Overview

overview

6

Static

static

1

jmxxkhns47...fb.exe

windows10-2004-x64

6

jmxxkhns47...fb.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/10/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jmxxkhns479fmm1vxt61rpk61j5dfb.exe
  • Size 116.9MB
  • Sample261026-wwpgzsbf72
  • SHA256 6dc27f072922e29741f32163990e53ac38f38fd1c275bbdca27893ffee8a00b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jmxxkhns479fmm1vxt61rpk61j5dfb.exe
    "C:\Users\Admin\AppData\Local\Temp\jmxxkhns479fmm1vxt61rpk61j5dfb.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6032
    • C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.exe
      "C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.exe" --veloapp-install 0.7.5
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4592
    • C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.exe
      "C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      • Suspicious use of AdjustPrivilegeToken
      PID:5972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        faviconV2[3].jpg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BBF28RIN\faviconV2[3].jpg
        • Size 879B
        • SHA256 c4d24b6d00069c2c95de835e51dabd2fdc94328f0a521e9df8c5be24569abdf0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2[4].jpg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BBF28RIN\faviconV2[4].jpg
        • Size 1KB
        • SHA256 78d2e3313ac043b6d6d11fe57a6109d8ad43803ecb88c1672f82ef7688ae8cc2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2[8].png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BBF28RIN\faviconV2[8].png
        • Size 519B
        • SHA256 1a81fbfbf0a8efe0a8a9a16f0951e679dbbda131fe014a150176056199968e06
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2JJNC5W5Y.png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L1V6K5E2\faviconV2JJNC5W5Y.png
        • Size 990B
        • SHA256 1c9bb61cd09e2f3d06907b7bd4973ecbf5ba8e99be05b2e134b022fe748df5ba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2YCT1V5I1.png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L1V6K5E2\faviconV2YCT1V5I1.png
        • Size 718B
        • SHA256 68cab71cb5fdc47c02cce3410ed97850e1f646edc9a5cf91b359a3d64b9e7114
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2KRKX252N.png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q2Q51FI5\faviconV2KRKX252N.png
        • Size 1KB
        • SHA256 ce7e8cafe276c4d6820387652d77437772fb2efa7511bff92a4e7664cd2bee51
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2[3].jpg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q2Q51FI5\faviconV2[3].jpg
        • Size 1KB
        • SHA256 bc3edc8cdc5cd950f3fe5a5ff412677d9ec240e712562ee0e3c3e4534a63c310
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2[5].png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q2Q51FI5\faviconV2[5].png
        • Size 2KB
        • SHA256 9c77e50630e526dd36c1295dbc734e121c5ebc6fa27ca3f8ad601ae461d0a492
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV29SC292EJ.png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WR34X31D\faviconV29SC292EJ.png
        • Size 177B
        • SHA256 33a03200b71055b3eafcd46496b977612b1e28f828bdc2eaf1f8c78035ccc6ab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        faviconV2ERDM1Z67.png
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WR34X31D\faviconV2ERDM1Z67.png
        • Size 2KB
        • SHA256 40dd6930927366564a50859931a798f0085920cccda1a34fa947ed719e7e0bcf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        applications.json
        • Path C:\Users\Admin\AppData\Local\WinOneShot\Config\Versions\26.10.07\applications.json
        • Size 88KB
        • SHA256 5072ff3f3b4c689db313000c8ef7ff93c655f5cea55c5990192ead87789ecf41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        feature.json.version
        • Path C:\Users\Admin\AppData\Local\WinOneShot\Config\Versions\26.10.07\feature.json.version
        • Size 8B
        • SHA256 3d1d6d962356db5819cf31b05f05aaf462a441253a9b59a7cef315a4321e01b4
        • MD5 SHA1 SHA512
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\Microsoft.Win32.Primitives.dll
        • Size 15KB
        • SHA256 6c21472b0ae2f9b484a97614fad5485a22f18f9f19ee1adb9ceb3ed8ddb072d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.WinUI.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\Microsoft.WinUI.dll
        • Size 7.0MB
        • SHA256 e6150e1510eda90a70ada1c6b80996c74b8e2926387f2e719dd8c6d56cca5a6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.WindowsAppRuntime.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\Microsoft.WindowsAppRuntime.dll
        • Size 2.2MB
        • SHA256 b35802467c3cba9fb0ab66492e3504bed91c25fbbc278732c1466ffc0a664f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Collections.Concurrent.dll
        • Size 225KB
        • SHA256 082f4bc0da1141eb65111b6da633d75624adfb7bb067d7ee90c5622c8b30885b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Collections.NonGeneric.dll
        • Size 101KB
        • SHA256 aa4d5216d066c91cb489f63c6cbfcaf1f47b6e74e070db45639d3460454fc60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Collections.dll
        • Size 289KB
        • SHA256 df6f2037eabee28100184e92f7536427ba2f086c1110629804d466b124bc4d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 1e2451184c287409ea25acde3c90f25950bf34d16458a6e52a94ca4292434f62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Diagnostics.Process.dll
        • Size 321KB
        • SHA256 51a57fbe918f8b68930c090792b718fc0850ea12da869d50b97a3796af29a740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Linq.dll
        • Size 681KB
        • SHA256 284d38945b6e92e847129bd28af458b19818d0f2181f79882888ab2003f4c519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Memory.dll
        • Size 157KB
        • SHA256 f8f9d38efd6b0de30954d6bf1f353e9617bfb36d3d245c013a3b12be9f6bd88a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Private.CoreLib.dll
        • Size 15.3MB
        • SHA256 1125acc8106c43fc8bad2d203c4c4485df6182d292846c2fff415c1040c54678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Private.Uri.dll
        • Size 249KB
        • SHA256 b15c84d2120e1ec9612c66ba59bc3d7e67d841e2bce7b7d0478cb212537539b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.Linq.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Private.Xml.Linq.dll
        • Size 381KB
        • SHA256 c832b73de9783e6929ca5ff4863fc313e13ef7cfb5965c52587c4f77f6e037a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Private.Xml.dll
        • Size 7.4MB
        • SHA256 d71e72a7a9de324352edd281a46466b51bd0bdd2831b1573f8d3bae8bd2dd4a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 e5eb1679f3579c9141e2bb9dbdce62624a623f38d299805cc1de07bacd21841f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Runtime.dll
        • Size 43KB
        • SHA256 76be53624f64b23d0249dfa0bbe85390086de7c44bfd490642ea86c6faaf44af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encoding.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Text.Encoding.Extensions.dll
        • Size 15KB
        • SHA256 8f51b9535db64fe027a40d6076200b1a6b0889bf05f62bb8e68c3eb083c7f113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Thread.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Threading.Thread.dll
        • Size 15KB
        • SHA256 ce71949bb1ea67b686e799128582015ebf8758f1107e59e43f342ece3f662930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Threading.dll
        • Size 81KB
        • SHA256 6c32ed1bf8067e4169e8feddd15e6489b89d19d1c7aae1520a551b57745d0a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xml.ReaderWriter.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Xml.ReaderWriter.dll
        • Size 21KB
        • SHA256 8e48fed4d12bcffff01e8059caafb564697275797d2f5ec6823fdd82b87fe938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xml.XDocument.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\System.Xml.XDocument.dll
        • Size 15KB
        • SHA256 3ff858607de5146051498a7124ef983bea280d86e165f993516c6c26af81cfb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Velopack.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\Velopack.dll
        • Size 272KB
        • SHA256 f4c6280e5141b91fdf7d62fcef96d65c6250fe72368ee2a1477343e9784cdfae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinOneShot.deps.json
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.deps.json
        • Size 109KB
        • SHA256 48a407252842121245201932e07618db910c6d7012df8efa2d34e99f30202a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinOneShot.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.dll
        • Size 1.3MB
        • SHA256 2a03da60ee1a975b01758ed0286138435154f2cbc8ab8a05141e6347dcb6dd2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinOneShot.exe
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.exe
        • Size 297KB
        • SHA256 c57d2c773dbeff688d5c31fe43f462e852fca28a152ef65b3dcdfeb4131c1ceb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinOneShot.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\WinOneShot.runtimeconfig.json
        • Size 586B
        • SHA256 f4a0dcbcb74b0c9b864590a01b8f212f5c1ddd4ad694237442d0779f1db54334
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        WinRT.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\WinRT.Runtime.dll
        • Size 516KB
        • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\clrjit.dll
        • Size 2.0MB
        • SHA256 0749d8fc8e944d0576e1bb47120f87add8f875e5cd8968995633063fc79256f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\coreclr.dll
        • Size 4.4MB
        • SHA256 128aee8c62a673d64739e585e3876b61133571cec83a46240a62581d5465639b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\hostfxr.dll
        • Size 370KB
        • SHA256 838591885c5396fb0588a3aedc2f3e841d3afc67570868b1bce615264005a44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\hostpolicy.dll
        • Size 369KB
        • SHA256 e92a2e71eeeaf7c574e905935b3e3724ef29bade44317659dbe06f505e99dbe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sq.version
        • Path C:\Users\Admin\AppData\Local\WinOneShot\current\sq.version
        • Size 553B
        • SHA256 322e144be226f5def2e62778c432ae91855b7dbb5e410723d69cd0f6e0f95637
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4592-1121-0x00000157207C0000-0x0000015720A06000-memory.dmp
        Download

        memory/5972-1563-0x000001C513110000-0x000001C513356000-memory.dmp
        Download