13f31346780baa4df60d44d10616fc4c8bd0a1467a2829a25bdeae08d5412e38

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinHex.exe
Size 2.3MB
Sample260728-w4emrasend
SHA256 13f31346780baa4df60d44d10616fc4c8bd0a1467a2829a25bdeae08d5412e38
MD5 3227b49b459a83fadb3997433fae43e8
SHA1 4bfe52fa5223f9e8fa5e5358889e5b0c3f29cd05
SHA512 0fe089bd896d00181d81a27ae5da850da954b528716afe6cd02985d4d662d716ce891bd85bf42cce1bd5b838d7d3ae6d2490d2c898bdb41e84dd98b3432c4aa3
SSDEEP 49152:ih8Fy2w0kFwp2dP2n+uzqC56TnOSfZ9/oOrIHdk+1xCaWznuRiphu+Lo8c2Q:y/Sp2d+n+uzqC56bB/rI9kwPcnu4pBm
TLSH
T13DB533B9A7A2703BC0A1397386AE45DE35EC1D9707072CDF56B903B18E377439A74868
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
760	WinHex64.exe

Loads dropped DLL 2 IoCs

pid	Process
760	WinHex64.exe
760	WinHex64.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	WinHex64.exe
File opened (read-only)	\??\N:	WinHex64.exe
File opened (read-only)	\??\W:	WinHex64.exe
File opened (read-only)	\??\U:	WinHex64.exe
File opened (read-only)	\??\H:	WinHex64.exe
File opened (read-only)	\??\D:	WinHex64.exe
File opened (read-only)	\??\O:	WinHex64.exe
File opened (read-only)	\??\Z:	WinHex64.exe
File opened (read-only)	\??\Y:	WinHex64.exe
File opened (read-only)	\??\V:	WinHex64.exe
File opened (read-only)	\??\T:	WinHex64.exe
File opened (read-only)	\??\S:	WinHex64.exe
File opened (read-only)	\??\R:	WinHex64.exe
File opened (read-only)	\??\K:	WinHex64.exe
File opened (read-only)	\??\X:	WinHex64.exe
File opened (read-only)	\??\Q:	WinHex64.exe
File opened (read-only)	\??\P:	WinHex64.exe
File opened (read-only)	\??\M:	WinHex64.exe
File opened (read-only)	\??\L:	WinHex64.exe
File opened (read-only)	\??\J:	WinHex64.exe
File opened (read-only)	\??\I:	WinHex64.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4628-79-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
760	WinHex64.exe
760	WinHex64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2760	4628	WinHex.exe	89
PID 2760 wrote to memory of 760	2760	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\WinHex.exe
"C:\Users\Admin\AppData\Local\Temp\WinHex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\wh.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\WinHex64.exe
    WinHex64.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chinese.txt

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\Chinese.txt
Size 45KB
SHA256 3543c72fc2896327797a380aa4980485afc3ec86966bdd8b107e0458d361151b
MD5 2cf96d6342e0678db57ea56405e41d94
SHA1 874051ef87339eb9a23ed054d019ad888fedc575
SHA512 f8443eff1ecb793af4ed888323ef64e18a475bcccb92df2e3d1456fd86835e7ed69e2ea5b46707808014eb479990b3c536ccaaae62ea9bf214c3fb2cbe5b69f9
SSDEEP 768:mUJ7hHVO0i1ORAl9wnVRAjSEUs04YOtNppmyucP5tauOk2bRH:p7+ORm9wnnAK54ptNf55P5tau6RH
TLSH
T1CC234B29875BABC4D3A747B19A6303363EBA777DE0B2CB242F016C094711D5DE0A5F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHex.cfg

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\WinHex.cfg
Size 16KB
SHA256 f5fad1dcd1f2dde8449e164a2d40ac6db1cb73a132fe66780a0676fab85cf9ff
MD5 37847e9a7ad73971f0e2aecd27bd299a
SHA1 2f53fb1ab4da39e54b74903333ce06c1bfce3889
SHA512 cadf0228200906ecdd274d4937cfe4cc6d2acad400b504b4de465d46344ba4c0dafe1a9a86bae3864536b0825064aab1b281428fc33012db7fd46cf575460d9b
SSDEEP 48:Qk94exW+Z6h3o3pzKzlxDfLxG/TdsE9vnYTExCbdyaKTJzeVrP0qfwP4JRiVxgEN:Qk94eqhsejfuxuQ6rlwPkiD5UqCQ
TLSH
T14C7221C3AFC50187D6B26EB4147207984729FDE0C612E79F1941B195ECF6AC00DD9B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHex64.exe

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\WinHex64.exe
Size 2.9MB
SHA256 3b162bb7eb31f600cfb4351a667c3d5f7ca2ffb13cf833a0d877c51523e89b42
MD5 9cc8fdb9592c9d6965228d5690a0d544
SHA1 9ee0f8483096a305aff46f54cff03f969a45fba2
SHA512 f870d3d2981a03585d121d531a9a9a97d6a47b3c09028eba84f360cc7965c56e2458eba7e25e06587d5dace64ce1b1ff09d42987593a752ddffb2358552a78d9
SSDEEP 49152:T/GTFliUdULqa/rXLNTzGV9zcfweqdFKX6/ABvh:CplSXEQEKB
TLSH
T100E55A7A5FFC8168C566C2BCC95793619AA1B4113B39A2FF55400184EF30BE0AB3EB75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

language.dat

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\language.dat
Size 376KB
SHA256 a9009d7e961f3c0c75e3fd4ddf5639b810127a43469dfb388cb77d354b83716a
MD5 b19420603d6d26756346a0ae987b7c62
SHA1 ded9a19e5efbfae40b929f2eb302638b46ec5c93
SHA512 aadf90d6e3f39f79fe302702dac05afc1bfd438383e774416ecf908f2c2c6d07f9dd38cf531537f44f60ba36230520524dc884fce08f6410e688318706ed7dd9
SSDEEP 6144:BfSXLoPIEHV1Aoyf0iGkB98SXuz3ldLH7ezQdw+JO7VU9/7Izx2MN/pXNPOt0zCG:s8PIiAokmlwYn/aLua+5SF
TLSH
T10F847D269EC40151CB8703B57302D247BBBDC1CDEB49E356445DC14D3287AAAA3FEAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timezone.dat

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\timezone.dat
Size 4KB
SHA256 a5ac049ef055907977fd743b73bf58a5892867396060c8e609df85ce8e7a581a
MD5 4df1385a33aae1fa195e932fdcac3b68
SHA1 3744a4e631297a6dcdcf028232af6c724280b447
SHA512 5b9834482e8423a0992e73a010934b5a781a08d156e3fa7315a5b599ad8731d3ed670ca040ec3420758f4d4d9aec41df0e89a2e1726c0223ba3c057ac4f1ff78
SSDEEP 48:5xKYPZE1wFR3eRsk/AkNJvXHOMOg3o9Z0OfHR1o62kc:5xKYP+wFRuvJvXuMuaOffSkc
TLSH
T1ACA1B7C170275FFAE46B47F60A04B2B1F77096E9DAA0A59F0C2E0E7C150B3A58F2C151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.txt

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\user.txt
Size 197B
SHA256 33b0dfe931a58097a5a8f1554d24024d83c8d1156c6249fe5090d5c4caeb37cb
MD5 e5ecd0ca8ccb27fa96c82bf33adc9510
SHA1 d6544045be44a3bd7e394ef2a6889d3038e7cbc1
SHA512 30faeac611ce292ff487327de71c84ebb07d98f684189715fa456326cd7e077305bb60983bb58e634bdc7ea8c9c1a11c017959bed7be4b23490190badfe06b7b
TLSH
T1F0D02298CC00AD4202AC440DA2C98D99B23DC02F4C8A24EC34202C0084C360242CC401
MD5 SHA1 SHA512 TLSH

Submit Download

wh.cmd

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\wh.cmd
Size 97B
SHA256 3ed1eb0228396f7abe8c3903e8de22bf2fe32480121fd2815ad862be49e14682
MD5 8a49407e9fab9dd135dbfb7aed404686
SHA1 671393337720da7c07546635ad80d1dcc3c82aa1
SHA512 1139b93d7cbbae38b1b01a4b26ef3b6b9940ee97af5dcb2228f48871d22674c5f466074e20babdafcc73772bdb499e9cd35cf04a9732a7d4cd4195481068f542
TLSH
T12AB01202C003174C114B0A920300304585DBD3C3A815276067862BF4D4C35710345AE2
MD5 SHA1 SHA512 TLSH

Submit Download

hash2.dll

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\x64\hash2.dll
Size 194KB
SHA256 2c31e7aacba30ad7113e2a66fe0966e4bf66026bd39e782fbe5e66dcf3dd7e3a
MD5 c4f650621c159aede7bbe9569d03ac16
SHA1 b3858ede91d874d7eb240b3ecfd8be458cd15317
SHA512 29790a1a3edfeb50dcb82cb21442c15c0606446ad912673a65ce7851bd9b9987cba735e54f81d46a1a873368f2f83b2703f4b105b32ff8f7bfe7b35dcc8b1325
SSDEEP 6144:b1TDYtW9I/C0EdpaPL11Sub3lbhg9UkPdpaPL11Sub3lbhg9UkUdpaPL11Sub3lv:bSZ/C0Edpaj11SY3lbC9UkPdpaj11SYs
TLSH
T10514079CEF8207B1DA2A48F7D2D54AC179B19811D39CF6FF106674B41E132FA542A33A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_SFX_SX_5223PNO\x64\zlib1.dll
Size 132KB
SHA256 b20bdc4701eabe9cb4d488ca0ef781737c509f77313614bf09e2edb3aa1902d8
MD5 ae4f3d3bd919e89817e905839a3fdea4
SHA1 2f4d59d7d92e514180df4120a7ecf3e0a312d8eb
SHA512 04c9331e06f3a4bd089513d5f27abaa3bbbd81f725e66eb9f9fce0a91d512ae3cf398554fb4e7ce1c6812b3dff510ffde4ab701fe07f639e58ee143f00b4fea3
SSDEEP 3072:nY/9XIYqXKayH+Y/YJTxeFcwqays1nPrTBfnBIqY:nY/9Xm1yH+OYTxgcwqatnPrTB2q
TLSH
T133D38C5A32A042B6D4F692B4D8F35A19D3B5341207B093CF969883A52F137D25F3A3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-80-0x0000000000400000-0x0000000000714000-memory.dmp

Download

memory/4628-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4628-79-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads