Analysis
- max time kernel
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AngryGoyII.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
AngryGoyII.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
General
- Target AngryGoyII.exe
- Size 47.9MB
- Sample260719-tmd9jsd15m
- SHA256 288d839aa1d272e080fbb52ff715ce71f22f795e46225f2794a44efa50e0a8c6
- MD5 d7dd891989fdb7b570afa6ab343c112f
- SHA1 d985eaf6d60f56add3357e1dae587a86a311acee
- SHA512 ec67100bcf0a60881426a6215a0e0d64fc7fe64b7a0239369d3e98cdc3434c0bb2d5f3786a2e371127716b0521981c9c7ff10913536c48595bb87e55a84a0ea1
- SSDEEP 786432:XPFuDKw9v7KwDhMAZhi/2ahAZQrIgEwNFuiSRlpoAj0GxetnJ+wQgBycTQrKdDNo:+K6MAZhi/2MIFwNF5SRlzj0G4xQkycTq
- TLSH T112B73300FBE08E61D467043220EDAB6552AEE889D7BB63E352557DC84EDFEE05631B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 30 IoCs
pid Process 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe 2676 AngryGoyII.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AngryGoyII.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ AngryGoyII.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2676 AngryGoyII.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\AdvDir.mfx
- Size 12KB
- SHA256 00c1bca2512b0d6278afd9bde4693348497238a233950621502962fd4b5df8ea
- MD5 cd827d3d88759afbcdaa300062e3cbb6
- SHA1 d2e4b9275ee046d1420fe69791941c002c66d3e4
- SHA512 30569c2cd796ab336d7feb7abef53bcb7dc95d98628946aced4ccc00e505aacae641ccda5a4ae7e4bbd32e5aa28402b4863d3f03b9d30ae57d16db768a46d5fb
- SSDEEP 192:H83pb0EOKhXot0PaVa/paYyUVAy/Y1JH2J4Ia4Y:c90s4tlI/0KEJWJC4
- TLSH T18D427527E7F48061E4BE5F75457E037BAA30BD51AABAD60E8500D42D4832B41BCB177B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\ForEach.mfx
- Size 73KB
- SHA256 2e3b169f989ce609b2dc4aa052343937badb1fbe41a702bf8327af9912d935b2
- MD5 2dabe793c09bf89d1804a5782e1eb755
- SHA1 4644b57822ce69065b12708a00a1c855a6808dd4
- SHA512 733249817df2e511d14d855a229ea4bd1383d2659504aae6e3855117c4fd13beb19db1fafce752c9913f8c3341f62d03bb8d37619317be55580dd04a44b02977
- SSDEEP 768:kJKBqQXJBpyXPda2iHKemMsVUfuYJezmgXgZVEdfLJWQIZKuISkNT8A8OMYSgvOc:RqZUmUfudzmXNQK7kNT8fYJvLLORUSG
- TLSH T1AE738D3074C0C0B2C09E18765829D73696FEA911AEF9D8477FA917AE4F317C1AA39353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\KcArray.mfx
- Size 32KB
- SHA256 16f507da7814a6105122cbc5a881ee558dafdcd0edc57dcdbce6798aa9dd68ec
- MD5 454ced31d695ea4f83db1ff81ab5cce2
- SHA1 a1d1d16f66d4ba77ffbb46c2c703135b6abbb68f
- SHA512 4f6b36cb7d26cc5623e1608cd061f71bef7c2b67061e6ed4bd55fe09e4971f8099be704ce58c0e5d80329a3396ab82c25502867e6d6a0451913a420279983d9e
- SSDEEP 384:rocCYN+65kmg2isir1GpsFhM2e2Ch5qa9EepY8LMxG:UcCGg2itr1Gpx5rpY8g
- TLSH T118E2B545EBE244D4DAB61E7159FE7373B736BD436EBEA22A4200D42C2C32342EA15731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\Layer.mfx
- Size 122KB
- SHA256 7da10d503a890cb3a9b653c5747717aba906bf26079f3038edd2b7177a59ed35
- MD5 7401110a97ed26241ce133b52fe2abba
- SHA1 2925536e1e15c132c6e11bc16e98ccc67993c2b4
- SHA512 887a0f2c428734d32bad868e8ac529f8196672356d9e6139406c0805ae3fd8c6fe04393d7f5c9018f527b60bb84741a0ac8ff0329035f50c27deec36093062c6
- SSDEEP 1536:7aGYQQwrlVUcmx0FnYGRPpnNm6prmICndZac8VkRyvsWjcdV+8Of9h+eOsaKq:7aGdQwbUS/nmICdZueV+vf9h/Ot/
- TLSH T1A9C34A1176E19032E5E317325D786A520ABEBD22FB75DACBA34C024D5D703C19B39BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\XBOXGamepad.mfx
- Size 64KB
- SHA256 4c0b333a1e55721d40609134a76d3fdbc62485d0c20f7faf34e229054da18b96
- MD5 1e66d9b53e22a5057dda3d6d8ff6ddd3
- SHA1 cc24d9b99dfd289e0f350a010d5db0df81aca4c0
- SHA512 265adba42c17ca02aed7720835043828c421d2fb8a0fe71a2f022fee99560c180cd67759873bdd24d973b547adb0960bc1b33246e5117674aa26526c6c914833
- SSDEEP 1536:FZn9Ntt+Tm2GG5MqnndJnwe2vIUcqaBtSx7j5F:7n9Ntt+Tm2GG5MqnYDv5aBts3
- TLSH T1F15319053A634033F0464DB681E956C15FBE7D033BBAE0EFEB5045795EA22C88971BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\adshow.mfx
- Size 40KB
- SHA256 c05b7b5fe45a20106ba776eec22dcbb606422edcae00942968cfd1f61046fc4c
- MD5 02b89ffb32c8c8db48732d61ea7587d2
- SHA1 42bc7b220123d2f1e2af88f9e37f53b6da6cc437
- SHA512 e07e8e95e0cedb27f654b040c9880234ad3ee01d3a30ab5c69b6ebae46d2efb0de689bcd1d9d1feaad4b6fe3583eacea2cb09bbcece3ce07399ff04a1f2870db
- SSDEEP 384:7HaGJuKXa2Km5N+UD6tE7SbTA6G3+xnVDLJvVhAdaB5mCfxa:z5uouGTcE7SHArGVDLJvVmdaB5Ff
- TLSH T19903090163F701F5E19A357128AB2B77963AFB591F79834B8B12EA2D1932380E539712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\aiffflt.sft
- Size 6KB
- SHA256 5c00a02a5c0084a6681d34e97f8dacb80742c7e1ea1682a9d7efc9723e970dee
- MD5 a9d967ec972eb6e073068ac2da0075bf
- SHA1 dc0e6751c7abcb58258d0c7c4fffc382768a0fe6
- SHA512 71eb106fe9f71c2f7fb0cce5bed0b67e8092f47311516bd18fac73ddab7e6bc93f40398043cc0aef6385cd8256c6c53f36ba0a38ec46d75e0befb14365ee9aa8
- SSDEEP 96:vzLiv3381GaXTgFjj5FBpWeZ682LkiS+edJ:vfU3ohXUFj3CAaLovdJ
- TLSH T1A8D1E702A3D010F5E89A0B7225E35337A0B9BE581BB4DB9FC888E51C1C322D2DC39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\clickteam-movement-controller.mfx
- Size 34KB
- SHA256 f42cf8a06f597308c9e5afe6aca52d229f769f5afa0162f87785fcc2a822efbf
- MD5 5fda00a9e5494366397111db051b6967
- SHA1 8911beb147549d89d305badb43dd8211b9476668
- SHA512 1208fb5348e6de659acea85eb4c94104b959b83aacc8876b766c18d925854d02b0634df8dfa60d09314f60925565614ead08e71d93057cfa8122f6e2f788763a
- SSDEEP 384:mLJm7qn3qD+3gKj166As9c/l7Syxmkk2K9ep0rg020z6mQJc9mAPkCORvuzQ4:mLTn6D+3gKj99w7ScFU6md9JkCORvuz
- TLSH T18BF2132367F60468F7BAAF31ADBD9723847AFC8658FCC64F1611822D1C736464852B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\clickteam-vector.mvx
- Size 32KB
- SHA256 67a1ebbd388887326e40d0b097cc88d829a547079de8f6ff0af72abc97e0f57d
- MD5 1d0f01e96da6115e25160301901b6d14
- SHA1 76e1684f03746f147fb701de87d09e63d302911a
- SHA512 ed39b9f84171c5fe98395a94ef65066e4ee4ccfc6418bcb13b4219fa9db8ff970bbe2a9ece47ed841bfb6b175afef24f33193a8a1fabd9a5f846aa3f0844f55b
- SSDEEP 192:hFdWitYB9mMhGZR9QMnbASSZ9CbP9l1F2UP/Iscu:Qity0brSZ9en3Dc
- TLSH T176E28502D7DB01A4F4B1197A99BBCF3B2430FC1869F6C24A5F65EDCE3922A215D1A712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\ctrlx.mfx
- Size 44KB
- SHA256 3407eb12f6bacec5ebd4df96ff3fd34741a3919fd46c2ec527364c5f1e753a65
- MD5 ceb8b2e522d0aaaecdf69b3bcc89a530
- SHA1 c1cf769a96a9612f7fd0c1965413f4a57e4907e1
- SHA512 3c46743c635eb96351e6a82490cececb24e6a104433c962f263ec01cf78fa9747d4f56d05c3085c0a18eff7c180b145df5e8e74bc008fe2f617f7f4c24be0331
- SSDEEP 384:zZ0UzWLt4DGVwVpat0AwYUPr9mM8UUgAVrcQ5k3OEsRUcEIenwQAI4rj7rmUhgYY:90vtD3w4P8h7rKtDtNm
- TLSH T18A13B650738405A2D9BA6D36E8BE6F73D9797CE228F5E20F4A52CC5C60726D1F83071A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\kcfile.mfx
- Size 36KB
- SHA256 daa25c6b2633009f655c0ea0503602ea220f9a5788e3ac7ca11c209be3246333
- MD5 beef4558c23ca51176a3ec1465cff89d
- SHA1 a8dda22b337ee4ff6f572603db69f0f6adb6f227
- SHA512 4ce528b244b4e125e61e67094c8c8041a2450db2aba2f95bd6f4b503116439b9b8dbe462c1199fe42c3687432d4475a77bf0730b5cecf8578856ee5b0e112c2a
- SSDEEP 384:Kognw23YeLui6fdiLDgGDBAOGOkHSlKIsfxWqPZlD0JOJlJAwHQ:KznwReLu98tDBxA9IiW6FpQ
- TLSH T111F2A30A5FF81861F4F66E357E7E22736938B9D59839C20F4210EC1E0973A17DAA5723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\mmf2d3d9.dll
- Size 1.1MB
- SHA256 a38d94169881d68a20c5031895492fa2bae58e70332b2f08fca79e62f4359edd
- MD5 ba4baf4220ede3a3bd32123e9c0fd952
- SHA1 e1186c6746d67e42fc57f72a6ed07e600755305e
- SHA512 55827a02e2617bc94b9990ff348d893eda39fdc6251abe506e0ac1f656ac2cd9bdae8197de437b277c434482e8a1c6782f7ab5b8993d1aa0b779d21b6349dece
- SSDEEP 24576:DozERYuUIT5KoF44tKLlHyDH34pCoR05Zs3:DHlKopiYoSI3
- TLSH T17A35BF10F2928131C4A773310667A3B972BABF2519B595CB1BC83D7A3E345E1973938B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\mmfs2.dll
- Size 460KB
- SHA256 3293a93c6d8a2ce529538fbdd2a81dc623fc40464efdb5348c8e039788ad1b22
- MD5 4758d460ecbb307ed90d59643046f00b
- SHA1 2bd87c39f97b73b9db6d205bb10ae37eb82f2372
- SHA512 970a44102539ed3116c125bfcf9075e3acb8f710a338ff8ba881bbebf5111d236b3c27bf325a77d83d295aba8e836439fb6fd54a899e3ef075e1e45b6e2a1fdb
- SSDEEP 12288:mFuDKw9v7mi3GSW5M2CZ+KCPpzGYBD5ucUo+ThclOh:mFuDKw9v7mpnPBzhBDaT2l
- TLSH T144A4AE10F582C231E9AA12728ABCBF5B297D7A704B7885E797844DBD2D701D21F32763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\modflt.sft
- Size 139KB
- SHA256 e1744d0a36f01213f79a3db6e062f2d5ced5d78e7a4cd5770ec63669ffef2779
- MD5 6e5eb546f1d4c9b14bb7caba03511bb7
- SHA1 fe8ada3a3abe687c8ef8cd2e0216d73827041241
- SHA512 ca6e57d7974247179f3974260d2b401ea78a9af0e80c616d67252392dd8fe3cfaff4a3a93019ab0c501111f985da588365e5d5aee2977ce48596edaa807366bb
- SSDEEP 3072:y+kr2afaRw0+LdjDzgC9vUMwPSjTV//78haGJ68tHQRSj3JhyGuqVt:KRfBLxf0PSjxA/J68twMf5t
- TLSH T1B8D36BC3E3CB90F3DAC92530511BF2771A3E4F8F0562E6569F54FE67B8322629621294
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\mp3flt.sft
- Size 24KB
- SHA256 fcca0e08e8a64081d71f3ad7455cb5bea48e73f158f0773e856fa100914fe192
- MD5 f0ebc8596156d8ebf6201a10f9864305
- SHA1 0efd689d027d2d592369c3585cdd9a0b879e6562
- SHA512 7752fb5d3d114791c7940088b98c03252d6fb151ad11774a8fd8b4fdf2d289c66b5d54a56feddda2e2e4de125f7f6b75c1197eae276add1774e3290becd8bcf7
- SSDEEP 96:24K7bMnfxKgUEDGDaq5E9my5F3MM+YuU0UNESZpMS07oQCcw95bcPw5D9qQ+5lyc:24KMCQiaOC3j9dJlfMSkI5wP69zElt
- TLSH T10AB21B12B3E10CF5E15A5F321D9B023BAE75FB9917B8625B5F91C2391C33A01A81B537
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\oggflt.sft
- Size 130KB
- SHA256 9efb0b4cff5bb033cf1e04bdeabc581db7d787399c5238f4fb40a1e820aac6b8
- MD5 3c63ea4611008fbcf86435559e9dffab
- SHA1 fdc9c6302fcc427530b2dbff63aad1b6d204125a
- SHA512 938c6ebbd0a7248f32bc83d2548791b35764417a74728b8b861d2bd539c182ced6f5168a604679e20c150dc6741fd6868768e7d1ffce224667546d3ea80787d3
- SSDEEP 1536:ww+JHSmG5I1VKFMHU+lfGTFHKYPoPGTUBjnPabuxepe0eDSIiRaEUsXxTTUE7:A5G5iE6qTFHdoPGTUBOKxyfmMR0Ij7
- TLSH T108D39E529687A0FEE8CE1978546F367FCE221A0E7118CE539314EEF65C61E14BE1830B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\pathfind.mfx
- Size 140KB
- SHA256 0d017201a44510ad135a5e69606eee471f863158445aaa122fe29c719dbe0fa8
- MD5 00f718ad2ae750451cb5aa691939a46b
- SHA1 68d2319db0667f58bd5178b1075e7fc7d8319ece
- SHA512 b01548334ba30a2567217b63fdea236431dc16b88bbb31436dbac75a21cd18d32bd1a06b397dc79efa33c12bee30e4ba5edb0b41812a065c25239fd62f2ef5af
- SSDEEP 3072:UFSZJccgpU5O5iXv4T5unctiX8VbOQ1j:UIZqcqU5O5i/u0TQbOQR
- TLSH T15EE3591173F58071D4FFAA76483A9B165B7BB9809F78C9CB63640A1EAA303D16D3134B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\ultimatefullscreen.mfx
- Size 73KB
- SHA256 fd179783ff6e6eb0959185087f33ed4a1b256e58762d9817bcb16888e20f7058
- MD5 96059dbec69c3904e4d7ce734a4b38d0
- SHA1 5169934f8d89b0dba963861dcbae55e78fc21dfc
- SHA512 82977b2c249e47ca37d6fd62f416ed995b4b5f953bc5c18c84bfbdacc2c5b17fdc50c1e736fafcac242a3f8921b5000e0ec84302bc4e0077d6eeee3aa43cc520
- SSDEEP 768:SZfXhNSu1qUKsek7uCZCbMh09RzRLh5xjEnR114TkeWeBg7RIAyEDVyncXBwfSV0:aSZc091RLh5xwnl4TkKBUuAMWHwn+q
- TLSH T1A1738E2072D0C072E0AB1679587666705ABE68129BF440CF6FA9067E7FE07E01E79377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtFE31.tmp\waveflt.sft
- Size 8KB
- SHA256 98134d326a09569bd5933ffcb026009575509a1bfc20384ef8eebb762aabcd38
- MD5 5230a9c12b9829c9fd333cd8b0620011
- SHA1 0becf7512f498c18af3b9943a4b2556a769cc8eb
- SHA512 1a6a5a72fed0458152ca830941b3d07e448bb588fc61a24c97561833b882e23a529a0a78036732cca95013170a46cc5444a4d642bf05a4fa5a474d51d40789d5
- SSDEEP 96:vwor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6b/8cKH+ewp:vf6Dj9t2ubTVdGJgOCGvw
- TLSH T158F10B12A7A500F5F8CD0B7134B7627BE875FA285B25C24FC584DE6C1C311E2D928BAB
- MD5 SHA1 SHA512 SSDEEP TLSH