53ae0c0201396b5778eb4f1060797ff72689bbccad22ef0c7c09c25576f3bb2c

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
G2WInstall.exe
Size 1.4MB
Sample260428-nclyract6k
SHA256 53ae0c0201396b5778eb4f1060797ff72689bbccad22ef0c7c09c25576f3bb2c
MD5 3d8645895c89e151afdd15753b07775f
SHA1 ff2f53939129a7bddeee0a80950abc3ef158630a
SHA512 2f3ff3f6c9b2b5df8b31d11cb91fab91688fa1c2e8ac7058fb14a94c4c72bd1986bb7e353db63b7567bc597f84f27c3f009ae6520ba5a743ebaf2fca71a8a8e4
SSDEEP 24576:9f+iN57Gtene3fiea/hKU1bWXSlzK3dvY45h9b9MeO2Y+m4rVQ:pLXKtene3fpaZF1mSluuYUQK
TLSH
T12765335BF5E0AD0CCE9C9334143244BAD634AEC5AC1B0A868768EDC5DC5D7F8AA3914F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	G2WInstall.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/5280-15-0x00000000004A0000-0x000000000077B000-memory.dmp	autoit_exe
behavioral1/memory/5280-17-0x00000000004A0000-0x000000000077B000-memory.dmp	autoit_exe
behavioral1/memory/5280-26-0x00000000004A0000-0x000000000077B000-memory.dmp	autoit_exe
behavioral1/memory/5280-33-0x00000000004A0000-0x000000000077B000-memory.dmp	autoit_exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5280-0-0x00000000004A0000-0x000000000077B000-memory.dmp	upx
behavioral1/memory/5280-15-0x00000000004A0000-0x000000000077B000-memory.dmp	upx
behavioral1/memory/5280-17-0x00000000004A0000-0x000000000077B000-memory.dmp	upx
behavioral1/memory/5280-26-0x00000000004A0000-0x000000000077B000-memory.dmp	upx
behavioral1/memory/5280-33-0x00000000004A0000-0x000000000077B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G2WInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	G2WInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	G2WInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5456	PING.EXE
5732	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	G2WInstall.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	G2WInstall.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	G2WInstall.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	G2WInstall.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\HAJBEPFY\root\cimv2	G2WInstall.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5456	PING.EXE
5732	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5280	G2WInstall.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5280	G2WInstall.exe
5280	G2WInstall.exe
5280	G2WInstall.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5280	G2WInstall.exe
5280	G2WInstall.exe
5280	G2WInstall.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 5224	5280	G2WInstall.exe	87
PID 5224 wrote to memory of 5456	5224	cmd.exe	89
PID 5224 wrote to memory of 5468	5224	cmd.exe	90
PID 5224 wrote to memory of 3768	5224	cmd.exe	91
PID 5224 wrote to memory of 5004	5224	cmd.exe	92
PID 5004 wrote to memory of 4792	5004	net.exe	93
PID 5224 wrote to memory of 5116	5224	cmd.exe	94
PID 5224 wrote to memory of 5732	5224	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\G2WInstall.exe
"C:\Users\Admin\AppData\Local\Temp\G2WInstall.exe"
1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Cleanup.Grub2Win.26042812152081.directory.DownLoadEndIt.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5468
- - C:\Windows\SysWOW64\find.exe
    find "5.1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3768
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /a:d "C:\ProgramData\Grub2Win"\*.*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INETWO~1.TXT

Path C:\ProgramData\Grub2Win\G2WInstall.exe.26042812152081\INETWO~1.TXT
Size 77B
SHA256 83f1acf35646d575132ca61595da932fad9e2daf5558b1248786de832fecb74c
MD5 238b23ae94a26c59979ebee8874859bf
SHA1 9aaa079d74e267428b5e904f27c81b6d1cdc094d
SHA512 f12108712b8cbf17cdf3dcae15160a908ba449d02b22a61f068143cabf0d799cd1952eb8afb3dd1a87d4933b3f65e7f4fb295ed49a1b3d649e1e1e0f4e0163d1
TLSH
T139A011328808208B8003888A22220C80BC02A220BA00A2A20AB800200800CA832FEA3A
MD5 SHA1 SHA512 TLSH

Submit Download

ZIP7ZR~1.RUN

Path C:\ProgramData\Grub2Win\G2WInstall.exe.26042812152081\Zip\ZIP7ZR~1.RUN
Size 587KB
SHA256 4bec0bc59836a890a11568b58bd12a3e7b23a683557340562da211b6088058ba
MD5 63cdadb8047e200ef81d63dbcfac7bbb
SHA1 c25e716a9e9b968df045aef541001a229082c8e4
SHA512 a30f8a214cbe5c0efcbfc4f2cae80f23e821044d167e8d33d882415f0544ae8ba78ad23fa17d58ad92cf7e46c31bded170eefb3d3bd8130d1fa78c6f2dcd5f58
SSDEEP 12288:DuZjs0po2L7FwGeMAi1T2U5Vqkv811uG7hw6suPv/uDprIgIg:DKs+LZZUi1qUfJS1Hh5scv/uDp5
TLSH
T10BD4AE173AE5C07ED25215308A1D6BB590FBC7680B3608C763809E6D2B359E6D73B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp.log

Path C:\ProgramData\Grub2Win\G2WInstall.exe.26042812152081\temp.log
Size 96B
SHA256 afdee43a7d982c781991bbfc1e72d3777fac78a9d6d3f03d1eb45b9816b79194
MD5 224241a74a8c334e36b329139737a5e3
SHA1 38281fca350663bf096449d52fb634080fc93534
SHA512 25c36868450b21fdea2953ce4aad8cb18f570fa848a438050a1a5d00d646a32d8ace14695557f7ed198af04822f3e8c1696ebca478f76ac60b7483fc80c76c63
TLSH
T1B1B0127D313142F544162600C01C116228500625C0044098C6383894AE3279D11FC0CA
MD5 SHA1 SHA512 TLSH

Submit Download

STATSL~1.TXT

Path C:\ProgramData\Grub2Win\STATSL~1.TXT
Size 813B
SHA256 b240e2dfa6d36f15ccc733bd82ae75ac85f4fe96c7d6bfde7185dee9866cf38d
MD5 b45962af3265db6d49478bf103be3d56
SHA1 6602044886481d2daa95c65b991b34f587684d51
SHA512 b55b0183f5b0368a97fee3aac5f4e2165a47fc742b40df7ca90c5093561995d23a21130cbc44a6be2c8fee8d5e1f3f197f73468e21783c4a9519ac6874337f53
TLSH
T1D901ECEE36714ED896167614986C1DD728810244CA054050E37B358AE73FFDA97FC1DD
MD5 SHA1 SHA512 TLSH

Submit Download

Cleanup.Grub2Win.26042812152081.directory.DownLoadEndIt.bat

Path C:\Users\Admin\AppData\Local\Temp\Cleanup.Grub2Win.26042812152081.directory.DownLoadEndIt.bat
Size 3KB
SHA256 3054769a542d67dd67d5985b89dc800d1702434eba8efd2cf10fd9d4bdd458de
MD5 0f10bee9f8828c827f5642f4a0ae2740
SHA1 8781322d2434b83f65e1b23d4e484c5defbdabaa
SHA512 a28202c630505fa116b065c25abb471313464eb8c77d758e2a970c89c01f165b45ead90987cb43a6b31763d8695f522a2ffb163d91a3d72a0bbc052f768d12a3
TLSH
T111712469754742C21C71E37A873D1A00BE04C1DB1A34AA68B4DE90C2FFA6A4847F82E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5280-0-0x00000000004A0000-0x000000000077B000-memory.dmp

Download

memory/5280-16-0x0000000003BB0000-0x0000000003C83000-memory.dmp

Download

memory/5280-15-0x00000000004A0000-0x000000000077B000-memory.dmp

Download

memory/5280-17-0x00000000004A0000-0x000000000077B000-memory.dmp

Download

memory/5280-26-0x00000000004A0000-0x000000000077B000-memory.dmp

Download

memory/5280-33-0x00000000004A0000-0x000000000077B000-memory.dmp

Download

memory/5280-32-0x0000000003BB0000-0x0000000003C83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads