Overview

overview

8

Static

static

3

14fa7aa15e...9a.exe

windows10-2004-x64

8

14fa7aa15e...9a.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/04/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe
  • Size 4.3MB
  • Sample260424-vdbmqsft5j
  • SHA256 14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe
    "C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe" /force "\\.\pipe\AHKMMJFFJIH"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4220
  • C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe
    "C:\Users\Admin\AppData\Local\Temp\14fa7aa15e1378f7c238cc990feb525d7f34a29f91617816bb9c68c72c032f9a.exe" /autostart
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe" /force "\\.\pipe\AHKBMFDJDBK" "/autostart"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4044

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AutoHotkey_Exec.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AutoHotkey_Exec.exe
        • Size 1.3MB
        • SHA256 196c855e6e8c2296becd05034bfdaa2b2bca0f4df85c4c5f2eb44248b05b2e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\HOS_Data\Config\Config.ini
        • Size 75B
        • SHA256 9b11575c606ca6c4aac5549b1373403ead74bb8b42136ac6dc876e9126624a8d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\HOS_Data\Config\Config.ini
        • Size 131B
        • SHA256 6bd9a4ab2b090c93d41ccd7aca9fdf3df54a504a8527f134c33e8b96e54c603e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_src421gi.i0r.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_src421gi.i0r.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\config.ini
        • Size 62B
        • SHA256 43db91c011eda92de77ba9842312cfd57c5d314c5b84f2142a30d3083cdeaa4f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2120-2-0x0000000140730000-0x0000000140796000-memory.dmp
        Download

        memory/2120-1-0x0000000140730000-0x0000000140796000-memory.dmp
        Download

        memory/2120-5-0x00000000009D0000-0x0000000000AD0000-memory.dmp
        Download

        memory/2120-12-0x0000000140000000-0x0000000140449000-memory.dmp
        Download

        memory/2120-0-0x0000000140000000-0x0000000140449000-memory.dmp
        Download

        memory/4064-73-0x0000000140730000-0x0000000140796000-memory.dmp
        Download

        memory/4064-52-0x0000000140000000-0x0000000140449000-memory.dmp
        Download

        memory/4064-92-0x0000000140000000-0x0000000140449000-memory.dmp
        Download

        memory/4220-24-0x0000021C62B50000-0x0000021C62B5C000-memory.dmp
        Download

        memory/4220-19-0x0000021C7B2A0000-0x0000021C7B2C2000-memory.dmp
        Download

        memory/4220-13-0x0000021C62F80000-0x0000021C62F90000-memory.dmp
        Download