Analysis
- user interaction
yes - max time kernel
1799s - max time network
1492s - platform
windows11-21h2_x64 - resource
win11-20260911-es - resource tags
- submitted
24/10/2026, 17:33
General
- Target SGTSTAFF086LCON_2026-10-23_18_10_43.030.zip
- Size 5KB
- Sample261024-v4w2csv1gt
- SHA256 31ded568161d93258827caba67dd4164dd9974733939b90411bda32e72b5f0cb
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SGTSTAFF086LCON_2026-10-23_18_10_43.030.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SGTSTAFF086LCON_2026-10-23_18_10_43.030\Files.js"1⤵
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Send to.lnk.js"2⤵
- Modifies visibility of hidden/system files in Explorer
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
~earchHoverUnifiedTileModelCache.tmp
~earchHoverUnifiedTileModelCache.tmp
Send to.lnk.js
memory/752-22-0x0000026E69570000-0x0000026E6957A000-memory.dmp
memory/752-21-0x0000026E66FC0000-0x0000026E66FEC000-memory.dmp
memory/752-23-0x0000026E695A0000-0x0000026E695A8000-memory.dmp
memory/752-25-0x0000026E69C00000-0x0000026E69CA8000-memory.dmp
memory/752-26-0x0000026E69830000-0x0000026E69852000-memory.dmp
memory/752-27-0x0000026E6B000000-0x0000026E6B102000-memory.dmp
memory/752-28-0x0000026E69800000-0x0000026E69814000-memory.dmp