Overview

overview

8

Static

static

3

_75e7bfed5...98.exe

windows10-2004-x64

7

_75e7bfed5...98.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 18:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98.exe
  • Size 31.5MB
  • Sample260708-w45tyafz4x
  • SHA256 75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 31 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\_75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98.exe
    "C:\Users\Admin\AppData\Local\Temp\_75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Users\Admin\AppData\Local\Temp\_75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98.exe
      "C:\Users\Admin\AppData\Local\Temp\_75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98.exe"
      2⤵
      • Loads dropped DLL
      PID:6096
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1520
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2732
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5072
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4616

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _imaging.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\PIL\_imaging.cp313-win_amd64.pyd
          • Size 2.4MB
          • SHA256 010808cd1eb564aeaee8ba65ab2e20ae07f9bd9cbab8dba1d88931bc6842de0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _webp.pyi
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\PIL\_webp.pyi
          • Size 66B
          • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_asyncio.pyd
          • Size 71KB
          • SHA256 166206ce4d432931cb29d8ee7398edf84b1b751d694668e0c89fff65f4147657
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _brotli.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_brotli.cp313-win_amd64.pyd
          • Size 836KB
          • SHA256 a7f83086a999a01db0ca8cba6d476b4aa74ec2f96292cf4e17446dd30c085c61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_bz2.pyd
          • Size 84KB
          • SHA256 64d9fbb516e08a6780dca160e40d8c6723d2a659b5ca3020de7a041305b3a3d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_ctypes.pyd
          • Size 131KB
          • SHA256 b9c9e713f11e111daa55e4a62a135d7e385fa7aa0986d30b286d000e122b13aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_decimal.pyd
          • Size 277KB
          • SHA256 b1f2dd16190154652f9ddb9e58a335932f56674dcdf6395bc634c577ae00429c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_hashlib.pyd
          • Size 67KB
          • SHA256 1e079c6b44488e273bc62d9bcb27cec519e9916b47b8c2878ebade0772e0f484
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_lzma.pyd
          • Size 155KB
          • SHA256 999ba26fe0b0376b7898d50ddb2f5012e7a64228e31fcdca99a4d7079df669e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_overlapped.pyd
          • Size 56KB
          • SHA256 8f40faaf55ce040ff5027a23df21da549e7d22a590832e47f6ce75a54a6134e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_queue.pyd
          • Size 34KB
          • SHA256 baa5a4cec6c369efc461f7109f1e6150c0afeef8ce53dbd9d673a00093cdadf8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_socket.pyd
          • Size 84KB
          • SHA256 7acc6c44436bf77be3c425d39f0acba03b42119513ef9db31a7039c969e056bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_ssl.pyd
          • Size 177KB
          • SHA256 738c579ed151498337026ea1f5dc7688197b41b74e39f4d9de05261bb35d9206
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_tkinter.pyd
          • Size 67KB
          • SHA256 777c29860ce1afb27ea8fc4afaf9c608ff49e9d19673c766c75c6053db8fb6ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\_wmi.pyd
          • Size 38KB
          • SHA256 6793bd216b5a329689cde8b1532858d6731707ec5063897f979a81e57077402c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\base_library.zip
          • Size 1.3MB
          • SHA256 b21ab010a653a5b434521e55a2c3ef87bb8a9ff9e043bf3289fa6cc7279586ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\certifi\cacert.pem
          • Size 283KB
          • SHA256 966ddc609c44bfd4a8031e00b5cdcd893d43f7677deb9bdc203e87dfd7fff77a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\charset_normalizer\md.cp313-win_amd64.pyd
          • Size 10KB
          • SHA256 76c8700ffc983bbec07468e354039b21e25e49e7c19f43d7343994c90d4bb7bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md__mypyc.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
          • Size 122KB
          • SHA256 e9c308245fe01d33ef92c7026115a0a930fd865fbe1bfcefa91e76c6aa32a0b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\libssl-3.dll
          • Size 776KB
          • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementpath.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\lxml\_elementpath.cp313-win_amd64.pyd
          • Size 144KB
          • SHA256 1cc38e702eb69aac7fcc8a5bfac5d25eb64fb2352ebb795aded5add3269d3736
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          etree.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\lxml\etree.cp313-win_amd64.pyd
          • Size 3.9MB
          • SHA256 547aacfa7c23afa48ed5a6e42b8e0f719086fe0130a35d51ffc60b2738a98fe4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\python313.dll
          • Size 5.8MB
          • SHA256 c9f98606d0d06f4e8ae75ae385021e58b57c90d4fd325c0313c8c42abe1ebf63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\reportlab-5.0.0.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\select.pyd
          • Size 32KB
          • SHA256 01c8fef709b657b17e1db3754b05cb1070ad3e303dd531ef0f5545316df53aa2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl86t.dll
          • Size 1.8MB
          • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk86t.dll
          • Size 1.5MB
          • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\ucrtbase.dll
          • Size 1.3MB
          • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\unicodedata.pyd
          • Size 695KB
          • SHA256 cc1f066d88c26a21808ec6053c0989d702b6d46429bb4f363e4f29b67f311c89
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI10682\zlib1.dll
          • Size 142KB
          • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2732-1591-0x000002B902D70000-0x000002B902D90000-memory.dmp
          Download

          memory/2732-1577-0x000002B9001E0000-0x000002B9002E0000-memory.dmp
          Download

          memory/2732-1617-0x000002B914210000-0x000002B914230000-memory.dmp
          Download

          memory/2732-1586-0x000002B902E50000-0x000002B902F50000-memory.dmp
          Download

          memory/2732-1585-0x000002B902A30000-0x000002B902A50000-memory.dmp
          Download

          memory/6096-1554-0x00007FFC7A770000-0x00007FFC7A799000-memory.dmp
          Download