cfa933ae32ab88943a5214c1cb0f5efaf6a47155d8a18fe94ee5212451c99f69

Resubmissions

30/07/2026, 02:05

260730-chwvcsbl9y8

30/07/2026, 01:59

260730-cejqmabl5x8

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V7Hz91X8U2.exe
Size 21.1MB
Sample260730-chwvcsbl9y
SHA256 cfa933ae32ab88943a5214c1cb0f5efaf6a47155d8a18fe94ee5212451c99f69
MD5 4ccb6ccc6ba399b115970882becb8b47
SHA1 0260186c9d6a1547cc130b88683da2b86c2c5b7b
SHA512 910537d397d468ce73d583cd1cf1a6e7b9e85a1a2624c5af84b4ae279aaf20c11d0751df1ce19be4772921f25af5ff2ffed84b0360b8fdb17b36ba438dbe8e1f
SSDEEP 393216:K0J0F7X56h0FMnVVPrdQllv7Y/XvcL9EtWryn0:07X56aIIlc49/rG0
TLSH
T10A276C002FB8473AD29E6772B8A122B057B1E857A312D74E24D4E9A53D537B5CE012FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	5648	V7Hz91X8U2.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\GkyOwRWQpafDP\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\GkyOwRWQpafDP"	85ab3de2.exe

Executes dropped EXE 2 IoCs

pid	Process
4560	7ftyFv8tI.exe
2660	85ab3de2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe
3160	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\shell\open\command	7ftyFv8tI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\shell	7ftyFv8tI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\shell\open	7ftyFv8tI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\shell\open\command\ = "powershell.exe -WindowStyle Hidden -Command \"$exe = Get-ChildItem -Path 'C:\\Users\\Admin\\AppData\\Local\\Eclipsed\\Unlocker' -Filter '.exe' \| Where-Object { $_.Name -notlike 'updater*' } \| Select-Object -First 1 -ExpandProperty FullName; if ($exe) { Start-Process -FilePath $exe -ArgumentList '%1' }\""	7ftyFv8tI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker	7ftyFv8tI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Eclipsed\\Unlocker\\7ftyFv8tI.exe,1"	7ftyFv8tI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\ = "URL:Eclipsed Unlocker"	7ftyFv8tI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\URL Protocol	7ftyFv8tI.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\eclipsedunlocker\DefaultIcon	7ftyFv8tI.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe
4560	7ftyFv8tI.exe
4560	7ftyFv8tI.exe
4560	7ftyFv8tI.exe
3160	powershell.exe
3160	powershell.exe
3160	powershell.exe
2660	85ab3de2.exe
2660	85ab3de2.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2660	85ab3de2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5648	V7Hz91X8U2.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	4560	7ftyFv8tI.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	2660	85ab3de2.exe
Token: SeLoadDriverPrivilege	2660	85ab3de2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 3592	5648	V7Hz91X8U2.exe	90
PID 5648 wrote to memory of 4560	5648	V7Hz91X8U2.exe	92
PID 4560 wrote to memory of 3160	4560	7ftyFv8tI.exe	94
PID 4560 wrote to memory of 2660	4560	7ftyFv8tI.exe	97

C:\Users\Admin\AppData\Local\Temp\V7Hz91X8U2.exe
"C:\Users\Admin\AppData\Local\Temp\V7Hz91X8U2.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Desktop\UnlockerCore.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\7ftyFv8tI.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker'; $Shortcut.Description = 'Eclipsed Unlocker'; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\7ftyFv8tI.exe
  "C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\7ftyFv8tI.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command " $WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Desktop\UnlockerCore.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\7ftyFv8tI.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker'; $Shortcut.Description = 'Eclipsed Unlocker'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\85ab3de2.exe
    "C:\Users\Admin\AppData\Local\Temp\85ab3de2.exe" "C:\Users\Admin\AppData\Local\Temp\7fca477c.sys"
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.mutex_id

Path C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\.mutex_id
Size 43B
SHA256 4277b00e5e186cb3896e020811724114b254753ce5282a1ef4d8fbcbdf030d17
MD5 d90ecae1985b7fd4ab2f81220c46dc1a
SHA1 2a6f54d9ec6d6defb00ac776383c464f65d6c1b2
SHA512 3f7d6765a48cfd52eb694f4ab782b9eb1581730dc2fb66fa072dfd83cb02101c77a4a25bd97d75fba3cd78fbbbc3d3ff6c2b942c24bf183cd60dd230b58de1b8
MD5 SHA1 SHA512

Submit Download

7ftyFv8tI.exe

Path C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\7ftyFv8tI.exe
Size 21.1MB
SHA256 cfa933ae32ab88943a5214c1cb0f5efaf6a47155d8a18fe94ee5212451c99f69
MD5 4ccb6ccc6ba399b115970882becb8b47
SHA1 0260186c9d6a1547cc130b88683da2b86c2c5b7b
SHA512 910537d397d468ce73d583cd1cf1a6e7b9e85a1a2624c5af84b4ae279aaf20c11d0751df1ce19be4772921f25af5ff2ffed84b0360b8fdb17b36ba438dbe8e1f
SSDEEP 393216:K0J0F7X56h0FMnVVPrdQllv7Y/XvcL9EtWryn0:07X56aIIlc49/rG0
TLSH
T10A276C002FB8473AD29E6772B8A122B057B1E857A312D74E24D4E9A53D537B5CE012FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e0083a663addca4a841a2367a7276a0a9b44d372097cee7d523f8c039a1f1e33
MD5 2729c607e8bc12cfb92ed86c28645e12
SHA1 2f115dc1330d9c85cc6ab81e77c412ebf4f89b73
SHA512 00977e76d4769f7753f74d29413e37338fdb0880d32fd0eb436fe5f819fa4c89e11070da9914c6748064baff02f250a94695374479f2e936f02878b5249cf007
TLSH
T17F112733B3CC8724DC9A413650CEAC1136B687DB409EDE6BBB84D549B42F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

85ab3de2.exe

Path C:\Users\Admin\AppData\Local\Temp\85ab3de2.exe
Size 147KB
SHA256 de9131947d40217279723514ccc6379d7acfc354bc2cca3ca6a0abe1153b3e11
MD5 779c178ad0eb7e8b119face166fa3564
SHA1 c41124eeebf8fb6c665b73da2ed631a5b6500a59
SHA512 2734d85828e3de10885ca956f62989af55fc4f97b6fad885325562d3bc3376ce644428f2615d6253a47165c754e84e300ef02a4750c74c3b4a9bf4204230b396
SSDEEP 3072:Ilvmx001c78K8pejkw/mJTQSaMm5/6/dY:IYy027t6PWlMu
TLSH
T16AE32B5797A5106DF2B7D6B8C9B20911EB717C950B74D2CF235048BA0F62BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockerCore.lnk

Path C:\Users\Admin\Desktop\UnlockerCore.lnk
Size 1KB
SHA256 24eff6e99e7a8be5596ab9f7ac4d2dd02de3ce40b3bee6f1b8fa344b83d1ce8c
MD5 c3dfa14a1cdd1a6148217a46ab305f3d
SHA1 8e651b6966ecdac3fccb4ce32ddefa8d983be6a2
SHA512 dba13e4d6b7c190310c52522c72a0f77105c757d84e5fe397ce8b59d6896e1b4fa0a3c647b7b6fe48e7e93c48fce16b91fa5b2aee1189056e9e1b13498f0f90f
TLSH
T1DF2103017AE26B11C1ADCAB87EFB7625E9B4B4204B4A5F2D00C7C10A1D56E52ED48B1E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3592-15-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-19-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-12-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-13-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-14-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-3-0x00007FFC42D8F000-0x00007FFC42D90000-memory.dmp

Download

memory/3592-16-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-17-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-18-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-11-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-20-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-21-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-10-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-9-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-26-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-8-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-6-0x00007FFC42C00000-0x00007FFC435A4000-memory.dmp

Download

memory/3592-7-0x0000025DB5A50000-0x0000025DB5A72000-memory.dmp

Download