81a5042fdb3885e4c108bc2a511bc078fa6073f47c72ffe5258ebac85ccdaee8

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JPSL82.vbs
Size 141B
Sample260527-k6ak2ab13w
SHA256 81a5042fdb3885e4c108bc2a511bc078fa6073f47c72ffe5258ebac85ccdaee8
MD5 a0c4f602db0582019ff690d029f6bc0e
SHA1 f3571243388076dbf424097f83bfe0ea6d063c72
SHA512 188f1fa07f1295ffbc6335222e18ee949829aebff79245e778a755515916f7a3f06c3f0cddff325d040a88be40ecd1cd19315d59be71fb03a6a36192b3121e9e
TLSH
T1D6C02B675F1CC0B4004016C340F7DC0FC57250492510F20048C2C8C651DA2340C1E089
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2040	WScript.exe
3	2040	WScript.exe
4	2040	WScript.exe
5	2040	WScript.exe

Deletes itself 1 IoCs

pid	Process
2040	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
1344	czhouvpw.exe
4064	czhouvpw.exe

Loads dropped DLL 4 IoCs

pid	Process
1344	czhouvpw.exe
4064	czhouvpw.exe
3984	attrib.exe
2972	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\czhouvpw = "\"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\czhouvpw.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\czhouvpw\""	czhouvpw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\czhouvpw = "\"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\czhouvpw.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\czhouvpw\""	czhouvpw.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
1	api.ipify.org
1	ip-api.com
11	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\attrib_veh.log	attrib.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 3984	1344	czhouvpw.exe	86
PID 4064 set thread context of 2972	4064	czhouvpw.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czhouvpw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czhouvpw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	attrib.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	attrib.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOMSTORAGE	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOMSTORAGE\attrib.exe = "1"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOMSTORAGE	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\attrib.exe = "0"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\attrib.exe = "0"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\attrib.exe = "1"	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_WEBGL\attrib.exe = "1"	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_WEBGL\attrib.exe = "1"	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ\attrib.exe = "0"	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\attrib.exe = "11001"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\attrib.exe = "1"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_WEBGL	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOMSTORAGE\attrib.exe = "1"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\attrib.exe = "1"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	attrib.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_WEBGL	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\attrib.exe = "0"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\attrib.exe = "1"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\attrib.exe = "0"	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ\attrib.exe = "0"	attrib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\attrib.exe = "11001"	attrib.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2\IconUri = "C:\\Windows\\SysWOW64\\attrib.exe,0"	attrib.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2\IconUri = "C:\\Windows\\SysWOW64\\attrib.exe,0"	attrib.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	attrib.exe
2972	attrib.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	rundll32.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2380	2040	WScript.exe	80
PID 2380 wrote to memory of 3960	2380	rundll32.exe	81
PID 2040 wrote to memory of 1344	2040	WScript.exe	82
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 1344 wrote to memory of 3984	1344	czhouvpw.exe	86
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87
PID 4064 wrote to memory of 2972	4064	czhouvpw.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2972	attrib.exe
3984	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\JPSL82.vbs"
1⤵
- Badlisted process makes network request
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
    3⤵
    - Modifies registry class
    PID:3960
- C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw.exe
  "C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw.exe" "C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\attrib.exe
    "C:\Windows\System32\attrib.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Views/modifies file attributes
    PID:3984

C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw.exe
"C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw.exe" "C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Views/modifies file attributes
  PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~tmp4711.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tmp4711.tmp
Size 1.7MB
SHA256 522c435e2074c7812ff0b800d2ed01c87dd4a667bc386f77a4083a1ea25b5cbb
MD5 7104f0522a0322031504b81855edc59f
SHA1 9fa4722ec2d66a1ed8a5701656115279002d078f
SHA512 64ef98a2d2c13bb71734a6d92ce0907a5441342812b61d69079c73cf0bb6a704072ec56a05c63754e30f3a1947bc533ce40c1957f97f9760789b34ab0c4bc867
SSDEEP 24576:4wjLj/FMh0WUlCRToVnGnPd+PDyOqFkN9kflH58QpOuOSjYpk:40jWtoVLPDyOe1pl+k
TLSH
T1B5856D13B2C9753DE0AB1E3A4E77E608987FB7722906CC0B67E0096C8E395445E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83f48ab6ce4c6198

Path C:\Users\Admin\AppData\Roaming\HWiN\83f48ab6ce4c6198
Size 4.6MB
SHA256 b8ad7d7397c6610656beb058b54bb7676b54c180365c9bb5a53eb685b8db68fb
MD5 1c06499faecbd28022913e5cae856d5d
SHA1 337d7e25530f7aa5357ae0104c4d871ca9b7237f
SHA512 fc1df87f74b74800c98fc6a4d4bedaab68567514569c4458a91bb5cbfe9c935fa0acb848e65370e290acf86075236bbac6b6ecd684eb89ea8dd2776d67f7b413
SSDEEP 98304:JnOWMomI8kQzbclmD5hH6iKE5ML4ugAuAZFHMvF9mIQ:JnOTXDPActhHza5jZFcQ
TLSH
T1512633E5E2AC8274260AB656F7F9DCB49649E81FC8C03C0569EDFB314117B1A607ECD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Roaming\HWiN\WebView2Loader.dll
Size 113KB
SHA256 cd2f07e47e98e52472bd744912edc9e9e645b544f5e612e2f38f89b7acb1e064
MD5 25473edbafc8f33413bcb284d79d30ff
SHA1 f64da5ddb853c4275a3da0cb6036216d93decb25
SHA512 8589ef4175d674a623b9d0b44dbf357417610eecb939fb494bad32f04c25fcf51855545eb25187266ead60d7cd72dd7f212f6019d4055d2e88d746bfbe8b5980
SSDEEP 3072:wnbFYqJx7sXRq2KVs9iiamgqeNZPTn7EtJlAlH5bgf4fmFf:wZYqJx4gkYiabEtJe9K2mV
TLSH
T1B0B35B5176D08072E5BE0A380874DB755B3F79A0DFA09DEB67841AA94F317C08E35E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czhouvpw

Path C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw
Size 1.2MB
SHA256 48dadb964aa7799cba0a3c4b59f646347b8a995bba979038497b3c682b3207f3
MD5 69594b60ce4877ae9d29959514ee407f
SHA1 d708b58ff90b73e424760522e38c836d1c4eaed5
SHA512 f9a9bad1c9525ad384b59aa888ca1a68d90754babea7c6f19a15cfe4793fb4da3a39220c74d9b11a3436c3848e4ae7004877a3e6494cdab48c2e669892c9ef71
SSDEEP 24576:ePiDTUJASYHuoKR0LLGEZtD9nqAP8Y+gfVJ4giaGk+JpM2CluPswQEUjsxG:QiDTaP+upefzpFVziotYEMMJ
TLSH
T15545333861D73CA6EB6E27266C9AC9E74BB32C0C3DE8DDB758062726503157443A6CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czhouvpw.exe

Path C:\Users\Admin\AppData\Roaming\HWiN\czhouvpw.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-38-0x0000000074F50000-0x0000000075114000-memory.dmp

Download

memory/2972-59-0x0000000000690000-0x0000000000695000-memory.dmp

Download

memory/2972-60-0x0000000000B30000-0x0000000000FCC000-memory.dmp

Download

memory/2972-65-0x0000000000B30000-0x0000000000FCC000-memory.dmp

Download

memory/2972-64-0x0000000000B30000-0x0000000000FCC000-memory.dmp

Download

memory/2972-63-0x0000000000B30000-0x0000000000FCC000-memory.dmp

Download

memory/3984-74-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-71-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-58-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-80-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-55-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-54-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-40-0x0000000001230000-0x0000000001235000-memory.dmp

Download

memory/3984-79-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-70-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-78-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-73-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-41-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-75-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-76-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/3984-77-0x0000000000400000-0x000000000089C000-memory.dmp

Download

memory/4064-57-0x0000000073EA0000-0x0000000074064000-memory.dmp

Download

memory/4064-45-0x0000000073EA0000-0x0000000074064000-memory.dmp

Download

memory/4064-39-0x0000000073EA0000-0x0000000074064000-memory.dmp

Download