Analysis
- user interaction
yes - max time kernel
103s - max time network
47s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
22/10/2026, 14:55
General
- Target trejjner-17-2-0-0-1_1715588582_518401.zip
- Size 5.2MB
- Sample261022-saffeafw2k
- SHA256 8a2d7f44cc2802e7ad021c84b2e8c3c2ad04c66d2759e86c6108a932cf9b7ca0
Malware Config
Signatures
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\trejjner-17-2-0-0-1_1715588582_518401.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Metro Exodus (+17) {mul0}.exe"C:\Users\Admin\Desktop\Metro Exodus (+17) {mul0}.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2108-0-0x0000000001830000-0x0000000001831000-memory.dmp
memory/2108-4-0x0000000001830000-0x0000000001831000-memory.dmp
memory/2108-3-0x0000000001830000-0x0000000001831000-memory.dmp
memory/2108-2-0x0000000001830000-0x0000000001831000-memory.dmp
memory/2108-9-0x0000000001840000-0x0000000001841000-memory.dmp
memory/2108-55-0x00000000018A0000-0x00000000018A1000-memory.dmp
memory/2108-54-0x00000000018A0000-0x00000000018A1000-memory.dmp
memory/2108-49-0x00007FFC12150000-0x00007FFC12151000-memory.dmp
memory/2108-48-0x00007FFC12150000-0x00007FFC12151000-memory.dmp
memory/2108-10-0x0000000001840000-0x0000000001841000-memory.dmp
memory/2108-43-0x0000000001890000-0x0000000001891000-memory.dmp
memory/2108-42-0x0000000001890000-0x0000000001891000-memory.dmp
memory/2108-37-0x0000000001880000-0x0000000001881000-memory.dmp
memory/2108-36-0x0000000001880000-0x0000000001881000-memory.dmp
memory/2108-32-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-30-0x0000000001870000-0x0000000001871000-memory.dmp
memory/2108-29-0x0000000001870000-0x0000000001871000-memory.dmp
memory/2108-24-0x0000000001860000-0x0000000001861000-memory.dmp
memory/2108-23-0x0000000001860000-0x0000000001861000-memory.dmp
memory/2108-18-0x0000000001850000-0x0000000001851000-memory.dmp
memory/2108-17-0x0000000001850000-0x0000000001851000-memory.dmp
memory/2108-16-0x0000000001850000-0x0000000001851000-memory.dmp
memory/2108-15-0x0000000001850000-0x0000000001851000-memory.dmp
memory/2108-57-0x0000000000570000-0x0000000000571000-memory.dmp
memory/2108-74-0x00000000018B0000-0x00000000018B1000-memory.dmp
memory/2108-76-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-73-0x00000000018B0000-0x00000000018B1000-memory.dmp
memory/2108-68-0x00007FFC14630000-0x00007FFC14631000-memory.dmp
memory/2108-67-0x00007FFC14630000-0x00007FFC14631000-memory.dmp
memory/2108-62-0x00007FFC12DD0000-0x00007FFC12DD1000-memory.dmp
memory/2108-61-0x00007FFC12DD0000-0x00007FFC12DD1000-memory.dmp
memory/2108-77-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-81-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-82-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-83-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-84-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-86-0x000002805FDD0000-0x000002805FDD1000-memory.dmp
memory/2108-87-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-88-0x00000000004B0000-0x0000000001821000-memory.dmp
memory/2108-97-0x00000000004B0000-0x0000000001821000-memory.dmp