Overview

overview

7

Static

static

3

75e8ce3a6a...c9.exe

windows10-2004-x64

7

75e8ce3a6a...c9.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 22:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    75e8ce3a6ae3c4b1522ac76146cd7f2014b3fdf7ff2cffd17e525951dc50cfc9.exe
  • Size 3.6MB
  • Sample260717-19pr5abv5x
  • SHA256 75e8ce3a6ae3c4b1522ac76146cd7f2014b3fdf7ff2cffd17e525951dc50cfc9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75e8ce3a6ae3c4b1522ac76146cd7f2014b3fdf7ff2cffd17e525951dc50cfc9.exe
    "C:\Users\Admin\AppData\Local\Temp\75e8ce3a6ae3c4b1522ac76146cd7f2014b3fdf7ff2cffd17e525951dc50cfc9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6112
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c set
      2⤵
      • Executes a command shell one-liner
      PID:5680
    • C:\Users\Admin\AppData\Local\Temp\~3962288247158138270~\sg.tmp
      7zG_exe x "C:\Users\Admin\AppData\Local\Temp\75e8ce3a6ae3c4b1522ac76146cd7f2014b3fdf7ff2cffd17e525951dc50cfc9.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~6143412717276996024"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4864
    • C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Dism++x64.exe
      "C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Dism++x64.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:6020

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        sg.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~3962288247158138270~\sg.tmp
        • Size 838KB
        • SHA256 e572ed07a5998c8fc256da630bf6f902c511605d665a6aa7120e75adb668ed26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Config.ini
        • Size 1KB
        • SHA256 baad928d8c00ff96ba1cdaa30a96d9c69e0629f24cb9b7498d9c9fee75ccdf55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Data.zip
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Data.zip
        • Size 45KB
        • SHA256 bde45526069a31a534c1fe13289dfe9867bcfe82ce44184a0bb4fce587494a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dism++.log
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Dism++.log
        • Size 248B
        • SHA256 306dfb084899bb34bd194b49de32bda85bd64ca7230bb7987e8d804e70301c35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zh-Hans.zip
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Languages\zh-Hans.zip
        • Size 6KB
        • SHA256 b6cfce094bf429022f08e22c8f93accac526ffb289eedc713a70b306c2b78a94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Plugin.amd64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\Plugin.amd64.dll
        • Size 129KB
        • SHA256 200e4858132591cb7cf7d575519e2a24ac405cb0797b66b901bb710259301cfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Plugin.arm64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\Plugin.arm64.dll
        • Size 127KB
        • SHA256 0f6a92c93b9b18323f7c8c08a3eb9a565bed91c9c1d2605e182e7264f251972f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Plugin.x86.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\Plugin.x86.dll
        • Size 96KB
        • SHA256 5bed5764ef69b10635f7a2dac84f02d717e7a05cad4507271f84133acd855653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PluginRes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\PluginRes.dll
        • Size 629KB
        • SHA256 c3ae5648a79358b82ab684ca132bff30150291dc5d8483f22960ba40189710a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdateInfo.zip
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\UpdateInfo.zip
        • Size 8KB
        • SHA256 2bda507641b5451beee95dc8d0105f3c96e56d04b905f38969e2cb4ec9001080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CBSHost.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\amd64\CBSHost.dll
        • Size 170KB
        • SHA256 8d4aac9defb8c4288c738d5e8e392128d9ba5995738334e305301ab78ec2cdb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NCleaner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\amd64\NCleaner.dll
        • Size 54KB
        • SHA256 141587ad11529d238dc7b63d7f30002ff042c3b06282d075e44e9c5af07ccc17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bcdboot.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\amd64\bcdboot.exe
        • Size 188KB
        • SHA256 309f3eccb0093cc6cc98f858bd3ce67b00bb810728ffb177b7bd287fb3c92b97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wimgapi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\amd64\wimgapi.dll
        • Size 754KB
        • SHA256 e51344884512b486ff1de3c30e554b0e1cb6ffb8ed4e3bdd31a29a76454f5562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wofadk.sys
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\amd64\wofadk.sys
        • Size 216KB
        • SHA256 54fba1cc80e820b462229fcb987fb8df2321ed85d9450f3f4a81d0982e5d289f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CBSHost.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\arm64\CBSHost.dll
        • Size 170KB
        • SHA256 65ced41cb868e901096cf20793426b3fab966a34e03dc57b6d971bb55693a613
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NCleaner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\arm64\NCleaner.dll
        • Size 39KB
        • SHA256 62bf4bcd3b3207e9bb8a4097684605a732e820968a9a8835a0f39e9bb67b26f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.ui.zip
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\default.ui.zip
        • Size 31KB
        • SHA256 1a90365ac33c37eeae4dd712f84062466c10948cf5b567574055e0b8b0f70534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CBSHost.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\x86\CBSHost.dll
        • Size 119KB
        • SHA256 6d47967988e1ad20a5d25a20384bb5ca14aed19b5ffe458efc5fee5bd363733c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NCleaner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\x86\NCleaner.dll
        • Size 35KB
        • SHA256 a1f16902ff0594a80da523dff4b8340b231188125dbfb87fe3e2f0ce23276253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bcdboot.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\x86\bcdboot.exe
        • Size 158KB
        • SHA256 0b85157e004ee59cfe054ad5bda6d8a9c3e3270d002befb07cddc6acb7497388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wimgapi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\x86\wimgapi.dll
        • Size 596KB
        • SHA256 e3e3eb7e2ed4aed86965bb42ffa6c10388acf62ae33d236dc613348fc7e120f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wofadk.sys
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Config\x86\wofadk.sys
        • Size 186KB
        • SHA256 48b2267e2cd998e325a88a4a877e6837fabd7ed3a8649c225de5b9c5ffbbd918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dism++ARM64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Dism++ARM64.exe
        • Size 1.1MB
        • SHA256 07137bf5e02b452744b73289cd51c18d650368780e25a12e1f64acfc3cea1329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dism++x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Dism++x64.exe
        • Size 1.0MB
        • SHA256 f18ab62cfc4c3e2b652a0e44227a621168ba867593f12dab60f416d71c97dc94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dism++x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~6143412717276996024\Dism++x86.exe
        • Size 741KB
        • SHA256 63995442aaa92917e7939bdc23c14971705360542712a4e2efcde021f2fe2c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download