755d267aa972eaf1d0b16882bc373cdad687fac099c5297c0aca19bb9dd737a8

Analysis

max time kernel
16s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
hqfhskdorsdwkb[1].exe
Size 6.8MB
Sample260721-kr9ftacy3v
SHA256 755d267aa972eaf1d0b16882bc373cdad687fac099c5297c0aca19bb9dd737a8
MD5 c00287395ba138c6c076d0bce19656ca
SHA1 85b34bfe710dffab9c427f506454f5e3f7cbc474
SHA512 59b30e756929e89f8159ad3f2bcbf5570cb69900d7f12a61a7b992557c478e08727195a3d615fab2f9d9d6047fe56b36b9269261433f9c136dd010aca34ccfb8
SSDEEP 196608:dP+Ai3i5tQ5FSr3V7ePoS1Mt78sCc8g8G2WHs/ZDdP:dP+Ni5tQ5FSr3MPoS1MecB8GjHs/xdP
TLSH
T156660166B232F522D16147365E81DD281A20FC25AE275F5F3618FB4D6B333423F6272A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	hqfhskdorsdwkb[1].exe

Disables Task Manager via registry modification
defense_evasion

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3276	attrib.exe
5468	attrib.exe
2624	attrib.exe
3352	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIATray = "C:\\windows\\dIIhost86.exe"	reg.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\windows\xmas.wav	cmd.exe
File opened for modification	C:\Windows\dIIhost86.exe	attrib.exe
File opened for modification	C:\Windows\christmas.exe	attrib.exe
File opened for modification	C:\Windows\death.wav	attrib.exe
File created	C:\Windows\dIIhost86.exe	cmd.exe
File opened for modification	C:\Windows\dIIhost86.exe	cmd.exe
File opened for modification	C:\windows\christmas.exe	cmd.exe
File opened for modification	C:\Windows\xmas.wav	attrib.exe
File created	C:\windows\christmas.exe	cmd.exe
File created	C:\Windows\death.wav	cmd.exe
File opened for modification	C:\Windows\death.wav	cmd.exe
File created	C:\windows\xmas.wav	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3488	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2732	shutdown.exe
Token: SeRemoteShutdownPrivilege	2732	shutdown.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4512	1268	hqfhskdorsdwkb[1].exe	90
PID 4512 wrote to memory of 3276	4512	cmd.exe	92
PID 4512 wrote to memory of 5468	4512	cmd.exe	93
PID 4512 wrote to memory of 2624	4512	cmd.exe	94
PID 4512 wrote to memory of 3352	4512	cmd.exe	95
PID 4512 wrote to memory of 3488	4512	cmd.exe	96
PID 4512 wrote to memory of 2732	4512	cmd.exe	97

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	hqfhskdorsdwkb[1].exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	hqfhskdorsdwkb[1].exe

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2624	attrib.exe
3352	attrib.exe
3276	attrib.exe
5468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\hqfhskdorsdwkb[1].exe
"C:\Users\Admin\AppData\Local\Temp\hqfhskdorsdwkb[1].exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MicrocodeUpdate.bat" "
  2⤵
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\system32\attrib.exe
    attrib +s +h +r C:\Windows\dIIhost86.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3276
- - C:\Windows\system32\attrib.exe
    attrib +s +h +r C:\Windows\christmas.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:5468
- - C:\Windows\system32\attrib.exe
    attrib +s +h +r C:\Windows\death.wav
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2624
- - C:\Windows\system32\attrib.exe
    attrib +s +h +r C:\Windows\xmas.wav
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3352
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v NVIDIATray /d C:\windows\dIIhost86.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3488
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 00
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2732

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d
1⤵
PID:5500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrocodeUpdate.bat

Path C:\Users\Admin\AppData\Local\Temp\MicrocodeUpdate.bat
Size 470B
SHA256 45ed0b0b523c2fc5c4fa6e8b138bcbfbc31b6a3ccdfe63f47d19a46abf0c0386
MD5 d51bb57da08f2948406bffaed1091c3e
SHA1 94f756d84de53b008e76073e8bdc048f21f2c38c
SHA512 5093389828c9caf0eb18957f6e90c1bb5e4e3e3ad3f3c1cf37e53e37805dfe212d59783dc5fe495ab7ace7f437ca7653fbadbe9c610ed983e263e1efbc8a777f
TLSH
T1E4F0E5695EF085A1C3B0AD76832F2B57F62BF0CE65580C90A3420092EE128034B6A1FE
MD5 SHA1 SHA512 TLSH

Submit Download

christmas.exe

Path C:\Users\Admin\AppData\Local\Temp\christmas.exe
Size 482KB
SHA256 cb7c01aa6b8d1f7fa7131d6444a220cedf0c51102c127a13a4313e4249b1f88e
MD5 c35aa97962c4132ef87768d6e7e4faea
SHA1 bb696ec7709f94067bc0cea5d53432f7f60667e3
SHA512 21d838c035b958f1e92aef0c6591d9631215f088bd96653a9d15b4293fdaab2d1b404c0f0e38f14eba3d69099dc07fc5191caa89f49aba956674e7f9b461450c
SSDEEP 6144:s68WiSoFDCIIH9rTmoSoaTxxsVW9rmdA1h3UeJsFtusIP3q7bNB+Xrge138ahLWk:CWiSoF2dN0KcPJsJ0ObNB+rKaVW+Is9
TLSH
T1C0B48E32B2E09437D163263C9D5B936C9C2AFE117D2878862BE82D4C5F3D781752B297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dIIhost86.exe

Path C:\Users\Admin\AppData\Local\Temp\dIIhost86.exe
Size 208KB
SHA256 7891c47c3f75d6608331f6b92ef36017612b78f6ddc2e2611dde3846639b52a1
MD5 19f780c9bd472b21ae1723eff91180e0
SHA1 0afba8be8b755c61377f77d6bd2fe67efcfafcdb
SHA512 0e4bd99411a100e6a374e0f9abe4693558137b4b330d347daaba413c517ac3210c52be76e5dae0e8cf38d3ff81c8b06cfa5e8f871243806a0ee41bb8b96b2f67
SSDEEP 3072:jh51k6IKr1v/Dzr+UzFBMDG1kTRRov+rp2k+2Z8+P1uVhY/3Ag0FubAIMw/B4P:jh53/ZrzJmjRfpRdRfAOFMYqP
TLSH
T1B2249E1074D1C8B2C572193909F4AB766A7DBD610B255AFF97E80B3D0F742D12A32AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

death.wav

Path C:\Users\Admin\AppData\Local\Temp\death.wav
Size 198KB
SHA256 bad1d94d90760af12d593b9affa8a35c161ce4d92482844a3d9c53329ec007cc
MD5 6de1ef0c2e0bd9e41788c01bc37cacb5
SHA1 ee45df052ac2abbca6e46fbabca8f22d7f715997
SHA512 02cbf15db0af2c65d8e8ae39d5ce47dfc8b847bded95505836e1b9b10eaf73c763699b5082f876756a133743701fd1c4bc387018d50c19295e03f386fe92b03b
SSDEEP 3072:QsN4WEJKaxZbtY9ZKpc/XwX4kIJZGQywFLnrqDg6qGt44Esny2:QsN0ZaOpn4kI6Nir+DrqGt449J
TLSH
T1A014E0233A20C412C8295A73DEBAD5FC2257BE42EF56532B30D1BF4F39761499F62285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmas.wav

Path C:\Users\Admin\AppData\Local\Temp\xmas.wav
Size 5.1MB
SHA256 20ab294332c3da45d5c5d87650dab37c4506b56bfa14315fc114f2afc62ffdc9
MD5 e0b58bcd3314b76de7529ca46ceed77f
SHA1 daec19f127453080c980dbc383a8667a2ef04115
SHA512 8daf9422e523b29fdee15e854e0e5e982fa7bb94bf64c51fd7680a85f8dcc18c04c9f48759f81b2cd3360abc82daca7aa4da4df3174b67784b8c0a5b24e85a3a
SSDEEP 98304:S0aPPLm5tQ5FSr3Eg7ePoS1+hoO7KLsTest8MfykAc8Gav5wHs/TxYWeCQ:Q3i5tQ5FSr3V7ePoS1Mt78sCc8g8G2W/
TLSH
T13236F1A6A023BA44D2A9823392C1DD180780FC5FA9670E7F6919FB50B1733057BB576F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-7-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-14-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-8-0x000000001CFD0000-0x000000001D01C000-memory.dmp

Download

memory/1268-9-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-6-0x0000000003680000-0x0000000003688000-memory.dmp

Download

memory/1268-10-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-11-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-12-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-13-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-0-0x00007FF82631A000-0x00007FF82631B000-memory.dmp

Download

memory/1268-15-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-16-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-17-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-5-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-4-0x000000001CE70000-0x000000001CF0C000-memory.dmp

Download

memory/1268-3-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-2-0x000000001C880000-0x000000001CD4E000-memory.dmp

Download

memory/1268-1-0x000000001C300000-0x000000001C3A6000-memory.dmp

Download

memory/1268-33-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

memory/1268-34-0x00007FF826020000-0x00007FF826A58000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads