Analysis
- max time kernel
149s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 07:27
General
- Target c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
- Size 683KB
- Sample261024-jalgzsav2n
- SHA256 c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 16 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe"C:\Users\Admin\AppData\Local\Temp\c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" qe Application /q:"*[System[(EventID=1000 or EventID=1001 or EventID=1002) and TimeCreated[timediff(@SystemTime) <= 604800000]]]" /f:text /c:80 /rd:true2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /dontskip /whql:off /t "C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082804\06_dxdiag.txt"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /all2⤵
- Gathers network information
-
-
C:\Windows\System32\route.exe"C:\Windows\System32\route.exe" print2⤵
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" winhttp show proxy2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" interface tcp show global2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" interface ipv4 show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" interface ipv4 show dnsservers2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ChildItem -LiteralPath $env:QIFAN_DIAGNOSTIC_SOURCE -Force | Compress-Archive -DestinationPath $env:QIFAN_DIAGNOSTIC_ARCHIVE -CompressionLevel Optimal -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\tar.exe"C:\Windows\System32\tar.exe" -tf "C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082804.zip"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_g2xdqvea.pzv.ps1
XYG-Client-Diagnostics_20261024_082804.zip
00_summary.txt
01_system_display.txt
02_process_windows.txt
03_critical_files.txt
04_startup_stage.txt
05_windows_application_events.txt
06_dxdiag.txt
07_display_update_evidence.txt
08_collection_manifest.txt
09_final_config_snapshot.txt
10_network.txt
dxdiag_command.log
ipconfig_all.txt
ipv4_dnsservers.txt
ipv4_interfaces.txt
route_print.txt
tcp_global.txt
winhttp_proxy.txt
memory/2492-45-0x000002CBB15C0000-0x000002CBB15E2000-memory.dmp
memory/2492-47-0x000002CBB1840000-0x000002CBB184A000-memory.dmp
memory/2492-46-0x000002CBB1850000-0x000002CBB1862000-memory.dmp
memory/4188-12-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-6-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-13-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-14-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-15-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-16-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-17-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-18-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-8-0x000001979E660000-0x000001979E661000-memory.dmp
memory/4188-7-0x000001979E660000-0x000001979E661000-memory.dmp