Overview

overview

8

Static

static

3

farware.exe

windows10-2004-x64

7

farware.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    44s
  • max time network
    37s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 13:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    farware.exe
  • Size 2.8MB
  • Sample260707-q1ycssgs9p
  • SHA256 b64906b980784d47865532b8f18775d92b9395b1bf96239cb432ed1def3a57e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 47 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\farware.exe
    "C:\Users\Admin\AppData\Local\Temp\farware.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5912
    • C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\dg2f20pxyejk.exe
      "C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\dg2f20pxyejk.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2664
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5804
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5128
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 591B
        • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Application.deps.json
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\Application.deps.json
        • Size 35KB
        • SHA256 ddc6866fab0e4a9308e7dc3422e1e646581088b5371cab393672866f119d9cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Application.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\Application.dll
        • Size 2.7MB
        • SHA256 3a3c4592ad43a66f24c816a1cbd9d97e18c44f36c4b50a74ccd12701efd6036b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Application.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\Application.runtimeconfig.json
        • Size 439B
        • SHA256 09c3537cf69db3d8c4c34480109bfd1716664d50371f95502b95a266729bf592
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DirectWriteForwarder.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\DirectWriteForwarder.dll
        • Size 490KB
        • SHA256 2a623687def6a72c7062dab2883725b897523b30619602e1c9f9fa6a866c7f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\Microsoft.Win32.Primitives.dll
        • Size 15KB
        • SHA256 50e52f74a18cf64efd7e3635c4489264a39207b221c69180999371c5597d899b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\Microsoft.Win32.Registry.dll
        • Size 118KB
        • SHA256 fa268218302f35a460d30f0480323428a95bf67bcb957ba8cd757a6593a1586b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PresentationCore.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\PresentationCore.dll
        • Size 8.1MB
        • SHA256 06c11c41bdd66a71889ab3c8046f18e8145e52661e6823bd1fa692b47ea6c930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PresentationFramework.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\PresentationFramework.dll
        • Size 15.4MB
        • SHA256 b6ca27c827f500396613c6ba3306bef369cc5bb4c2b9094112c1f44fb3e75854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Collections.NonGeneric.dll
        • Size 102KB
        • SHA256 8a4845d14b6c46234a34b4ff1fa9ee0eb157339928b58e708212daca68048294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Collections.Specialized.dll
        • Size 102KB
        • SHA256 b96fd8a86a0105ff787075a10d2ab58c72ba01d02dc0d31dae582cbd78d3aee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Collections.dll
        • Size 254KB
        • SHA256 43f1812c74be62e65bb6e232d2a61a24f1ad732d014ed5adc6fe1f13e454de8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 719473d4afdabd721abe970b1f2bf20e40f3e447da6d0b784a579badb82b5a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Debug.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Diagnostics.Debug.dll
        • Size 15KB
        • SHA256 71fa39187aed0e29a98a0c7ac1c344cbb4d6fe7bbb8a7830a7673e181dc37778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Diagnostics.DiagnosticSource.dll
        • Size 406KB
        • SHA256 269b3a1dba411fbcd44c647ccfba184c3fa9ae01bada673ddf7e70ebc60728ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Tracing.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Diagnostics.Tracing.dll
        • Size 16KB
        • SHA256 57aa3cd37e582f4f3080a53a5ad99fde95d0aba6edd8d7fafd73017552349676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Packaging.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.IO.Packaging.dll
        • Size 286KB
        • SHA256 e84e52280a1c76ae6f84bfe263ab620193924df4bce73cde1a2701e2854034ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Net.Http.dll
        • Size 1.7MB
        • SHA256 7f95d4356ec6c5f909ab2cf1f2c29d3c279c1f0a1a97b40fb5cccfdf39972ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Net.Primitives.dll
        • Size 226KB
        • SHA256 7e6667e15d7400a02659474e1e8b795377b89057c9ffe1c41ab3df9de94626b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Net.Security.dll
        • Size 654KB
        • SHA256 5e5f39bd0ddb55528764bfbe03cf2f9a0632d4d9fb313dee064fbf893c5ae98a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Private.CoreLib.dll
        • Size 12.6MB
        • SHA256 09c5898352069d4971591723371be70537bea18503c2bf7c6b9dd11f74760382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Private.Uri.dll
        • Size 254KB
        • SHA256 b762dfa0e052d5fd9fd05309b4ae9e03d6ae46f262b620cfaad961a6070ef7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.CompilerServices.VisualC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Runtime.CompilerServices.VisualC.dll
        • Size 30KB
        • SHA256 4f0b694621b954307243f61a176938ee78ad46ce45d00d6e43331aefc1b54de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Runtime.Extensions.dll
        • Size 17KB
        • SHA256 7211259add4a0a9b0ad045ec5c4b22c8e8a6ce04d66de63952b7899d28a9774a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Runtime.InteropServices.dll
        • Size 94KB
        • SHA256 7c53e031183b36fe378205ac894b1ddc41bca992393b153c7e68b951dc14f657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Runtime.dll
        • Size 42KB
        • SHA256 55242c750d5817ab526ab17be00a604d88458c49001eb520c0538194a9a46f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Security.Cryptography.dll
        • Size 2.0MB
        • SHA256 2d87acc3aa3f516d13562f163651c0efbacf8542b9a72389e69b5ecd124ffefc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Text.Json.dll
        • Size 1.4MB
        • SHA256 61dd1e919e85962de35fc839f45651d3f22809ffac193c9bc2d71ac58347d31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Threading.dll
        • Size 82KB
        • SHA256 72e11fd27c4e00cf5f1b78d009bc782d4d594a9d149f9c455c067f0be7f38f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xaml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\System.Xaml.dll
        • Size 1.4MB
        • SHA256 c40a366b6715bde1054927c27e65114c976dd3832a75a6b34fe3cbf4a18220af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsBase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\WindowsBase.dll
        • Size 2.2MB
        • SHA256 34f54062cddf13a353981136e831250838b07bfb83fb13153ed31ea1fd56d51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\clrjit.dll
        • Size 1.7MB
        • SHA256 4058cbcf9ce69938e29e6ab8bdcbcd75266fde7aad5c016394e0bde0ba690441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\coreclr.dll
        • Size 4.8MB
        • SHA256 bdcf2dabaaf30e293a59ecdada775cb9bc052b75c08147e19ea2fa82a348499a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dg2f20pxyejk.exe
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\dg2f20pxyejk.exe
        • Size 148KB
        • SHA256 15ba8dab7e16ba3632aadaa6c0db40caca32e31e37f3bb34f958daceb8af3fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\hostfxr.dll
        • Size 358KB
        • SHA256 6030fa4943ff98b4d29787c1b3045a98d4fd03dd644a3de223f0aac2ed984b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\Users\Admin\AppData\Local\Temp\dg2f20pxyejk\hostpolicy.dll
        • Size 397KB
        • SHA256 d6fd9ce40c9e2ff31f552313773b8c870249fe8e5f0140808a2bd26a238afcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5128-1037-0x000001E9801E0000-0x000001E9802E0000-memory.dmp
        Download

        memory/5128-1046-0x000001E983C70000-0x000001E983C90000-memory.dmp
        Download

        memory/5128-1047-0x000001E993EE0000-0x000001E993FE0000-memory.dmp
        Download

        memory/5128-1084-0x000001E994290000-0x000001E9942B0000-memory.dmp
        Download

        memory/5128-1059-0x000001E983D30000-0x000001E983D50000-memory.dmp
        Download

        memory/5912-11-0x0000016FDCA80000-0x0000016FDCA92000-memory.dmp
        Download

        memory/5912-3-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-9-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-8-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-6-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-5-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-4-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-7-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-2-0x0000016FDC9F0000-0x0000016FDC9FA000-memory.dmp
        Download

        memory/5912-1-0x0000016FDC2B0000-0x0000016FDC58C000-memory.dmp
        Download

        memory/5912-0-0x00007FFEC871F000-0x00007FFEC8720000-memory.dmp
        Download

        memory/5912-524-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-525-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-538-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download

        memory/5912-957-0x00007FFEC8590000-0x00007FFEC8F34000-memory.dmp
        Download