b9ef0ed33dca715c1ce5f865f93f9de46f3c49a6ecb23882a54c61b588dc5efa

Analysis

user interaction
yes
max time kernel
16s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
123.exe
Size 189KB
Sample261107-sj5rnacy2x
SHA256 b9ef0ed33dca715c1ce5f865f93f9de46f3c49a6ecb23882a54c61b588dc5efa
MD5 9a571d6843c4f091e89cbc101d582a40
SHA1 229e17002a1c814194b8f09e6b31a1c8511aacc5
SHA512 ac99b61c83e1ff6a452d9a97f312fb6553885e49cd605e623b74341172ca757969d181f0474ca1991b01017e2679f20ebe9892cb9ae34b05336556bf733d3fb6
SSDEEP 3072:MyCtwCpCA20RQ6vN+s7h/9amsb6NVqsv42jnLNrUhOKsJgNjO7Ly/janktAowi99:My8cAc6vUwar6NVlrjNUhO5Jp7m/Vt57
TLSH
T1DF1412D0B7E5911CC2BA037034F65719A337E4A6EEE1CB5A54DE0A10AF827B56704BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1280	123.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	mountvol.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2868	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	123.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1380	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2868	powercfg.exe
Token: SeCreatePagefilePrivilege	2868	powercfg.exe
Token: SeShutdownPrivilege	2868	powercfg.exe
Token: SeCreatePagefilePrivilege	2868	powercfg.exe
Token: SeShutdownPrivilege	2268	123.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	123.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2268	123.exe
2268	123.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1380	2268	123.exe	81
PID 2268 wrote to memory of 2868	2268	123.exe	83
PID 2268 wrote to memory of 1776	2268	123.exe	84
PID 2268 wrote to memory of 4088	2268	123.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "123" /tr "C:\Users\Admin\AppData\Roaming\123.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1380
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /s
  2⤵
  PID:1776
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /d
  2⤵
  - Enumerates connected drives
  PID:4088

C:\Users\Admin\AppData\Roaming\123.exe
C:\Users\Admin\AppData\Roaming\123.exe
1⤵
- Executes dropped EXE
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.exe

Path C:\Users\Admin\AppData\Roaming\123.exe
Size 189KB
SHA256 b9ef0ed33dca715c1ce5f865f93f9de46f3c49a6ecb23882a54c61b588dc5efa
MD5 9a571d6843c4f091e89cbc101d582a40
SHA1 229e17002a1c814194b8f09e6b31a1c8511aacc5
SHA512 ac99b61c83e1ff6a452d9a97f312fb6553885e49cd605e623b74341172ca757969d181f0474ca1991b01017e2679f20ebe9892cb9ae34b05336556bf733d3fb6
SSDEEP 3072:MyCtwCpCA20RQ6vN+s7h/9amsb6NVqsv42jnLNrUhOKsJgNjO7Ly/janktAowi99:My8cAc6vUwar6NVlrjNUhO5Jp7m/Vt57
TLSH
T1DF1412D0B7E5911CC2BA037034F65719A337E4A6EEE1CB5A54DE0A10AF827B56704BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-0-0x00000000009E0000-0x0000000000A16000-memory.dmp

Download

memory/2268-2-0x000000001CDA0000-0x000000001CDB0000-memory.dmp

Download

memory/2268-6-0x000000001CDA0000-0x000000001CDB0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads