Overview

overview

7

Static

static

3

speed.exe

windows10-2004-x64

7

speed.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/06/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    speed.exe
  • Size 7.4MB
  • Sample260622-pf9dwscs21
  • SHA256 05c0766559d164e929c5cff6360cbeb6b3f4afe59fef88be3b0677bdcec1a5ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryinstallerspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\speed.exe
    "C:\Users\Admin\AppData\Local\Temp\speed.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\is-EN85N.tmp\speed.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EN85N.tmp\speed.tmp" /SL5="$D0142,7550094,54272,C:\Users\Admin\AppData\Local\Temp\speed.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3420
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\COMDLG32.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:536
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCTL.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5060
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSWINSCK.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4524
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCT2.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3832
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMM32.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3268
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSMASK32.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3000
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\TABCTL32.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4420
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\THREED32.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:332
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSBIND.DLL"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3548
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSSTDFMT.DLL"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4296
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao350.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2024
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4988
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\System\ado\msado15.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2424
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\fpSPR80.OCX"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1992
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Btn32x10.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3336
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\½ºÇǵå\CMButton.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3264
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\½ºÇǵå\MJGraph.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:940
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\½ºÇǵå\VFunzip.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4352
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\½ºÇǵå\VFzip.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:972
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\½ºÇǵå\BrumiOcxA.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2724
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\½ºÇǵå\seeid2.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2556
      • C:\½ºÇǵå\AppAssist.exe
        "C:\½ºÇǵå\AppAssist.exe" /inst;p=8;e=Speed.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of SetWindowsHookEx
        PID:4008
      • C:\½ºÇǵå\Speed.exe
        "C:\½ºÇǵå\Speed.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\½ºÇǵå\AppAssist.exe
          C:\½ºÇǵå\AppAssist.exe /exec;p=8
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          PID:1140
        • C:\½ºÇǵå\FirstCheck.exe
          "C:\½ºÇǵå\FirstCheck.exe" C:\½ºÇǵå\DBS\dbMain.mdb|??
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dao350.dll
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao350.dll
        • Size 556KB
        • SHA256 a4b20735be317a924d2e36707baaf911fbae890ca53c5044fb506f15d33bcb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3D0AC26322348780E90E022EA217C58C
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3D0AC26322348780E90E022EA217C58C
        • Size 15KB
        • SHA256 c2e30c8b311929806a24eb648199ebd97ae9eed2f406ba38dc5b35f1cc5c4d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
        • Size 5B
        • SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
        • MD5 SHA1 SHA512
        Submit Download

        A3D5BF1283C2E63D8C8A8C72F0051F5A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A
        • Size 834B
        • SHA256 de6bcf84b3f5959cfdf2f8b6622a68cbbbd52d804e59751a5e52a8ac985d369d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0972B7C417F696E06E186AEB26286F01_C06803BF3DE0E9E307E5C45C04CB632B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_C06803BF3DE0E9E307E5C45C04CB632B
        • Size 394B
        • SHA256 a629f1d61a2906345bee9469f8beb7ebc8e0b3a1fc70f9fb4c73e0e33251fbda
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0972B7C417F696E06E186AEB26286F01_C06803BF3DE0E9E307E5C45C04CB632B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_C06803BF3DE0E9E307E5C45C04CB632B
        • Size 394B
        • SHA256 4dfe3b9ef0c24d5b9e7958c541ac7bf0ecb1eab001c7cd3826820a6e0e8216f2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0972B7C417F696E06E186AEB26286F01_C06803BF3DE0E9E307E5C45C04CB632B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_C06803BF3DE0E9E307E5C45C04CB632B
        • Size 394B
        • SHA256 63872c42b18cbd7f91df4f30e474005d7181dacf1b4651e61bd6fb73d8e3848e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        3D0AC26322348780E90E022EA217C58C
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
        • Size 170B
        • SHA256 09bbf8144fc16d86e0825d2d34dc10cd3553f6760618c6363d6ae3fdcb4e651e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
        • Size 392B
        • SHA256 566e1f1538acac2373c37795aa6bd7cae76706a9375b682db4a83ffcb6c5ae9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
        • Size 392B
        • SHA256 1a97033304738ae43d5889d084d4be2521c59c26ee6b806a4c4884d437c52f6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        A3D5BF1283C2E63D8C8A8C72F0051F5A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
        • Size 178B
        • SHA256 f1a410e90fc3d2f2ed03587ca6fe953ae30cde24feb174a0e8eabe8e41223ea3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        speed.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-EN85N.tmp\speed.tmp
        • Size 688KB
        • SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Btn32x10.ocx
        • Path C:\Windows\SysWOW64\Btn32x10.ocx
        • Size 264KB
        • SHA256 c0fc1ffcf3eeae2ad32c13cc75df2db10868c909d9ad6cc84c7d0c3f1bfb413e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COMDLG32.OCX
        • Path C:\Windows\SysWOW64\COMDLG32.OCX
        • Size 149KB
        • SHA256 e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSBIND.DLL
        • Path C:\Windows\SysWOW64\MSBIND.DLL
        • Size 77KB
        • SHA256 c5c533f319eafd251a7dd7867f7342d7275e3bfbf7c1eb48846b260bb99d11b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSCOMCT2.OCX
        • Path C:\Windows\SysWOW64\MSCOMCT2.OCX
        • Size 646KB
        • SHA256 160b0cef5e9ed57c024e9b3a278e6456e849daa85d46f2b6d1450bf19fca72dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSCOMCTL.OCX
        • Path C:\Windows\SysWOW64\MSCOMCTL.OCX
        • Size 1.0MB
        • SHA256 fac6736251d3c61ecbd63be0420d1c75d5cd0442181d479013330155ca37d358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSCOMM32.OCX
        • Path C:\Windows\SysWOW64\MSCOMM32.OCX
        • Size 101KB
        • SHA256 51a1d6812e445c26c71465e2709e6d1ad587f8513002d662cd160f424f48b37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSMASK32.OCX
        • Path C:\Windows\SysWOW64\MSMASK32.OCX
        • Size 164KB
        • SHA256 804955435643d896370321dd81b7a208bfaee8935bb30cc75a6cc49d20f70640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSSTDFMT.DLL
        • Path C:\Windows\SysWOW64\MSSTDFMT.DLL
        • Size 117KB
        • SHA256 3d5c3074fc645da3b68c859a709a5fbefb7df43f458af01ffda55bfc1456e7fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSWINSCK.OCX
        • Path C:\Windows\SysWOW64\MSWINSCK.OCX
        • Size 121KB
        • SHA256 80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TABCTL32.OCX
        • Path C:\Windows\SysWOW64\TABCTL32.OCX
        • Size 218KB
        • SHA256 d10a197fd53e65dc910ca4aed86cb674c613ff14ce6436d1a445bb27a7a499e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        THREED32.OCX
        • Path C:\Windows\SysWOW64\THREED32.OCX
        • Size 201KB
        • SHA256 fa274f6b12cf50bf582fcaef4a9eb94585d176dedc440cfa6ed82aa351aa8704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fpSPR80.OCX
        • Path C:\Windows\SysWOW64\fpSPR80.OCX
        • Size 1.6MB
        • SHA256 8e3edf44841a3b8f0c4234ce50788ceb2603c82fc7fd3956ae6238b5ffc701c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BrumiOcxA.ocx
        • Path C:\½ºÇǵå\BrumiOcxA.ocx
        • Size 28KB
        • SHA256 a25674490457bb13c909783c056d1b30189517027b0377dfb7270fd2f954cb25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CMButton.ocx
        • Path C:\½ºÇǵå\CMButton.ocx
        • Size 120KB
        • SHA256 5791ab70e88dd7749ecc250e977753f9381376a57b97c748e1e592d08d1362d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbMain.mdb
        • Path C:\½ºÇǵå\DBS\dbMain.mdb
        • Size 668KB
        • SHA256 3447828fb8b507e64b301790ac56051990abb52d1321cb6676cbf96bb7763daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FirstCheck.exe
        • Path C:\½ºÇǵå\FirstCheck.exe
        • Size 82KB
        • SHA256 22828f818dede0982465fc62bd65d7c1a5631c8e65376a75dafc07370daa63e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MJGraph.ocx
        • Path C:\½ºÇǵå\MJGraph.ocx
        • Size 64KB
        • SHA256 5e4c8b365308ca86756bca4d1131c691d9504d7187c37cf1b9a054ebc494ab99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Speed.exe
        • Path C:\½ºÇǵå\Speed.exe
        • Size 7.9MB
        • SHA256 37d5bdf7992a95f27b7f0e4aa4c2b5f8a9c8a8138ef73138aebd2d959543f529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VFunzip.ocx
        • Path C:\½ºÇǵå\VFunzip.ocx
        • Size 132KB
        • SHA256 199de2e6a2e19eef38db002145eb08130692bfe1b11943144cd2275093aa1c0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VFzip.ocx
        • Path C:\½ºÇǵå\VFzip.ocx
        • Size 92KB
        • SHA256 3c2cbc6bb87a4473dace28aadc5e3fd57e2c9673f34f3378cdce8a4dd67142d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appassist.exe
        • Path C:\½ºÇǵå\appassist.exe
        • Size 34KB
        • SHA256 560ce851562eb7b3bc529966092267fc142fec9b6167e5fa1f29d3c765ee0a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        seeid2.ocx
        • Path C:\½ºÇǵå\seeid2.ocx
        • Size 68KB
        • SHA256 f8d8c556b3a5fc9a4149d8b97881ce3765d15e0c439d25f1dd73a5687a80068b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1592-226-0x0000000000400000-0x0000000000413000-memory.dmp
        Download

        memory/2856-217-0x0000000000400000-0x0000000000C1E000-memory.dmp
        Download

        memory/3420-222-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/3420-16-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/3420-14-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/3420-11-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/3420-7-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/3432-0-0x000000000040D000-0x000000000040E000-memory.dmp
        Download

        memory/3432-223-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/3432-15-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/3432-1-0x0000000000400000-0x0000000000414000-memory.dmp
        Download