Overview
overview
7Static
static
732-Bit/BTCR_x86.dll
windows10-2004-x64
332-Bit/BTCR_x86.dll
windows10-ltsc_2021-x64
332-Bit/BTCR_x86.dll
windows11-21h2-x64
332-Bit/Blake3.dll
windows10-2004-x64
332-Bit/Blake3.dll
windows10-ltsc_2021-x64
332-Bit/Blake3.dll
windows11-21h2-x64
3BTCR.dll
windows10-2004-x64
1BTCR.dll
windows10-ltsc_2021-x64
1BTCR.dll
windows11-21h2-x64
1Blake3.dll
windows10-2004-x64
1Blake3.dll
windows10-ltsc_2021-x64
1Blake3.dll
windows11-21h2-x64
1TeraCopy P...py.exe
windows10-2004-x64
6TeraCopy P...py.exe
windows10-ltsc_2021-x64
6TeraCopy P...py.exe
windows11-21h2-x64
6Analysis
- max time kernel
306s - max time network
223s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 19:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
32-Bit/BTCR_x86.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
32-Bit/BTCR_x86.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
32-Bit/BTCR_x86.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
32-Bit/Blake3.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
32-Bit/Blake3.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
32-Bit/Blake3.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
BTCR.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
BTCR.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
BTCR.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
Blake3.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
Blake3.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
Blake3.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
TeraCopy Pro 3.17 Multilingual_Pass[KakáBadi]/teracopy.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral14
Sample
TeraCopy Pro 3.17 Multilingual_Pass[KakáBadi]/teracopy.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
Behavioral task
behavioral15
Sample
TeraCopy Pro 3.17 Multilingual_Pass[KakáBadi]/teracopy.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
900 seconds
General
- Target TeraCopy Pro 3.17 Multilingual_Pass[KakáBadi]/teracopy.exe
- Size 11.8MB
- Sample260503-x89jcsf191
- SHA256 ac03db52bb68a013d3a8bf4db703ec11976fa1d0aa557eb988e3f926a26656cf
- MD5 d704e453e065a23ed414927d9b203086
- SHA1 352e4b98faebc35f5c8cfeaebb7bcb36d7c7fbfc
- SHA512 0ec2c8cd14a7f4dfd704b19729239ee78e54fc1fb87ba1a2a80da4b7d595fd573861271ca220c3a7b264209ceed1ca96da12d6bdf2b34c35771790cd6337cf49
- SSDEEP 196608:AAKBx4px+sN23RSEfvYfXf1v3j+FX3/yXg3Kf5T72gFUbUamFbSf4k5EBGUQ:AAK/4px/23bfvYvf1bI/8RfVGwdFbSfD
- TLSH T11CC6F131724AC43FDA6255B0192C8E9A512C7E750BB264CBB7CC2E3E5BB45C21736E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: teracopy.exe File opened (read-only) \??\X: teracopy.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: teracopy.exe File opened (read-only) \??\P: teracopy.exe File opened (read-only) \??\Z: teracopy.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: teracopy.exe File opened (read-only) \??\I: teracopy.exe File opened (read-only) \??\J: teracopy.exe File opened (read-only) \??\U: teracopy.exe File opened (read-only) \??\V: teracopy.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: teracopy.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: teracopy.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: teracopy.exe File opened (read-only) \??\M: teracopy.exe File opened (read-only) \??\O: teracopy.exe File opened (read-only) \??\Y: teracopy.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: teracopy.exe File opened (read-only) \??\K: teracopy.exe File opened (read-only) \??\N: teracopy.exe File opened (read-only) \??\R: teracopy.exe File opened (read-only) \??\S: teracopy.exe File opened (read-only) \??\T: teracopy.exe File opened (read-only) \??\W: teracopy.exe - Loads dropped DLL 15 IoCs
pid Process 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe 2472 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language teracopy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Colors teracopy.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2780 msiexec.exe Token: SeCreateTokenPrivilege 824 teracopy.exe Token: SeAssignPrimaryTokenPrivilege 824 teracopy.exe Token: SeLockMemoryPrivilege 824 teracopy.exe Token: SeIncreaseQuotaPrivilege 824 teracopy.exe Token: SeMachineAccountPrivilege 824 teracopy.exe Token: SeTcbPrivilege 824 teracopy.exe Token: SeSecurityPrivilege 824 teracopy.exe Token: SeTakeOwnershipPrivilege 824 teracopy.exe Token: SeLoadDriverPrivilege 824 teracopy.exe Token: SeSystemProfilePrivilege 824 teracopy.exe Token: SeSystemtimePrivilege 824 teracopy.exe Token: SeProfSingleProcessPrivilege 824 teracopy.exe Token: SeIncBasePriorityPrivilege 824 teracopy.exe Token: SeCreatePagefilePrivilege 824 teracopy.exe Token: SeCreatePermanentPrivilege 824 teracopy.exe Token: SeBackupPrivilege 824 teracopy.exe Token: SeRestorePrivilege 824 teracopy.exe Token: SeShutdownPrivilege 824 teracopy.exe Token: SeDebugPrivilege 824 teracopy.exe Token: SeAuditPrivilege 824 teracopy.exe Token: SeSystemEnvironmentPrivilege 824 teracopy.exe Token: SeChangeNotifyPrivilege 824 teracopy.exe Token: SeRemoteShutdownPrivilege 824 teracopy.exe Token: SeUndockPrivilege 824 teracopy.exe Token: SeSyncAgentPrivilege 824 teracopy.exe Token: SeEnableDelegationPrivilege 824 teracopy.exe Token: SeManageVolumePrivilege 824 teracopy.exe Token: SeImpersonatePrivilege 824 teracopy.exe Token: SeCreateGlobalPrivilege 824 teracopy.exe Token: SeCreateTokenPrivilege 824 teracopy.exe Token: SeAssignPrimaryTokenPrivilege 824 teracopy.exe Token: SeLockMemoryPrivilege 824 teracopy.exe Token: SeIncreaseQuotaPrivilege 824 teracopy.exe Token: SeMachineAccountPrivilege 824 teracopy.exe Token: SeTcbPrivilege 824 teracopy.exe Token: SeSecurityPrivilege 824 teracopy.exe Token: SeTakeOwnershipPrivilege 824 teracopy.exe Token: SeLoadDriverPrivilege 824 teracopy.exe Token: SeSystemProfilePrivilege 824 teracopy.exe Token: SeSystemtimePrivilege 824 teracopy.exe Token: SeProfSingleProcessPrivilege 824 teracopy.exe Token: SeIncBasePriorityPrivilege 824 teracopy.exe Token: SeCreatePagefilePrivilege 824 teracopy.exe Token: SeCreatePermanentPrivilege 824 teracopy.exe Token: SeBackupPrivilege 824 teracopy.exe Token: SeRestorePrivilege 824 teracopy.exe Token: SeShutdownPrivilege 824 teracopy.exe Token: SeDebugPrivilege 824 teracopy.exe Token: SeAuditPrivilege 824 teracopy.exe Token: SeSystemEnvironmentPrivilege 824 teracopy.exe Token: SeChangeNotifyPrivilege 824 teracopy.exe Token: SeRemoteShutdownPrivilege 824 teracopy.exe Token: SeUndockPrivilege 824 teracopy.exe Token: SeSyncAgentPrivilege 824 teracopy.exe Token: SeEnableDelegationPrivilege 824 teracopy.exe Token: SeManageVolumePrivilege 824 teracopy.exe Token: SeImpersonatePrivilege 824 teracopy.exe Token: SeCreateGlobalPrivilege 824 teracopy.exe Token: SeCreateTokenPrivilege 824 teracopy.exe Token: SeAssignPrimaryTokenPrivilege 824 teracopy.exe Token: SeLockMemoryPrivilege 824 teracopy.exe Token: SeIncreaseQuotaPrivilege 824 teracopy.exe Token: SeMachineAccountPrivilege 824 teracopy.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 824 teracopy.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2472 2780 msiexec.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeraCopy Pro 3.17 Multilingual_Pass[KakáBadi]\teracopy.exe"C:\Users\Admin\AppData\Local\Temp\TeraCopy Pro 3.17 Multilingual_Pass[KakáBadi]\teracopy.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:824
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AED715F7EAA8EBF54B14FB7019689DBA C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2472
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSICBC9.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- TLSH T1F9F46B203695C03AD66E46B029BCCBAB55697E760B7254CB73C86E3A19F18C39335F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSICDFE.tmp
- Size 1.1MB
- SHA256 0831dbcb3799c9e36ea586582e8ef907dcefeb2045351d6774c7ad0ef02a9af2
- MD5 25e52c5776a81e0c5ccb9bdd4c808c90
- SHA1 e42104ef61ae4760a41552292091eb6a5089ced4
- SHA512 746570c011e501505ec9d09077519bca1a485b0cac66229be6f4715a91ee52d5cc857de26ad8d7a33806ddfa580d2ba9f77759e3764ea761d327fe2f1e881292
- SSDEEP 24576:W1jqahAB31gUHifWW9CdDLwYjxzKu/5xq6w3cQ3azCHknkQRAYYhSG:aj2WfWW9CdDLwYj0A58V3cQ3azCHknkl
- TLSH T12B353922BD6EC632EB7EE57596B8D76771BA77E00772C4CB52D8289A1E340C101B1F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\upd9A0.tmp
- Size 1KB
- SHA256 0b2fbc71769d676d7219540b2f6a8277778be04e2c97c01d1d570988d90c7cd7
- MD5 9295121e9e3c13c7d54e13fa73b2e6a3
- SHA1 1de761be51210bf5acd50cf785100d93c83194cb
- SHA512 f1686f7dee620be1bfd730d8a1ca9cbf79e178dbaa684a980a550d4f98f9d9ab169d3746c2c92dc976b546af96ab4d4f890381701b02fb0e786ae5da0c391e9e
- TLSH T19211866FF12643A849C937C3635671412A7B425C9F5170E8906E80DD7301C98D36D13E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi
- Size 5.6MB
- SHA256 c8077ad69802259fcb291e528c9be01eced4e7302c1dbd337d53bb879b6e7b02
- MD5 9529d790607eca409b70c780f99e05a3
- SHA1 c1852c6d0ce7ee0b424890a3d7e9c6ff338fd459
- SHA512 ab9debb175c7635ec3beb326c5a0f5486d7efb029872d6ddef4a64a9ba52cce4f2934f54e8b3bad6055d4277fca551a844cd1019239bf25fc7b7f6fa1e6779f4
- SSDEEP 49152:BAHgI5UdQ8+5eNBA+oQ5L59j2WfWW9CdDLwYj0A58V3cQ3azCHknkQRAYYhSDBjJ:sgCstvjXEjCSRWMPCAcAw6xjSwd1P
- TLSH T1DB466B217A49D13ED56ECD70152C8BFAE07DBEA1BB7144CF62887A698D703C34331A96
- MD5 SHA1 SHA512 SSDEEP TLSH