d57460b2013e45bcc7480fa28e37a01bb3deb9fe7d501d04af75df7b1464f11a

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20251223-en
resource tags

arch:x64arch:x86image:win10v2004-20251223-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2025, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 3.0MB
Sample251228-pp53tsvqeq
SHA256 d57460b2013e45bcc7480fa28e37a01bb3deb9fe7d501d04af75df7b1464f11a
MD5 0e3f62828831bb50d95ef074e3054ca2
SHA1 6e4898ba392182d90ef2e4b2d7a1af79c1f73061
SHA512 29315a4aed33c0fa6f29d1dd140a9ed16930263b0b78705c4675d39edd044d84f88ca5ca9f6aa309c428a4005aa5b3b35b097eed5b337c868606e7a1ed59c212
SSDEEP 49152:cC52qVgj8kzvwhZveG7W8rSsoHHV4eJ1VF:cCPglwhkaXrSseBV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5340	Interval.exe

Executes dropped EXE 1 IoCs

pid	Process
5340	Interval.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	random.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5656	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Interval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1424	schtasks.exe
2972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe
5340	Interval.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 5656	3132	random.exe	84
PID 3132 wrote to memory of 864	3132	random.exe	86
PID 864 wrote to memory of 1004	864	cmd.exe	88
PID 1004 wrote to memory of 2384	1004	cmd.exe	92
PID 1004 wrote to memory of 5340	1004	cmd.exe	94
PID 5340 wrote to memory of 1424	5340	Interval.exe	95
PID 5340 wrote to memory of 2972	5340	Interval.exe	97

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SYSTEM32\sc.exe
  sc.exe /?alksjdfhjf834827435
  2⤵
  - Launches sc.exe
  PID:5656
- C:\Windows\SYSTEM32\cmd.exe
  cmd /v /c Set oaCF=cmd & !oaCF! < Fighters.dot
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\system32\findstr.exe
      findstr /V "Overhead" Ground
      4⤵
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\690563\Interval.exe
      Interval.exe c
      4⤵
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5340
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Stainless" /tr " rundll32.exe pcwutl.dll,LaunchApplication 'C:\Users\Admin\AppData\Local\SafeWork Solutions Inc\SafetyNet360.lnk'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1424
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "SafetyNet360" /tr " rundll32.exe pcwutl.dll,LaunchApplication 'C:\Users\Admin\AppData\Local\SafeWork Solutions Inc\SafetyNet360.lnk'" /sc onlogon /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2972

C:\Windows\system32\rundll32.exe
rundll32.exe
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Interval.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\690563\Interval.exe
Size 957KB
SHA256 02862289fbed08ab4a6e0cbf5bff34579827738aa8b01b388af3877184813b65
MD5 ebc8e59a17bbfc7b73365e3a6b4dac48
SHA1 b864a62b6fa7a2cd17207668469565da890177ce
SHA512 55d4466e3adeb6ef9fbccf766f421a390829265c96e2b84508bdbf939187002214424c1816e3824a8ab558de32944a8d9e4bfbb88eca23b53ff8dc0542b646aa
SSDEEP 24576:OpLy2+H1AvYVJjWrA4A73log5w3aHGrMB:OM2+H1A4jWq71j2rM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\690563\c
Size 916KB
SHA256 26d286159d7be2d80d4aa3d4f0bf94d534f0fbffbcc71b2a6466af16168215c1
MD5 2f2189242ec41a9d68cbbe39d4e3147b
SHA1 bbc767ea5f7ef653be81374dbb70375d769f38a3
SHA512 ec45b8f81f1c01e1479cbe14f454b5b0377f603244e7222505755bbfb132a5c8ba3cd2aa6d8c68fdcd9caefce8cdd405610aab777a6820fd3130a7cf6f50e756
SSDEEP 24576:nRqZd7KC5PvgLyC95Na6f6R69/9dQhFV7BCyhy:RqRKC1vbOd6+6VVny
MD5 SHA1 SHA512 SSDEEP

Submit Download

Contemporary.dot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Contemporary.dot
Size 226KB
SHA256 795654365fab4e558c238cacbb399e16012365bbc2ed228e04563a12005ed463
MD5 47f3cfbdf1da92b2464cddf5984d3a42
SHA1 8ae1779ceae97a62533389f2cbb36fe8fc7b76aa
SHA512 4dcf3f28eb16932835361b1d08d6e4de109e0bd169a36be2d0d488ad0101f5b478a6638c3f6e9d4d9a414deceacfbf92100a35e882bcf031cbd206883f4f5691
SSDEEP 6144:GXMUXJiQU2S+oCfZdca5GMwqCmQjBQjhgoA:4xJbjpfEa5zC4jhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fighters.dot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fighters.dot
Size 8KB
SHA256 d95e56ca0eb712c8a5c810286345b242a2d28fa7f29e58e17fabd7cb95ebf42a
MD5 db82f70a1c8aa938f8d9df62b92a7af5
SHA1 7139982f64d779c4f6db3ce76e45824893b323c8
SHA512 ca49a453bc7ae2fddfc732a75249b9d52a61dff2f920e1d378fd55337293a28e6661e3c19868959b647209729336ec3fc0fb5b53cdd43dc366a408be128b8146
SSDEEP 192:lrSEEWK+MyH4h/EenW3HZAYNhUWLrUgfKduOP1QqmZMTrmBJutx:luaqyKWJAYNh3UUKAONQeGux
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ground

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ground
Size 2KB
SHA256 ca488109b6cfe81645a705688441a55590d6133defef5411f3348f89350330d7
MD5 862f0991ccc3392c43f5e45e760cb8f5
SHA1 fde2188b90ad4134fa0b193c5390c16e43cac26c
SHA512 dfa3ed233555345f83dfbe9aca35314d57a2f569c5f2a5a9dce41a12ec86f8d026e9b44bb562f37b273468fbd54f89f78f3e23d51c748e8274efdad194f2b2b2
MD5 SHA1 SHA512

Submit Download

Indexed.dot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Indexed.dot
Size 196KB
SHA256 14c0b5278e874d32b6dac415f1e491d447221d5abed65e0d8ee960ee5dbbb5d2
MD5 0de55190f801775a4afae3710027f75d
SHA1 045094f67c46657cb64e9d427b50dfcea323a290
SHA512 3b37d6f765388600e0c3df9131e79dcf5c5ffc24cbe04eb87ade3bdc505b2df7e2a6edbca943822556492847476008a55df46921b7c6c6b9fb7e19749ed86e14
SSDEEP 6144:nRnadRleH+FLCkDz7AVx4ws+VuPw6exYGdKCO:nRqeqd7AVxFs6uPvlG8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Interior

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Interior
Size 346KB
SHA256 e4f304fbd57763a93f50b8e67aa2291fa48e05b1007d01c3e8b25a68e723d9f9
MD5 2fb5732a67165910932c06f7324f1447
SHA1 ebc439799028ffdf7b40b330bff3e5f5de2db915
SHA512 cf43d44528e43e78cd681120afc69ad5858629ca77b7bae2ece270b999c22b593b694edf0d5353c087483c87d3a1db67d44f66679703b4d37cb9351b4d2d7594
SSDEEP 6144:OYajZMZ/TAAf9JSnPN/FYJMb73dAKVOJLwfKkoyISRddLAh:OfjW/TASDSnPN/FYmb739cpkLogdLo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Photographers.dot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Photographers.dot
Size 194KB
SHA256 e62e8626437c037cfe0852409ac438979fbbd70edcae8458a4bfe53bdaea59b2
MD5 550a66fe140cb83592d7307899f079bf
SHA1 405004da2bbe8479d6ca189b09226855aa34a6c9
SHA512 13d4e58c8a89c9f96d3adb729a0f4d927583ad77410adb517c602e3719431b765ef3fed6b2538bac8e23aba70c8288f69aecd7552c9c608a50029c8186116325
SSDEEP 6144:DEk2RtMOgSJQlDWC7x889vwar+6qq6GbXNzbdqhU7:v/IRCj9w+9dQhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Principal

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Principal
Size 342KB
SHA256 c6c758b19e9cd7b9203804f12c699b8a076add8f7033bc026668bf3ae0e23b42
MD5 d6fafec3103659896e83d22e91eb0f8b
SHA1 4e1d1405b034aa4ec273812e9dd703af91809ef3
SHA512 deaf2ae404d3f2024a455073a1624e40f84c6ca75d8bdc78c4c156b7ee1379cc22ae468a3e3d1daf2a22ee6f4facd1b87de2905b5991b02f57bd2ee5b4bca4da
SSDEEP 6144:2mcLvyhtkv9axZHTx4pQf3WYSDoP8M/AOghDP2uAV5GPsu:2pL6h29iZHTxQQftAHP2uAVqsu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rl.dot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rl.dot
Size 106KB
SHA256 34cb09447bd6f8aa96d4f6e6234afecf89397c0234cd0698dfc1ad72057f1b4a
MD5 b37f2ecec8c3c6d56767dcc833fc46cd
SHA1 519394a842dbd3b41bff554a3ecf94348ffd6277
SHA512 46d4f2841bc61babc9558e8905813598e016a5593c7e8a1fcdf721e55f46adfa3da1a55aca43ddc8af701cb315420497cc6c6d87c5f3057645030342dcbb1111
SSDEEP 3072:Ug6ITXXS1ckbeKUvdo6CWOL3cf7Pw5jDSAb:UxwXS1cHdo6frfLwlDSAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sp.dot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp.dot
Size 194KB
SHA256 b8939d0a374c289d0e316201f25dabfc0055753b04c8466094df90d7a55e6355
MD5 97100faee0f63676d8b0d38c80c33c4d
SHA1 116e86b883a716fc068b09471b09aee06fa58e8f
SHA512 693f93e452f4a88e4583819ffbd070a12463c0dd96b2bc3fc90c668bd2353c3fffb26aa5698a134ebbd9e6818804757a608492b9a371b191416dfeba261e1de3
SSDEEP 3072:Hg8Y+cQdMMc8+5YZHdmgQBqGQoiBOcwka5iYPUZqI44ENbFMwANyNPszGZ07n:E+JyFg9yq1Za5/8ZgLp6TzGZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Syracuse

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Syracuse
Size 266KB
SHA256 7bdfd8e170f032f7f90392a696e5ded363b10d0612b22be90bbdd19c02654e20
MD5 a3e905901b4a1f38da39160e0a7b0d92
SHA1 7a1c148fe614767392a9526fda30fe6d9761a3de
SHA512 e2bef74b9e2af922a86c4e2de45da750fa48ddf9b260746f914d72e220457eb55e60af68dfb0d4dbead756df564ca4054acbdcc42a397574684bcf02e15f2eae
SSDEEP 3072:LFuz08XvBN3JaAt41PfaB6OJRkrJrRj4nHDWy4ZNorgK4+vQR3iJp6vS0eQ:0z04pXdO13aB6WGrRcHaBZ2r1T63Q6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5340-48-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-62-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-46-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-47-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-44-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-50-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-51-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-54-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-63-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-45-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-61-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-60-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-59-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-58-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-57-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-55-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-53-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-52-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-56-0x00000000007E0000-0x0000000000857000-memory.dmp

Download

memory/5340-64-0x00000000007E0000-0x0000000000857000-memory.dmp

Download