Suspicious
Rare unsigned ZIP with sandbox-observed process injection and credential-dumping behaviour, but only low-trust engine flagging and no tier-1 consensus.
2e2b0f1ad08795f77b…98f0a43f56The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The sample exhibits two offensive MITRE techniques (process injection and credential-dumping) that are hallmarks of credential-theft malware and post-exploitation tools. However, these detections rest entirely on sandbox heuristics and a single low-trust engine (MaxSecure) flagging a generic label. No tier-1 antivirus engine (Kaspersky, BitDefender, Microsoft, ESET, Avast, etc.) has flagged the sample, and external intelligence sources (CIRCL, YARAify, MalwareBazaar) return no hits. The dropped children are inspected but unconfirmed. The rare-new prevalence and unsigned status add uncertainty. This profile — offensive behaviour + low-trust-only detection + zero tier-1 consensus — is consistent with either a genuinely novel malware sample not yet catalogued by major engines, or a false positive from heuristic overfitting.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.malicious=1/67 reporting, tier1Malicious=0, onlyLowTrustFlagging=true — MaxSecure (low-trust) only detection
MaxSecure label 'Trojan.Malware.300983.susgen' is generic heuristic, no named family consensus
triggeredHeuristics: T1055 (Process Injection) and T1562.001 (LSASS credential dumping) observed in sandbox, but behaviour.hasMaliciousSandboxVerdict=false
prevalence.classification=rare_new, 1 submitter, 0 days old — no established reputation or signer history
droppedChildren: 2 inspected, 0 malicious, hasMaliciousChild=false; no external-intel hits (CIRCL, YARAify, MalwareBazaar all negative)
- All 17 tier-1 antivirus engines report clean or undetected
- No external-intelligence corroboration (CIRCL, YARAify, MalwareBazaar all negative)
- No malicious contacted hosts or domains
- Dropped children inspected but not confirmed malicious
- Process injection into legitimate Windows services (T1055)
- LSASS credential-store access (credential-dumping pattern)
- Unsigned executable in ZIP archive
- Rare-new prevalence (1 submitter, 0 days old)
- Generic heuristic detection label (no named family)
Isolate and monitor this file pending further analysis. The offensive sandbox behaviour (process injection, credential-dumping) is concerning, but the absence of tier-1 engine consensus and external-intelligence hits suggests this may be a false positive or a genuinely novel sample not yet catalogued. Re-submit if you have additional context or if the dropped children are later confirmed malicious.
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
- C:\Users\user\AppData\Local\Temp\jzmjqa52.3su
- C:\Users\user\AppData\Local\Temp\jzmjqa52.3su\WandEnhancer.exe
- C:\Users\user\AppData\Local\Temp\unarchiver.log
- \Device\ConDrv\\Connect
- Global\OneSettingQueryMutex+compat+encapsulation
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache.
- 2dcb964dff99bf331871…cd6b55Never scannednever seen before
- cf306d204d78a57ae2fd…ecc118Never scannednever seen before
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exe
1 detection across 74 engines
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- WandEnhancer-unsigned.zip
- Size
- 389.1 KB
- MIME type
- (unknown)
- Detected type
- ZIP
- SHA-256
- 2e2b0f1ad08795f77b8161276ef0f20063b19264ebaed69334349798f0a43f56
- MD5
- f35d2d7b2ea8afb88a5a971b98a4f9e1
- SHA-1
- 237cbd9d2462c96df5340d4c1b556345e33fdf7d
- First seen (VT)
- 7/2/2026, 4:46:51 PM
- Last analysis (VT)
- 7/2/2026, 4:46:51 PM
- First scan (MalwareTips)
- 7/2/2026, 4:56:46 PM
- Last scan (MalwareTips)
- 7/2/2026, 4:56:46 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.