6c5087d06021234b772afefdacfad8da2cf0a085bf2392ec2ad60f7544fc41f4

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2025, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.exe
Size 1.9MB
Sample251104-rtb2natpdq
SHA256 6c5087d06021234b772afefdacfad8da2cf0a085bf2392ec2ad60f7544fc41f4
MD5 072cbb5142aa12a4652b5f27b609f071
SHA1 fa3a65302b2c2dc9efc9353f41fc7d5350811a6a
SHA512 e5c9865aaaa6f70c8c3035331d42093081d044a7cc9720cfa49ffa7af207dd1c4a070f59f47134da80751355f1e60112a0fcb0e8a621b7672bd4153dab591ca5
SSDEEP 49152:OpBfaB8QYXxup79SCR6y+239YXF/An9L86Ru1dRWrG:IaqQ9p75wMS1on9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5196	Avi.scr

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	update.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
260	tasklist.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avi.scr

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4224	4332	update.exe	84
PID 4332 wrote to memory of 4224	4332	update.exe	84
PID 4332 wrote to memory of 4224	4332	update.exe	84
PID 4332 wrote to memory of 4568	4332	update.exe	85
PID 4332 wrote to memory of 4568	4332	update.exe	85
PID 4332 wrote to memory of 4568	4332	update.exe	85
PID 4568 wrote to memory of 260	4568	cmd.exe	91
PID 4568 wrote to memory of 260	4568	cmd.exe	91
PID 4568 wrote to memory of 260	4568	cmd.exe	91
PID 4568 wrote to memory of 2184	4568	cmd.exe	92
PID 4568 wrote to memory of 2184	4568	cmd.exe	92
PID 4568 wrote to memory of 2184	4568	cmd.exe	92
PID 4568 wrote to memory of 3496	4568	cmd.exe	94
PID 4568 wrote to memory of 3496	4568	cmd.exe	94
PID 4568 wrote to memory of 3496	4568	cmd.exe	94
PID 4568 wrote to memory of 5196	4568	cmd.exe	95
PID 4568 wrote to memory of 5196	4568	cmd.exe	95
PID 4568 wrote to memory of 5196	4568	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c move Conspiracy.wmv Conspiracy.wmv.bat && Conspiracy.wmv.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- - C:\Windows\SysWOW64\findstr.exe
    findstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2184
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Tomatoes" Fitted
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\139408\Avi.scr
    Avi.scr H
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Avi.scr

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\139408\Avi.scr
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\139408\H
Size 1.2MB
SHA256 4607374e7bde056538234731f1d90618d35250b3c950defaf7037f4fa4a46644
MD5 1909162ebb3ef9d7cda1fc549462a2bd
SHA1 22b35a1fe90431f4a9a0316f270b5b1fc89de76d
SHA512 80da1c0ff7d790c34cd6aae4c7403446ecdeb583b32a46daa51ac5a5f3888bebfca7f6f0d8e04d57e4bb8a310f9e8cacff8d4b35b74b5ac9c9df1096679bad65
SSDEEP 24576:7SvtnD9QBcLDEooa7JFZOuqkYz6rxudt0ci64R2CyW23k:7Sv99QBcLDEvyfqkYgxub3B4RjyW20
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cards

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cards
Size 54KB
SHA256 b99045b0796f27c3ea57ae5f807df027920b1f35d6a0431e25962908a2bb66e1
MD5 ff42b357c759e9540d7ea6c2c9486616
SHA1 48cd6496f5e7eae17973496df9a65af952056745
SHA512 f29a95ffa82af6715e9fe680ab5ed0489f9a2a575a95fcb312a26c6b540f9dda90bcdc77029e9fc2a8c877fba9c4ce130ac35681bfc4de67accff222c7f6ec6f
SSDEEP 1536:iCygeLnE+7ZgWb50olTwZVADSqdO6WjI8trB9GMYT+z5BWVI:iCylLnESeAWqdUUUrbGMYT+zGVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceramic

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ceramic
Size 135KB
SHA256 bf7c09f3bcdc1245a64ce28cb55d5922b15efea01cb3c09c6398899d3a39065f
MD5 228c670e7f62278c44814fd5fa4a4fcc
SHA1 5337b3d5742cc09ac0e95497aa0021633fd84dc7
SHA512 3b8d2bdedccb9105a543e1724add2af6d823cbda0e8fa91a8949c881a2aed453b7e89d01960e8d2c8ffacb902320d7534f5674b74368dc62858e503db5c69e9b
SSDEEP 3072:J8KhbzcIVg8Ac3RhvK2D9pAsxsj4MgY51ZO2wg0IAg0Fuz08XvBN3A:vrRhvK2hewsAZIAOz04pS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chain

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chain
Size 90KB
SHA256 7d8d95cb7fd73ba67a4a03302f5a09f865f9675774d9294e84f7a5d0fcf8f3e4
MD5 6eafa8faf7d744cda9a79dcb001241ec
SHA1 0908cbbc9d185cb91284f7501dbff8319f31bd9d
SHA512 c63483bb0a59edb09951188802c3e44a68bda2f058c1bb2c48b54f71e094827bcafe8849086e71ee8546a32e0bb3ec2c1f79d10ec09a86770edf5603f8a39aba
SSDEEP 768:Wu2xhSaAwuM2c/mex/SGJaG+qAGWRqA6n:Wu1aAwuM1PdJaG+qaj6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Clicking.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Clicking.wmv
Size 286KB
SHA256 60e9f47af65d2244d451505f9c555a4d4deb2c3f998986ee1d9870587bda52db
MD5 8216874a74bd28e59e8761c8d951bac5
SHA1 389edd59d6df4cc25824a9bdbc945e12ef8aa90b
SHA512 fa38c2fe4d26bc83c0dbf9f3613376b78328bc97d672c4358afd9009192c5e0539fd20c06d39edc6c15c632084ab715de7e493fafb4cd144906490cc24a52895
SSDEEP 6144:zw2lRZF7GD3naJgPaXv7l1QaDiijo5rLlL:E2rGbc3l1nDiijo/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Conspiracy.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Conspiracy.wmv
Size 12KB
SHA256 7e48acc6f49f0c6ba559ac24d3dfbb1dcf35e8e5026011247f45c13382216ea4
MD5 aaa252d5e6310668b5defaefcb043c95
SHA1 6e22287e206df37bab772019d08fea074bbc5e11
SHA512 a4bcff2aabfa6726c4ddef55f43e2716249fae9e8a7ebf4e462002f2ce86acc0e976512710375b8aeefb7404d197c0bc96ff3ddb5ef13c77e5fdb33af5e5d274
SSDEEP 192:8kYXnXGCKQ2UCOVkp/nI+JbbNPySmwBufDZKoiob4cud+I861zAYM2BUcZLkLoZy:8LXkNjzp1bRPZu46cd+7YV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Definitions

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Definitions
Size 79KB
SHA256 c942c0431788f2607b396ae64774b09139d3083ae404d0afe129b753aea14226
MD5 bf998ae918d8270b675f4e117fb17e75
SHA1 8b5b10c96ae0d04b16aac1f0557012b0b141b1f5
SHA512 9a3dfcecef14147159b8cf6bf686ef1e498b35e4a3ce876cb2da0d3a7545c1af50989171dd2cc474c68148b830724c195fe0f8ef6b3d6443ba4a025651e02e55
SSDEEP 1536:RbNYI8lbn4nOkC7ER8eJB5yvE4Z7jbwCdtjE+LKw2MzrK:fS84heryWCHj92NJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ent

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ent
Size 103KB
SHA256 c2c2307002aa4ceceae2a973d12583d623baf7262a165456a4813a1f2d4e6ec1
MD5 79e02f19fb80b152f55afe0dc0d18d52
SHA1 89b90e6cf5f5e4eb991357e8141978e85db88fa5
SHA512 562754fbaef5d8b0ebc1ecce26be7e6ba6c3353f0e8eede5da0667d28eb1054d09b2dd1c18fd903cf874d2bcb628f4f3b3114c89c23aa789491e91fb90faa564
SSDEEP 1536:oqdADjK1T9kP4TZY5CSzdnscGMskcJ5i/1LP5Eu6vK2lh2R23s5quh0zcNziJa:cwTZY5Jnxdd1Eu652R1h0z/Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Examines

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Examines
Size 120KB
SHA256 7b814f425661a3511695a920650f5ff5b4d0aabffdda280d87e2b2fdd077f051
MD5 eb2f99e0d8948b4c1495ee55e11bb5f4
SHA1 5eb3c20d85947ddea38c1d1dbe997d6b17281f72
SHA512 0632847731cda548eb9d681796b5c891abd0f33765eb7e6c4cdfb54b976dd4638640d72d5988864f2a9acf91355d7f125bf01dd792829cfde2d4c1ef5de7bb02
SSDEEP 3072:J3xEeTZovSQo67A3MDhpSxAOghHjZZ2u8sPqpriGrw:J3VYSQoP8PEAOghDL2u8txw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fitted

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fitted
Size 1KB
SHA256 91c6d25fe40e58bbe36b5251ee976c5a10bf25934e74bf4c1b31a75cdb0a8652
MD5 59e217fbe0f0529319aa78e96bb26aff
SHA1 af5d863f0afa23413f856347e9f90e2a51dfe0b6
SHA512 2ba147167dea9ca1d9315bd45095b6085b7741fdfadba285e57b4e5bd4cdef3101ec4f6412be3df2a081a05e3a6733e301050a0766073b1b13a64c90b14ada15
MD5 SHA1 SHA512

Submit Download

Harbour.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Harbour.wmv
Size 135KB
SHA256 4fdf5b9e1254407c28f38611dc9d56367f2aa7b0604e395ba6d928d85f69c655
MD5 34c282d98a47b933471cfc736f155658
SHA1 70a0e0e4486aeb5c80da662f369515a5557a24dd
SHA512 3f1b132a194e5e4e97e276181a521807af7d00751ecf2da5f8fda25ab98f7880e36e6edaef1961d6c8c9c244b48682db1cb14303a2e15b57f87074125a441f6d
SSDEEP 3072:mjLvhEx3ohPHY0avzexz8/vl4y2nZhsQNrwUSX3vdMLqZd1xuYCn:mhRBY0wD/vqyQhd23vnZd1xE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maintenance.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Maintenance.wmv
Size 262KB
SHA256 50c4b351e6fa10099476e82ac163a420ca335b1a0634cf1f05d627b0fcfe6a69
MD5 0c27b825bec44fc9f794cebecca9faa4
SHA1 a565f7583f63b92a109c0a38192b698b5c53ea95
SHA512 34ad07e044f1832449d251e3edafa32ca1b22a3aae6828c74284b3e79dd5cbc553c95b77a6331ad3a2827aea69543515f0d76dce44daa0f769c8ba5e7ee86d82
SSDEEP 6144:ghGrPHO8b7+qvAcRMlul9MP01Zmjm6vtxrx+fOoQHkH:gopvcYl96XtxrxuddH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pub.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pub.wmv
Size 152KB
SHA256 73d111b7fc8f2ec6c6f001d5d9099fc37309252657b38ab03e65b1eed2cfd93b
MD5 59a63c11abc7ebe0ea76a4cca88dd340
SHA1 3b38b5e8abb102e8f9057eb62790f839581ab9ad
SHA512 8f509b742a939a386903244577a9114aeb07e0224d9e686555e07a2ad4b4307067725cb1be6c1932c008e398c645eb5e4d185e401e8ddae06c7e3c0cf12eafcb
SSDEEP 3072:VdjJovA9EQEhqNeJKsv3ZZgYEZl6+NfvGxSah92G9CmrhP5K7YY0:7jGvGTsbvnrEbfASah92G9F1eYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Son

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Son
Size 40KB
SHA256 785da162d10ff0404e482bae15b64abf183fb662e2ca2a6a506df746b670460d
MD5 601399cc929ab6a9737baa09bc158919
SHA1 302f5784f276991b83b8b0a0a3fb6069fbb2a2f8
SHA512 242a1dd0472ab782ea5f01b4f9b8827ae0b429e77016c2029fb5c5896d75f4271fd146e47cbf28aaf45304c204903d4a2459d706b3ef1f48e88ce0cf0c804c9a
SSDEEP 768:+RXBLZKKz0zyiTIvoZvHiY+eZ3+cvC0WOHpecM5R95JXtyn923tJfvSO2TalmDVJ:moKz0+vvohHPF+iC0WwQcW7LK92fvSD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Span

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Span
Size 115KB
SHA256 b5c1cce29abbb9893da072fb0b5ad96759fcbe8d78d127307059124badb960ca
MD5 1668c7bad2fb6dd72b1b806b95331d45
SHA1 ae32449c8651eb865590c71072764b6a7b06b7ad
SHA512 ba19a645079daa607c6272518a0a563d76fc5467d808de17a78b5c4cc82406e25d0a12410968a72949727b07b9d2b59112af691d0d948ae9b296d60bb6a55f7c
SSDEEP 1536:vi4znFLNpH9TBAxJNO1HWevW2E5cG82lhGIEMJpvwNVs6v6Uc4ygU7TcPYOa+1bi:vRbdWg1Hle2EFhVJpkVpv6UcXTvh2brO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stan.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stan.wmv
Size 173KB
SHA256 6282372f9f2cd45b4ba90f9339ca44b4158178c9c5c337a2fea703f34e5190a8
MD5 ff4daca01a73c56ee645eeb11105d050
SHA1 ce919149bd326e35aa8cc481890d2ea5093bcf24
SHA512 23cc1ba3dba356c9f84384046e14e57c1858682866e682a3508317177560d5508256408575d53a261b4e8ddaaa5a27202e8dbe271f1febdd0e3d1300b737652d
SSDEEP 3072:CWvl1bHCEtEMV9XmsggIk+NhohetEREZTjtmB5Wg353zVLB+3DeRWsgulOZD6QvS:VPHntPPXDNletMEZHQqgRrmeYsml6gUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Supervisor

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Supervisor
Size 113KB
SHA256 b5a63e01bd5ce8e5aedac0bef0fe611cd97bb3e82db6a17b4a4a915b59b22152
MD5 04409eb06f3f5d6d2b19df2cd3c762c5
SHA1 b1c085a7c06f64d8ef1d391f63457a15a6341f9b
SHA512 775dcfb6f509bd568c2f9d45297637e11a97a15e6335130e1ade99cf3fa205611aec93d95e202658627415fbf6f891c158c30d866632dce4135f58504161fbcb
SSDEEP 3072:ESVrRvAFLs90OvRuwR7RQOICiJt+Jd+HgYkP:ZrIzOZuwtR4+Bh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Underwear

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Underwear
Size 106KB
SHA256 175175340334bf9543d04a956e7ed3e59ed93462f839a425cabfb3ce37629e38
MD5 d4629a07c571f6dad34fe1967e6a3483
SHA1 e30812cdd1b7e91ecca441d36a0bf1d1529266a7
SHA512 52552ba817cfc2aafca5a03e0570bdabbbd68f15ac2073556aac7f57e168ae6c815c10bfc463952612be361ece89045a78b339764a9b113b7c74b9ba070bc779
SSDEEP 1536:bs8jcd/TcWwsTAXkrfhrRj3oQV3EYrDWyu0uZo2+9Br8:ORYkrJrRj4QVDWy4ZNor8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variance.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Variance.wmv
Size 174KB
SHA256 0c7230d24da04c3f7ef9d2ff02eac52180b7d250619b85468720b508b7d2837b
MD5 ef659fea5a4a62f3f176fbb72f2d8e30
SHA1 8ebbdcb9ebf54908466c98fc04c2bfcef4c5493f
SHA512 e3549e902e821f9e9af3b07469cf993e46db7d61d72e3f0299577dd8b57a62e8f21837a902c08d5aade0bfd15729b4d32eb8f69fb67d30ce60799f08a756990e
SSDEEP 3072:ff8U+i+Q2ffoRtMaJ8CWg3akILFL/qSYY7/ngUKCuvjKMpsM:ff8HzffmiaOCWg3ak2mSYY75ZuLKMpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads