Overview

overview

8

Static

static

3

sexseven.png.exe

windows10-2004-x64

8

sexseven.png.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    25s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/10/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sexseven.png.exe
  • Size 4.7MB
  • Sample261020-wpvqestsct
  • SHA256 96ea60b509ee205086e334d5fdeb0b1c966de4fdae84e52176e9ffeb39bc396d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 25 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\sexseven.png.exe
    "C:\Users\Admin\AppData\Local\Temp\sexseven.png.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Users\Admin\AppData\Local\Temp\~0E58932A.exe
      C:\Users\Admin\AppData\Local\Temp\~0E58932A.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn "WinHelper" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Helper\winhelper.exe\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4524
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Helper\winhelper.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Helper\winhelper.exe"
    1⤵
    • Executes dropped EXE
    PID:4052
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Helper\winhelper.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\Helper\winhelper.exe
    1⤵
    • Executes dropped EXE
    PID:904
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\fd5ed139c0384bd6a7bb3f3d952732ce /t 3272 /p 3268
    1⤵
      PID:836
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:412
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1012
    • C:\Windows\system32\werfault.exe
      werfault.exe /h /shared Global\117de3358e9a4abf87d96bf6130bef10 /t 3600 /p 412
      1⤵
        PID:4064
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5060
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2660
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:748
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3784
          • C:\Windows\system32\werfault.exe
            werfault.exe /h /shared Global\98f79bee2af84ba8a9e9766d5c4c32a7 /t 4916 /p 2660
            1⤵
              PID:4048
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4864
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2220
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:2736
                  • C:\Windows\system32\werfault.exe
                    werfault.exe /h /shared Global\8397853cd7ea408f9f1e15f26c4cf26c /t 4216 /p 4864
                    1⤵
                      PID:4920
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1768
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4552
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4936
                          • C:\Windows\system32\werfault.exe
                            werfault.exe /h /shared Global\e5fd6739e6844fe8b7d39473435c0728 /t 556 /p 1768
                            1⤵
                              PID:4716
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4684
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4784
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4732

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                        • Size 1KB
                                        • SHA256 522c22ee1f2e34dd38a7426f233f48f4a2bbb0af6c99ca7e45f1b130a6646acf
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                        • Size 471B
                                        • SHA256 3d90a57fb0eba986b0d2315613f8437316fcc50b0eee4e989a71d409fda378c8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                        • Size 422B
                                        • SHA256 98d2d8839c1d8935b33970208094011591e401187feac2005fb12f3815edbf86
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                        • Size 412B
                                        • SHA256 7c12fba4cb25023f1c5ff31738fb9037a85df47f2c4a285d46a5620f6148bcf4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                        • Size 2KB
                                        • SHA256 f6eaf8f071872db3f2a9cca4c68057a7abeeef0f7ff72505fe8b9b95987e64de
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        SettingsCache.txt.~tmp
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.~tmp
                                        • Size 670KB
                                        • SHA256 7c71e740fba5726a98453b2e1733fa5a0323ef12b5dde937f001ab084d3021fb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        microsoft.windows[1].xml
                                        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\C5KK0GV1\microsoft.windows[1].xml
                                        • Size 97B
                                        • SHA256 cb464987d444e646b09d9fdbe0fb8738131ca07c5b50a3ecad47374257deeefc
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ~0E58932A.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\~0E58932A.exe
                                        • Size 740KB
                                        • SHA256 b3eda00e6d6a68f74d039ebb30b4043cb21e391386b8735a887214e70f24ba15
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/412-24-0x0000000005210000-0x0000000005211000-memory.dmp
                                        Download

                                        memory/904-15-0x00007FF7BE5F0000-0x00007FF7BE64A000-memory.dmp
                                        Download

                                        memory/1564-4-0x00007FF688430000-0x00007FF688544000-memory.dmp
                                        Download

                                        memory/1768-365-0x0000000004F10000-0x0000000004F11000-memory.dmp
                                        Download

                                        memory/2660-31-0x0000000004F80000-0x0000000004F81000-memory.dmp
                                        Download

                                        memory/2736-206-0x0000019FD9400000-0x0000019FD9420000-memory.dmp
                                        Download

                                        memory/2736-200-0x0000019FD8300000-0x0000019FD8400000-memory.dmp
                                        Download

                                        memory/2736-208-0x0000019FD93A0000-0x0000019FD93C0000-memory.dmp
                                        Download

                                        memory/2736-207-0x0000019FD93E0000-0x0000019FD9400000-memory.dmp
                                        Download

                                        memory/3784-34-0x000001C201600000-0x000001C201700000-memory.dmp
                                        Download

                                        memory/3784-69-0x000001C2021A0000-0x000001C2021C0000-memory.dmp
                                        Download

                                        memory/3784-70-0x000001C2028B0000-0x000001C2028D0000-memory.dmp
                                        Download

                                        memory/3784-39-0x000001C2021E0000-0x000001C202200000-memory.dmp
                                        Download

                                        memory/4052-13-0x00007FF7BE5F0000-0x00007FF7BE64A000-memory.dmp
                                        Download

                                        memory/4684-519-0x0000000002C10000-0x0000000002C11000-memory.dmp
                                        Download

                                        memory/4732-513-0x0000027958340000-0x0000027958440000-memory.dmp
                                        Download

                                        memory/4732-518-0x00000279594A0000-0x00000279594C0000-memory.dmp
                                        Download

                                        memory/4732-522-0x0000027959880000-0x00000279598A0000-memory.dmp
                                        Download

                                        memory/4732-521-0x0000027959460000-0x0000027959480000-memory.dmp
                                        Download

                                        memory/4864-197-0x00000000030C0000-0x00000000030C1000-memory.dmp
                                        Download

                                        memory/4936-385-0x0000021A9D420000-0x0000021A9D440000-memory.dmp
                                        Download

                                        memory/4936-371-0x0000021A9D050000-0x0000021A9D070000-memory.dmp
                                        Download

                                        memory/4936-366-0x0000021A9BF00000-0x0000021A9C000000-memory.dmp
                                        Download

                                        memory/4936-373-0x0000021A9D010000-0x0000021A9D030000-memory.dmp
                                        Download

                                        memory/5052-507-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-509-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-195-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-362-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-501-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-198-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-508-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-194-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-510-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-178-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-177-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-33-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-25-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download

                                        memory/5052-16-0x00007FF640610000-0x00007FF64066A000-memory.dmp
                                        Download