2bc85e540a631cf84d9ca8265ffbd41512568315e45bd7d9faa54c38b6e8b82f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Զȵ/wifi.exe
Size 333KB
Sample260601-phbkmsdv5l
SHA256 2bc85e540a631cf84d9ca8265ffbd41512568315e45bd7d9faa54c38b6e8b82f
MD5 6234394b13ef7ac8dbcc749f8c4286ae
SHA1 54cb403245b11ac6cba7cbae2b27c2d73fa7977c
SHA512 7a1d5087082740028d7d2f7f396bb6663d64a69b8bec88b96ad0d9c7ca5349800457db9d35a06c82cfb284af39dc99f5939a2c47c897e017721714e45f83bf0c
SSDEEP 6144:AoTf1YKSP3zJI2c0ROBSs5X4/eGb7cHdS4nAXlgtDit:AoTfx+l1c0ROBSaX/VS
TLSH
T19D74E5C6F45042E2EC294A75D19A7CB00947BE3EDB6D8CCB32C8F69235A30E345B595B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	wifi.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe
4264	powershell.exe
1304	powershell.exe
2264	powershell.exe
1704	powershell.exe
4076	powershell.exe
4544	powershell.exe
4696	powershell.exe
3828	powershell.exe
3592	powershell.exe
2820	powershell.exe
2804	powershell.exe
4980	powershell.exe
3992	powershell.exe
3024	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wifi.exe

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
1068	timeout.exe
4900	timeout.exe
5072	timeout.exe
2764	timeout.exe
2264	timeout.exe
1636	timeout.exe
1692	timeout.exe
1180	timeout.exe
980	timeout.exe
3164	timeout.exe
2464	timeout.exe
2056	timeout.exe
2096	timeout.exe
4696	timeout.exe
4316	timeout.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe
4076	powershell.exe
4076	powershell.exe
3460	powershell.exe
3460	powershell.exe
3592	powershell.exe
3592	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4696	powershell.exe
4696	powershell.exe
4264	powershell.exe
4264	powershell.exe
3828	powershell.exe
3828	powershell.exe
3992	powershell.exe
3992	powershell.exe
1304	powershell.exe
1304	powershell.exe
2264	powershell.exe
2264	powershell.exe
2820	powershell.exe
2820	powershell.exe
1704	powershell.exe
1704	powershell.exe
2804	powershell.exe
2804	powershell.exe
3024	powershell.exe
3024	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 720	4088	wifi.exe	85
PID 720 wrote to memory of 4980	720	cmd.exe	90
PID 720 wrote to memory of 2464	720	cmd.exe	91
PID 720 wrote to memory of 4076	720	cmd.exe	94
PID 720 wrote to memory of 2056	720	cmd.exe	95
PID 720 wrote to memory of 3460	720	cmd.exe	96
PID 720 wrote to memory of 4900	720	cmd.exe	97
PID 720 wrote to memory of 3592	720	cmd.exe	100
PID 720 wrote to memory of 2096	720	cmd.exe	101
PID 720 wrote to memory of 4544	720	cmd.exe	110
PID 720 wrote to memory of 2264	720	cmd.exe	112
PID 720 wrote to memory of 4696	720	cmd.exe	116
PID 720 wrote to memory of 1692	720	cmd.exe	117
PID 720 wrote to memory of 4264	720	cmd.exe	118
PID 720 wrote to memory of 5072	720	cmd.exe	119
PID 720 wrote to memory of 3828	720	cmd.exe	122
PID 720 wrote to memory of 1180	720	cmd.exe	123
PID 720 wrote to memory of 3992	720	cmd.exe	124
PID 720 wrote to memory of 1636	720	cmd.exe	125
PID 720 wrote to memory of 1304	720	cmd.exe	126
PID 720 wrote to memory of 2764	720	cmd.exe	127
PID 720 wrote to memory of 2264	720	cmd.exe	128
PID 720 wrote to memory of 4696	720	cmd.exe	129
PID 720 wrote to memory of 2820	720	cmd.exe	132
PID 720 wrote to memory of 4316	720	cmd.exe	133
PID 720 wrote to memory of 1704	720	cmd.exe	134
PID 720 wrote to memory of 1068	720	cmd.exe	135
PID 720 wrote to memory of 2804	720	cmd.exe	136
PID 720 wrote to memory of 980	720	cmd.exe	137
PID 720 wrote to memory of 3024	720	cmd.exe	141
PID 720 wrote to memory of 3164	720	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\Զȵ\wifi.exe
"C:\Users\Admin\AppData\Local\Temp\Զȵ\wifi.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7124.tmp\7125.bat C:\Users\Admin\AppData\Local\Temp\??????\wifi.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...