Overview
overview
10Static
static
3tmpanfn5x1c.exe
windows10-2004-x64
8tmpanfn5x1c.exe
windows11-21h2-x64
6ADVPACK.dll
windows10-2004-x64
3ADVPACK.dll
windows11-21h2-x64
3W95INF16.dll
windows10-2004-x64
1W95INF16.dll
windows11-21h2-x64
1W95INF32.dll
windows10-2004-x64
3W95INF32.dll
windows11-21h2-x64
3fngrprnt.dll
windows10-2004-x64
3fngrprnt.dll
windows11-21h2-x64
3msnphoto.scr
windows10-2004-x64
3msnphoto.scr
windows11-21h2-x64
3msvcr71.dll
windows10-2004-x64
3msvcr71.dll
windows11-21h2-x64
3pibase.dll
windows10-2004-x64
3pibase.dll
windows11-21h2-x64
3pidav.dll
windows10-2004-x64
3pidav.dll
windows11-21h2-x64
3piorg.dll
windows10-2004-x64
3piorg.dll
windows11-21h2-x64
3piorgres.dll
windows10-2004-x64
1piorgres.dll
windows11-21h2-x64
1pisync.dll
windows10-2004-x64
3pisync.dll
windows11-21h2-x64
3pisynctw.exe
windows10-2004-x64
3pisynctw.exe
windows11-21h2-x64
3piview.dll
windows10-2004-x64
3piview.dll
windows11-21h2-x64
3slides~1.js
windows10-2004-x64
10slides~1.js
windows11-21h2-x64
10startup.js
windows10-2004-x64
3startup.js
windows11-21h2-x64
3Analysis
- max time kernel
148s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
tmpanfn5x1c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
tmpanfn5x1c.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
ADVPACK.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
ADVPACK.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
W95INF16.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
W95INF16.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
W95INF32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
W95INF32.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
fngrprnt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
fngrprnt.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
msnphoto.scr
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
msnphoto.scr
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
msvcr71.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
msvcr71.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
pibase.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
pibase.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
pidav.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
pidav.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
piorg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
piorg.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
piorgres.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
piorgres.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
pisync.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
pisync.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
pisynctw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
pisynctw.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
piview.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
piview.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
slides~1.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
slides~1.js
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
startup.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
startup.js
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target tmpanfn5x1c.exe
- Size 2.3MB
- Sample260523-b32exacy41
- SHA256 e5cc4a232bd7bfcc2a57174554c284527bce0e2f494f1e9190c9c4c469985eca
- MD5 a00f59737d82c8df1c974b50e80e03f8
- SHA1 470a71a8d4645e9aa96b36f5b99a609f90faf142
- SHA512 de9ae03b9a20bf262cfe34af0f759ada873eb004a51a9f6d8ae88e325a9a34e4530b68daa699e255f05bb379fdedad6506c4edb6aa264219b3293b96b0163bc7
- SSDEEP 24576:+VYbWzOqXT4XFrhe1v/xRZJQnxBrabsM8KGH7Co0OLeGrIocE5lArjPPW:XWzORX1he1HxRqr08KGbNLeGMb4unW
- TLSH T12DB57C10A3DAF491F67E1F3498B157520E757D268A32C57ABAEC398DF83C2137924722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpanfn5x1c.exe" tmpanfn5x1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpanfn5x1c.exe" tmpanfn5x1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpanfn5x1c.exe" tmpanfn5x1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpanfn5x1c.exe" tmpanfn5x1c.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll tmpanfn5x1c.exe File created C:\Windows\SysWOW64\ntdll.dll.dll tmpanfn5x1c.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\mircModule.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\mircmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\iexploreInternet11.00.22000.1.160101.0800.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\UpdateUpdate.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\UpdateEdge.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\x86\Browsermirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\mircmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\WindowsWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\mIRCmirc6.35.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\mircVisual.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Google\Update\Updatermirc6.35.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Internet Explorer\en-US\mIRCmirc.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\ExplorerInternet.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewerPhotoViewer.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ietoedgebhodllIEToEdge6.35.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceserviceFirefox.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x64\mircmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\fr-FR\WORDPADMicrosoft.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ietoedgebho64dllietoedgestubexe.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeReader.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\telclientLink.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x86\EmbeddedmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x64\MicrosoftEmbeddedBrowserWebView6.35.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows NT\Accessories\SystemWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualOperating.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\WindowsOperating.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\SistemaPackageManagement.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\mIRCmirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\de-DE\SystemOperating.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows NT\Accessories\es-ES\operativowordpad.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\uk-UA\WORDPADWindows.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ietoedgebhodllIEToEdge6.35.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\chromeelfdllicudt60.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\ToolsMicrosoft.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ietoedgebho64dllietoedgebho132.0.2957.140.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\MicrosoftTools.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\mIRCmirc.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Media Player\en-US\mircmirc.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoftresources.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\mircmirc6.35.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\wmplayerWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\WindowsWindows.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\it-IT\mircmIRC.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\mIRCmIRC.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\ado\de-DE\mIRCmirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Systemsetupwm.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\mIRCVisual.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\eventlogprovidermicrosoftshellintegrationdll.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TipResSystme.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\WAB32resWAB3210.0.22000.1.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\Microsoftmpasdesc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Defender\uk-UA\mIRCmirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\VisualStudioTools.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\mIRCmirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\mIRCmirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x64\BrowsermIRC.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\mircmirc.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ja-JP\mircmirc.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javawsU381.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\TableTextServiceMicrosoft.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\AdobeWindowsMedia.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\mpvisSistema12.0.22000.1.160101.0800.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\it-IT\WAB32resWindows.exe tmpanfn5x1c.exe - Program crash 2 IoCs
pid pid_target Process procid_target 3772 5352 WerFault.exe 79 2476 2564 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpanfn5x1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpanfn5x1c.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier tmpanfn5x1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmpanfn5x1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmpanfn5x1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier tmpanfn5x1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmpanfn5x1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmpanfn5x1c.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5352 tmpanfn5x1c.exe 5352 tmpanfn5x1c.exe 5352 tmpanfn5x1c.exe 5352 tmpanfn5x1c.exe 5352 tmpanfn5x1c.exe 5352 tmpanfn5x1c.exe 2564 tmpanfn5x1c.exe 2564 tmpanfn5x1c.exe 2564 tmpanfn5x1c.exe 2564 tmpanfn5x1c.exe 2564 tmpanfn5x1c.exe 2564 tmpanfn5x1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exe"C:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 14722⤵
- Program crash
PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exeC:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exe1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 14562⤵
- Program crash
PID:2476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5352 -ip 53521⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2564 -ip 25641⤵PID:1988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Windows NT\Accessories\it-IT\wordpadoperativo10.0.22000.1.exe
- Size 2.3MB
- SHA256 e5cc4a232bd7bfcc2a57174554c284527bce0e2f494f1e9190c9c4c469985eca
- MD5 a00f59737d82c8df1c974b50e80e03f8
- SHA1 470a71a8d4645e9aa96b36f5b99a609f90faf142
- SHA512 de9ae03b9a20bf262cfe34af0f759ada873eb004a51a9f6d8ae88e325a9a34e4530b68daa699e255f05bb379fdedad6506c4edb6aa264219b3293b96b0163bc7
- SSDEEP 24576:+VYbWzOqXT4XFrhe1v/xRZJQnxBrabsM8KGH7Co0OLeGrIocE5lArjPPW:XWzORX1he1HxRqr08KGbNLeGMb4unW
- TLSH T12DB57C10A3DAF491F67E1F3498B157520E757D268A32C57ABAEC398DF83C2137924722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewerWindows.exe
- Size 2.3MB
- SHA256 59e583dd66d4ac8f7629eb598676d6e11a24be24486c019b4c73aa9a7af78b1a
- MD5 f5ea6af3e0ae56d112654bdef9a463fa
- SHA1 25607f4e57ec242f4b611b08dd2c678d2e059233
- SHA512 b954297a678749bc89ff3d53e149d3762dd92d140b041b50e0f3f48fcf7732759964e453e3e0568b62cc6d96548a8e0c17c2e238a4aa9abd8f3b947940a7de0f
- SSDEEP 24576:pWzOqXT4XFrhe1v/xRZJQnxBrabsM8KGH7Co0OLeGrIocE5lArjPPW:pWzORX1he1HxRqr08KGbNLeGMb4unW
- TLSH T143B57B10A3DAF481F67E1F3498B157520E757D268A32C57ABAEC798DF83C2137924722
- MD5 SHA1 SHA512 SSDEEP TLSH