181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe
Size 2.9MB
Sample260719-3avkfaas21
SHA256 181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db
MD5 2d632f094e7c2f42696c158ae365ca47
SHA1 b62cd4d3e5742a2d061504db75dbb66d73a7af82
SHA512 8fc106a34d63ba25bfb8e3cb44a36513eb2d6bf166d126351f83e38f61a3ea6e29438cbda17ac7cbe1b391dc16a9c391607597d7d51821085d394b87a24d4f35
SSDEEP 24576:PaZuNejWhftaY0jkcKpjaZPVdBzUwrD9vD5M33Una8c2MS1dDctmulYsaXTUmKfF:CZux2jkcKE3oGD5M33UaQDqmu9aNWB
TLSH
T1CDD5122224B4D8B5F061E1F9C8A3E1FFD5E67C42D128824F4D207DBA7E72651AD2B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe

Executes dropped EXE 2 IoCs

pid	Process
1328	7zr.exe
4420	AutoIt3_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5836	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4420	AutoIt3_x64.exe
4420	AutoIt3_x64.exe
4420	AutoIt3_x64.exe
4420	AutoIt3_x64.exe
4420	AutoIt3_x64.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1328	7zr.exe
Token: 35	1328	7zr.exe
Token: SeSecurityPrivilege	1328	7zr.exe
Token: SeSecurityPrivilege	1328	7zr.exe
Token: SeDebugPrivilege	4420	AutoIt3_x64.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1328	4752	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe	84
PID 4752 wrote to memory of 4420	4752	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe	86
PID 4752 wrote to memory of 3724	4752	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe	88
PID 3724 wrote to memory of 5836	3724	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe	89
PID 4752 wrote to memory of 3828	4752	181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe	91

C:\Users\Admin\AppData\Local\Temp\181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe
"C:\Users\Admin\AppData\Local\Temp\181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7zr.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7zr.exe" x -aoa -p"vMgXworcvLkJ+c11mCsGQ" setup.7z
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe" libmmd.dll
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe
  "C:\Users\Admin\AppData\Local\Temp\181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db.exe" -sfxwaitall:1 "timeout" /t 2 /nobreak
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\System32\timeout.exe
    "C:\Windows\System32\timeout.exe" /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 300B
SHA256 eba2b2c14735dd9d8221583f3bb4800f8091c736bb6d1f8b998b6cab44ba6ef2
MD5 107cb361ff32a6a2452bdef401069c6b
SHA1 1a9a25d103df5b2065c26fa1aca605c97fa4adfb
SHA512 af331a019dafe09ab7c7bcd2fe740e99b7a21783eafcbc92318a21bee81bd14c4991db21b6afa75c05c2b87877ffb8866a015820f4087e39485ae76687dfd099
TLSH
T1FBE0CD73C1CFD32B1088705B05B9A5CE857257681B473A64A770D4D970C562D78A7101
MD5 SHA1 SHA512 TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7zr.exe
Size 889KB
SHA256 8bdcdb0a2333d6bebd7c610dfd245166481dfcc78114257a322748a4e4352fe8
MD5 91b137b3f99d2afef01e67b04acfef92
SHA1 6f5ad9bfe467483feceeca821870be4f6632b1ac
SHA512 58e884f7c79e81dd632b2cf34276b686870aedbf9729ce62fa523973756476e7b068d6eb1cd1f73ac92eaae40dc99c5ece4b046f826a989b3f44342dc29112b5
SSDEEP 12288:UVaZBgr8AeB3eTUuhc+8Ti2FFtphKmJvzx/y4vzYucmIIZn4+XCL:lT9pYUP+QpQmVx/yszjcm6+XI
TLSH
T1A9151966F6788275D073C079C5D25B9AEE723086173086C71286977C3F67BE68A3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmmd.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\libmmd.dll
Size 21KB
SHA256 11dea495d2b2b8a879ba5be490c235c1b3f8911b0f35a1ae63f461135dc71868
MD5 829c89c7d80c3c7dac90ceecd8f64f80
SHA1 37d398fc7f7e547e409292b503d909aee37cb07a
SHA512 ebd3fafd577fbd9e86adf6b40b650ab90e4d2a41b6d5eb717768bdf3f09de2f53d1fa7aae069a165fcc8c5f0d9034985352d531f7d2e76b4bf886e7e4be3e7a2
SSDEEP 384:MI4XLenCmw+655WGYKTxOMJX3aAbZN0YomyPtITefbev5nmY+umaGIWl8HmFj6Y6:dFnCmxcnYkOMJntbZN0FmyP2yjeVgQGK
TLSH
T1F0A2E1AC1A7B19CD16305B4F06B2B0A6936FB0FF514B88230B29C6A7D2C38D157DC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.7z

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.7z
Size 417KB
SHA256 91c116b146f60867de868afc7cc14328362156d87ab5417a65c2a37c15ecf314
MD5 7c1f4cbbee303d3b483186d9218566f1
SHA1 3f080bc5267da0e90d86c30c8b1ffa1fc62e32db
SHA512 86e1ff05a499fb77bd94d8c1605e0923cd8f1aa39274fa96cda0881105843340df3705c2aff9a3f369d1758d918b25f368898d783f13d4ce44b7e05cbe51a63c
SSDEEP 6144:Lhg2DbFSvCKRYRG8a0rIdAs4FRro/Ac9HI1m4NUUl83De55Nbt3scOZDSThPof:NXFSaKRYXa0rQURMvj4iNqpc79SA
TLSH
T1CE94234DC66EA0688EA44E13DE2D6CD6E5F4FD383B2627C7D2B111CECB19602D259E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_olxo0rzv.bip.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_olxo0rzv.bip.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4420-27-0x000001A471FD0000-0x000001A471FE0000-memory.dmp

Download

memory/4420-26-0x000001A471FD0000-0x000001A471FE0000-memory.dmp

Download

memory/4420-25-0x000001A471FD0000-0x000001A471FE0000-memory.dmp

Download

memory/4420-35-0x000001A471FD0000-0x000001A471FE0000-memory.dmp

Download

memory/4420-36-0x000001A471FE0000-0x000001A472002000-memory.dmp

Download