Overview

overview

7

Static

static

3

fa7aca5139...7d.exe

windows10-2004-x64

7

fa7aca5139...7d.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe
  • Size 2.6MB
  • Sample260426-ewgnpsez6j
  • SHA256 fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
    adwarespyware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe
    "C:\Users\Admin\AppData\Local\Temp\fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3999.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4380
      • C:\Users\Admin\AppData\Local\Temp\fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe
        "C:\Users\Admin\AppData\Local\Temp\fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4560
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3968
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4828
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4828 CREDAT:17410 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4976
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MicrosoftEdgeUpdateBroker.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
        • Size 128KB
        • SHA256 f3fc8d25a26a0a53b053b2372b7a3b52f08da72f2d0d7c298e6dc7558728b14b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 578KB
        • SHA256 e3c28c1c72d963762b9ad3c7201584570edcad88ea916c64a1bccd6417158919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcredist_x86.exe
        • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        • Size 484KB
        • SHA256 86a8075fd0611b8c18eb5cae71e121c7e18a4f132975a3685b8ea2695d173524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Size 471B
        • SHA256 966f7e842dc4a0c8d91f0f3eee504223b5f4056f3f9726649ce4f63eaedd69ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Size 416B
        • SHA256 38e6857fa0a7dad08ab0e4d855a89443012e2e3d6fee00da5a85667885fa1e08
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        imagestore.dat
        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ymfegs7\imagestore.dat
        • Size 1KB
        • SHA256 89a24cf82fcbcef4f66bf8716e8afc10ac5c46fa10057830dce123c49bd544df
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        browser_download_link[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MR04LX3R\browser_download_link[1].js
        • Size 1KB
        • SHA256 1bbd31b5dd4900360b8b9091f57bafb2193ef71b2a95e331926dc7fcc327bcc4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        favicon[1].ico
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MR04LX3R\favicon[1].ico
        • Size 1KB
        • SHA256 2a40e46debd9a2139f8d6bfd02b2fb15039373d67965a352c9a2c9cbe45257b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        suggestions[1].en-US
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MR04LX3R\suggestions[1].en-US
        • Size 17KB
        • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        $$a3999.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a3999.bat
        • Size 722B
        • SHA256 c16eb5f909920b03925fe63755d18789964aaae566354ba5e7335d814b2e8316
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\fa7aca51396cc99b36c472be6634c5cb2b538e2dea06a0d9e8c8b2568f718b7d.exe.exe
        • Size 2.6MB
        • SHA256 37ea4475068b34b4d7ba3a4d8a0c42e5b96bac663de1c73206e4f092c4b87701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Logo1_.exe
        • Path C:\Windows\Logo1_.exe
        • Size 29KB
        • SHA256 0e845067b18093300215d03cff7dab2c8e6e7cfff7b77bc069bc0c7fdfb72113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _desktop.ini
        • Path F:\$RECYCLE.BIN\S-1-5-21-745935970-1373868228-562466063-1000\_desktop.ini
        • Size 9B
        • SHA256 0fba28bb6e9597f362c7d8b2ec285f05fa93e7ef3f824af145839bcbccc1f7e1
        • MD5 SHA1 SHA512
        Submit Download

        memory/2360-0-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/2360-11-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-45-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-178-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-32-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-21-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-541-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-1402-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-5191-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-8-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/3536-5704-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/4560-20-0x0000000003640000-0x0000000003BF3000-memory.dmp
        Download