eb9cd9b17479dbf69bd96f9dfe440b46df29a8b5dde7997e5c3da3fea7946827

Resubmissions

23/04/2026, 18:08

260423-wq9kzac16p7

23/04/2026, 14:08

260423-rfva3sew2k7

Analysis

user interaction
yes
max time kernel
644s
max time network
564s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medtrans-setup-1.6.6.2.exe
Size 4.7MB
Sample260423-rfva3sew2k
SHA256 eb9cd9b17479dbf69bd96f9dfe440b46df29a8b5dde7997e5c3da3fea7946827
MD5 a44ce0777e19e0b7689c8abc5bedb7da
SHA1 bac8248f0b842fcab372d0d7fecbf40488ad1b7e
SHA512 3a7edd42e8721c056fc0b1a712f21ecb736ef847796c5f22ed2fd09e39d3e2eba7933c5a3ed01af51d07edaa4d9c53cf2b3f1003ef835922f759bc208699cda8
SSDEEP 98304:7J+stMSHhhe6HLWSK6kTdZh1EDFHoTP236K85h/qvizq:t+kMog6pKrt1+HobW6VCv6
TLSH
T1873633493E59C5A2FA3AFA751D79DE75E162242939058CC2B0FDFA8D38C14F0983E1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery link pdf persistence ransomware spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	medtrans-setup-1.6.6.2.exe

Executes dropped EXE 3 IoCs

pid	Process
3180	shelllink.exe
3520	medtrans.exe
2904	medtrans.exe

Loads dropped DLL 2 IoCs

pid	Process
3520	medtrans.exe
2904	medtrans.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Create_Icon = "c:\\medtrans\\shelllink.exe c:\\medtrans\\medtrans.bat c:\\medtrans\\medtrans.ico"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\SET4782.tmp	rundll32.exe
File created	C:\Windows\INF\SET4782.tmp	rundll32.exe
File opened for modification	C:\Windows\INF\medtrans.INF	rundll32.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x00070000000243a8-41.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	medtrans.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	medtrans.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	medtrans-setup-1.6.6.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shelllink.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4352	NOTEPAD.EXE
1736	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
3520	medtrans.exe
3520	medtrans.exe
2904	medtrans.exe
2904	medtrans.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
4480	AcroRd32.exe
3520	medtrans.exe
2904	medtrans.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4988	4960	medtrans-setup-1.6.6.2.exe	93
PID 4988 wrote to memory of 472	4988	rundll32.exe	94
PID 472 wrote to memory of 3180	472	runonce.exe	95
PID 472 wrote to memory of 4056	472	runonce.exe	97
PID 4480 wrote to memory of 1996	4480	AcroRd32.exe	111
PID 1996 wrote to memory of 3308	1996	RdrCEF.exe	112
PID 1996 wrote to memory of 1644	1996	RdrCEF.exe	113
PID 1996 wrote to memory of 1644	1996	RdrCEF.exe	113
PID 1996 wrote to memory of 3616	1996	RdrCEF.exe	115
PID 1996 wrote to memory of 4000	1996	RdrCEF.exe	116
PID 1996 wrote to memory of 4000	1996	RdrCEF.exe	116
PID 1996 wrote to memory of 1236	1996	RdrCEF.exe	117
PID 1996 wrote to memory of 4300	1996	RdrCEF.exe	118

C:\Users\Admin\AppData\Local\Temp\medtrans-setup-1.6.6.2.exe
"C:\Users\Admin\AppData\Local\Temp\medtrans-setup-1.6.6.2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\MEDTRANS.INF
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\medtrans\shelllink.exe
      "C:\medtrans\shelllink.exe" c:\medtrans\medtrans.bat c:\medtrans\medtrans.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3180
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:4056

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:4788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4280

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\medtrans\medtrans.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4352

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\medtrans\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\medtrans\medtrans.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D50E3E78F82B9A00B33D950AD4245DD0 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=03BF12168F5FD143BF5435DDDFA574C4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=03BF12168F5FD143BF5435DDDFA574C4 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E428D6C7E92B48F1194F4546F46452D7 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3616
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5493D70B3786C8807DC590A3EF2A6244 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5493D70B3786C8807DC590A3EF2A6244 --renderer-client-id=5 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4000
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C54192E45DAE4DE0B3EF3C53B82EA4A --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E3963C791ED506DC82945350C3AB092 --mojo-platform-channel-handle=2820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\medtrans\medtrans.exe
"C:\medtrans\medtrans.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3520

C:\medtrans\medtrans.exe
"C:\medtrans\medtrans.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 615ea9655e2616927a4a58dc66b2a73baf144c66925bee14c4767ce2ab8066ed
MD5 5b5133118bea68be7154cfe5bb52ce80
SHA1 c9e53af05851ca06dc59498da311af42f4394702
SHA512 70996db12af79859ff07277a4ed2c8b053819fc21ae0a56cac498e04ddeb6a071d39b3e6a37b064dc4048b9fada48b90b654558173ec94b9c36ddc6d4924e9c8
SSDEEP 384:yefdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:6+eUZsLQCZsL3hUS4
TLSH
T14B53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEDTRANS.INF

Path C:\Users\Admin\AppData\Local\Temp\MEDTRANS.INF
Size 3KB
SHA256 02f63b9aa08ff80b2e5152e2cbc525683b65f6b44c0363c631f641095a5ec5c9
MD5 f987bfda403abf994b276ce685fe4337
SHA1 8bf5cb7e8963a4a583dda3e164c0332273091f6c
SHA512 2938fce7b6803ceeb6d128df728efd8b0fb9bfc6396ac3155d1357a0f43953d4dcf67bc4c9a469cf889c1459afa32a2922dcb5985cb2d4cee7884a0dc95fe906
TLSH
T10D61428A2D008B2370E2F59E97C73A07CB2E8B6D6254838DF269C051D91160D627F7F2
MD5 SHA1 SHA512 TLSH

Submit Download

medtrans.cab

Path C:\Users\Admin\AppData\Local\Temp\medtrans.cab
Size 4.7MB
SHA256 fc5e3f4c025ef46067a5b886580b656295645b86d19726f9b22294a568288f8f
MD5 288687b8a7ef1ceb3e56aa23a57e84d9
SHA1 f2d84db71ac3c0f8c4c053036cb0762ce02a4707
SHA512 e811c93b5a5554dc6f62f1486c05badcc2fd3039f1f1ad39e9d4b30cc5bc0e99116cb3ae6ea38f1055d6c0f879ba309f7e68ef963dc7a6915b066416ef30197a
SSDEEP 98304:4J+stMSHhhe6HLWSK6kTdZh1EDFHoTP236K85h/qvizqK:g+kMog6pKrt1+HobW6VCv6X
TLSH
T1BB3633493E5DC5A6BA3AFA455D79DE792162242939098CC2B0FDFECC38C54F0983E1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET45FD.tmp

Path C:\medtrans\SET45FD.tmp
Size 2.2MB
SHA256 a35c705ecc32e606f196834c5dafbd0ff91482b0138a2da85af7f27eeb4256eb
MD5 60563340a72cd85fd1e6d76fdfbfd94d
SHA1 5dfc0b47ebfe9ad3ad08bc23d70c6edf8a12dac3
SHA512 6a19073f135dd56a7cdb575cfecc5c5cc7067a54035691178082029a6e58be5d3a7cb5bfd19d0c98f19a16dee80ed1401ba74645c5749d254bf82f316f91b8a5
SSDEEP 49152:rv9zbUVAM1rKnTAdqv/EqHxMnQo8e1TbyaPKYcSpSk:rv9zbU3ZKnTzvgN8X
TLSH
T1A1B5AE12B6818076E5D20574D56AABBE4979BE30072554D3F7CC3F2E8F302D26B3A74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET46BA.tmp

Path C:\medtrans\SET46BA.tmp
Size 2KB
SHA256 1628598d9afb59c60175e13894e9555d69c1cba325aab578319496671d3f5a8c
MD5 0c08b544fd2a110653c2b515146c3bf7
SHA1 c2c56a6fc8072703dd564032ef2d6f5731f8ae14
SHA512 d24bbd5203750f34f20bbe5e6209990768f1618d5ae2bd902b5f1c8ecc19d080a91de465ee9a20ba2af77f7d8ff937c0fc0822997bf52400c0a0f5d5431e25f7
TLSH
T15941DE7BA35BC4D4C40184B0D95B95989B7A1E32642500DA4D72BFBF5FFBE21A21EC22
MD5 SHA1 SHA512 TLSH

Submit Download

SET46BC.tmp

Path C:\medtrans\SET46BC.tmp
Size 40KB
SHA256 33a3aa05e2ada8c33441b59d16cb0bb1a21743114a4c3f109d6a754ce5cbe111
MD5 12ee3f4da6382db2c25a7bcce6f96677
SHA1 6f4833508e5e2153c70576fccf6c2b8be1384372
SHA512 cf7e90c113503778ceccd1a681700e54479c126548fa8b1332473cb73ba31f7b1f5f35f6f950dd1f679af8dc547494d5bbf65777f1a2337b25b21690a392fd91
SSDEEP 384:Q3Tw0SMBQPHCpYBpCticvwonN2U/fIcbyN9/reAGoR:Cw0vQPHYYBQjNge+jeVo
TLSH
T1FC037C2778E24573D481C6B061B2CF6EA33F563207A69587CB04AC5A3E715F0EA3A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET46BE.tmp

Path C:\medtrans\SET46BE.tmp
Size 45B
SHA256 456192ef343c3dee72c1c88dc735fc95430e8ba74e993719f5a5c2a7d5df989a
MD5 4b917c9d683382e5df8153631ef88186
SHA1 a327b156935db7aef0eb4f3af353c3e3b81375a1
SHA512 907b997bbf8b43aa2b7a4c02bbe7aae94fb452bf9b60562cc539dd90881537e046a4aedb64aef517798dcdb8bf40dd5902bd7404e34eac451f975986be4ec5be
MD5 SHA1 SHA512

Submit Download

SET46C0.tmp

Path C:\medtrans\SET46C0.tmp
Size 1.1MB
SHA256 d1961cca7a2a0e0d9d7083d57fbcb57b152917f41ae42b7b5e6770247b00a8f9
MD5 22a99865f5dda92d174c3ed432c38f45
SHA1 0c607e09e8620813091d1b709917c0b5133476f0
SHA512 88e1c3981fa4ab85cc6267d919d906645401160eb7cbaba31f761c1fb65dbd8694ebaa89e3d7806d45abb2b06095da3ebbc2c28224f09a74680ed628f443d069
SSDEEP 24576:NQvpleUkLQn2zbbxZJCyyikWvsCSPRg+oNhX8ss1O:2LehQn2zbbxjCyynOjQRz2hTSO
TLSH
T10345011348586DCFD29447A5BF0F3D557B49B622F6C16AEA322ECFC62740A379C1702A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET46E2.tmp

Path C:\medtrans\SET46E2.tmp
Size 7B
SHA256 1433fd6a7e9050dd40925c4dfd3cea00624ed6570dc940307161215d809b2eed
MD5 0a9082478b1a1466f6e56fd5e48db8c4
SHA1 81155ff1887266b24ea1b1ad1c557e3de298bf42
SHA512 acf384443beb98943c838ccbd05fdaabe380123cf52126b4f93d0ed0f1798f93287bcdb46cc36428c90430a9e60932b54f66a50d5c01f7bc8eb38d0acf89253c
MD5 SHA1 SHA512

Submit Download

SET4713.tmp

Path C:\medtrans\SET4713.tmp
Size 5.0MB
SHA256 229ee5b067b475804889919554247698681042dfb02e3cfb9c098675348e2c28
MD5 4a4b29c76ad468c2f4b14a9f98addfdd
SHA1 a6f0c7257ee6a72702691bb17aa68dc8b1163363
SHA512 7547016aa8fe40b4116614d38a9ea688dfa195fb320e56e044743a46739988a8e5544fda0a5b3307f1e1fc1bcc79680443b618d07a3784fc5f139044b34e923b
SSDEEP 98304:wgY2mvLHig4GeMIcCK3Md45sYAtjeTyX63FRiimCHC7TNhipnnsg09snWh5izS0Z:jVmjChGeMIcF4i4NhipAbizS0g3Pa/46
TLSH
T1A9369D01D0726121C5427073FC1EF7794B206E390BF54AEBB6D4ACE3AB749E2763A652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

medtrans_2026-04-23.log

Path C:\medtrans\log\medtrans_2026-04-23.log
Size 233B
SHA256 f7b100d1076dc15ddb42ada8dc554e255aad25a72d5b6a0d2f36a3886f0a1c71
MD5 0c623bf5b29283cbff064c13fa943f5b
SHA1 0a5aeba72fd0d6dd2e317edb26c5ff2cc5b6f9da
SHA512 4d8c8268b2d4b34b48dd81500455ca4693579d315129a8f2530cf5e54a25d156e419e54cbf9f2f66d16ccbadc86bad68310c03db5520c26e694bc05abdea0c65
TLSH
T10ED0A9440AF0B0A309B38272F2E21FAE0B2EE0A726C0E9343B84C249242390F37C2605
MD5 SHA1 SHA512 TLSH

Submit Download

memory/472-71-0x00000000013D0000-0x0000000001983000-memory.dmp

Download

memory/1236-95-0x0000000001B20000-0x00000000020D3000-memory.dmp

Download

memory/1644-113-0x0000000001BB0000-0x0000000002163000-memory.dmp

Download

memory/1996-104-0x00000000013D0000-0x0000000001983000-memory.dmp

Download

memory/1996-260-0x00000000013D0000-0x0000000001983000-memory.dmp

Download

memory/2904-276-0x0000000000C90000-0x0000000001243000-memory.dmp

Download

memory/3180-68-0x0000000002010000-0x0000000002085000-memory.dmp

Download

memory/3308-83-0x0000000001660000-0x0000000001C13000-memory.dmp

Download

memory/3520-267-0x0000000000CC0000-0x0000000001273000-memory.dmp

Download

memory/3520-272-0x0000000000CC0000-0x0000000001273000-memory.dmp

Download

memory/3616-90-0x0000000001B80000-0x0000000002133000-memory.dmp

Download

memory/4000-114-0x0000000001B40000-0x00000000020F3000-memory.dmp

Download

memory/4056-69-0x0000000000870000-0x0000000000E23000-memory.dmp

Download

memory/4300-98-0x0000000001A90000-0x0000000002043000-memory.dmp

Download

memory/4480-207-0x000000000DED0000-0x000000000EC03000-memory.dmp

Download

memory/4480-217-0x000000000ED50000-0x000000000F442000-memory.dmp

Download

memory/4480-215-0x000000000DED0000-0x000000000EC03000-memory.dmp

Download

memory/4480-185-0x000000000BB40000-0x000000000BB87000-memory.dmp

Download

memory/4480-262-0x000000000BB40000-0x000000000BB87000-memory.dmp

Download

memory/4480-261-0x00000000017D0000-0x0000000001D83000-memory.dmp

Download

memory/4480-100-0x00000000017D0000-0x0000000001D83000-memory.dmp

Download

memory/4960-74-0x00000000014B0000-0x0000000001A63000-memory.dmp

Download

memory/4960-73-0x00000000014B0000-0x0000000001A63000-memory.dmp

Download

memory/4988-72-0x0000000001100000-0x00000000016B3000-memory.dmp

Download