93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paket_Dokumen.exe
Size 118KB
Sample260730-h2an5adf27
SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
MD5 1605971fa40b7f784311cecea47a251e
SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
TLSH
T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence upx

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2776-70-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-79-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-78-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-77-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-76-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-75-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-74-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-73-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp	upx
behavioral2/memory/2776-57-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/2776-56-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/2776-53-0x0000000180000000-0x0000000180033000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\nvdaHelperRemote.dll	Paket_Dokumen.exe
File created	C:\Program Files\Windows Media Player\Mixed Reality.exe	Paket_Dokumen.exe
File opened for modification	C:\Program Files\Windows Media Player\nvdaHelperRemote.dll	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\background.jpg	Paket_Dokumen.exe
File opened for modification	\??\c:\windows\background.jpg	Paket_Dokumen.exe

Executes dropped EXE 1 IoCs

pid	Process
5256	Mixed Reality.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3804	sc.exe
2560	sc.exe
4520	sc.exe
4876	sc.exe

Loads dropped DLL 1 IoCs

pid	Process
5256	Mixed Reality.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1308	cmd.exe
6436	cmd.exe
6224	cmd.exe
6420	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Reach	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Reach\FirstRun = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5256	Mixed Reality.exe
5256	Mixed Reality.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1308	1156	Paket_Dokumen.exe	90
PID 1308 wrote to memory of 2560	1308	cmd.exe	92
PID 1156 wrote to memory of 6436	1156	Paket_Dokumen.exe	93
PID 6436 wrote to memory of 4520	6436	cmd.exe	95
PID 1156 wrote to memory of 6224	1156	Paket_Dokumen.exe	96
PID 6224 wrote to memory of 4876	6224	cmd.exe	98
PID 1156 wrote to memory of 6420	1156	Paket_Dokumen.exe	99
PID 6420 wrote to memory of 3804	6420	cmd.exe	101
PID 5256 wrote to memory of 960	5256	Mixed Reality.exe	8
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2776	960	svchost.exe	103
PID 960 wrote to memory of 2784	960	svchost.exe	104
PID 960 wrote to memory of 2784	960	svchost.exe	104
PID 960 wrote to memory of 2784	960	svchost.exe	104
PID 960 wrote to memory of 4400	960	svchost.exe	109
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4836	960	svchost.exe	110
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 4336	960	svchost.exe	111
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112
PID 960 wrote to memory of 2612	960	svchost.exe	112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:960
- \??\c:\windows\system32\svchost.exe
  "c:\windows\system32\svchost.exe"
  2⤵
  PID:2776
- \??\c:\windows\system32\svchost.exe
  "c:\windows\system32\svchost.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:4400
- \??\c:\windows\system32\svchost.exe
  "c:\windows\system32\svchost.exe"
  2⤵
  PID:4836
- \??\c:\windows\system32\svchost.exe
  "c:\windows\system32\svchost.exe"
  2⤵
  PID:4336
- \??\c:\windows\system32\svchost.exe
  "c:\windows\system32\svchost.exe"
  2⤵
  PID:2612

C:\Users\Admin\AppData\Local\Temp\Paket_Dokumen.exe
"C:\Users\Admin\AppData\Local\Temp\Paket_Dokumen.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1156
- \??\c:\windows\system32\cmd.exe
  cmd /c sc delete mixedsvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\sc.exe
    sc delete mixedsvc
    3⤵
    - Launches sc.exe
    PID:2560
- \??\c:\windows\system32\cmd.exe
  cmd /c sc create MixedSvc binPath= "C:\Program Files\Windows Media Player\Mixed Reality.exe" start= auto displayname= "Windows Mixed Reality Service"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6436
- - C:\Windows\system32\sc.exe
    sc create MixedSvc binPath= "C:\Program Files\Windows Media Player\Mixed Reality.exe" start= auto displayname= "Windows Mixed Reality Service"
    3⤵
    - Launches sc.exe
    PID:4520
- \??\c:\windows\system32\cmd.exe
  cmd /c sc description MixedSvc "Manager the Mixed Reality functionality"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6224
- - C:\Windows\system32\sc.exe
    sc description MixedSvc "Manager the Mixed Reality functionality"
    3⤵
    - Launches sc.exe
    PID:4876
- \??\c:\windows\system32\cmd.exe
  cmd /c sc start MixedSvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6420
- - C:\Windows\system32\sc.exe
    sc start MixedSvc
    3⤵
    - Launches sc.exe
    PID:3804

C:\Program Files\Windows Media Player\Mixed Reality.exe
"C:\Program Files\Windows Media Player\Mixed Reality.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Mixed Reality.exe

Path C:\Program Files\Windows Media Player\Mixed Reality.exe
Size 118KB
SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
MD5 1605971fa40b7f784311cecea47a251e
SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
TLSH
T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvdaHelperRemote.dll

Path C:\Program Files\Windows Media Player\nvdaHelperRemote.dll
Size 492KB
SHA256 f7c6ad17144420c57cb0ccf1a0a93067140f91c88ba2f4b2a51ee65005799bcf
MD5 d23e7874974577346eeb5b62840d2f12
SHA1 ec0a06d7bbee958c5acb229d1c97bcb7ce1b9b2d
SHA512 f17312c562758bf201cdfd75e1316dce7d1126fb878b1b9db8a14162a630da8bbb5df4b433f22f19c843d6e4cd137c1e05efc6c1b7789b01b514af98e4dd43b2
SSDEEP 6144:kNEguF81ESxK99+zkzh6RVHcBE5q+LHRTtJIHfxIhuGGULLl3SSJgj:2En9Nh6RVHcBE5qOJIHfxIsGZXVY
TLSH
T1A9B49D06B3E848A9E06AC478CA438647DA7578860B75F6DF0390D2392F77BE45B3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sxhang20[1].jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JZCAHKE4\sxhang20[1].jpg
Size 2.8MB
SHA256 fa5075119ad69a37baf9dd65628d19e65c7176f0678114fb63499d6119e1972d
MD5 346efb71dfc76532289928c09f60129b
SHA1 fb83a4b1bbcd3213e4092c5b231666a5ec04e620
SHA512 3461369020663ba05f664d0b885292f80a08c29a26922f9bab9cb572f1a400b75016589b866c92f477e4c1c34eac3700c8d0785924cf59f7d394f86c54ab942f
SSDEEP 49152:LAYIOVTrIvaL8o/+gsmvnQTkKoMSqUPi5x9nG6cxHqv3Y7avPXlxJ5IbY:LAYIOVTcval+g94oLqUK5TnG6cAvxvvp
TLSH
T141D5124677D0989DE4EBD1388A438A03E77538D61725F1DF1281A62A3F7B7E05A3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.txt

Path C:\debug.txt
Size 11B
SHA256 e1c55f5fa34caa28f89da8401b1029ac4b28869c288df1230a62426dcfb01426
MD5 baa983eed4bc9ca0e095f922c3b69905
SHA1 4f2c4aeeafac554529a8e4945e2643336899d5d3
SHA512 715e1fdcf6587b3db2af11ab9cefe716c8bd99bf764c597fd1ac6f96e1e9589c752a5506cc93c46d474338899cdf3aa03d24e4ff8cada2ee2391cfb4da8e73a7
MD5 SHA1 SHA512

Submit Download

background.jpg

Path \??\c:\windows\background.jpg
Size 2.8MB
SHA256 6f52cb291c9db67f3fc70b7657c60b4cdf21dc2f78ca69a0b7ca0cbfa306f9b8
MD5 8f44f49c29309d58e05a325d3f87f540
SHA1 1cbd307b3d5e7ec60d0d100b3926f390550100ee
SHA512 2fed58039872e9e9e21b27953900bfc228c1e075a8a397363ed175c7c37f9f3b00970ebb1a27979b08ee53896923068230e98bd2d53a8c79139657e4799e8d26
SSDEEP 49152:LAYIOVTrIvaL8o/+gsmvnQTkKoMSqUPi5x9nG6cxHqv3Y7avPX:LAYIOVTcval+g94oLqUK5TnG6cAvxvv
TLSH
T183D523CA7741E44EEDCBA63E40970F02B3394BF9721A3065F0477E177E6E29099194A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-34-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-37-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-35-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-40-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-33-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-32-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-36-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-30-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-26-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-27-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-28-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-31-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/960-25-0x000002DC5A8B0000-0x000002DC5A8DA000-memory.dmp

Download

memory/960-29-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/1156-8-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-1-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-88-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-0-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-2-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-6-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-7-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/1156-3-0x0000015652290000-0x00000156522B4000-memory.dmp

Download

memory/2776-79-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-73-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-99-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-100-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-93-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-41-0x0000022FF4260000-0x0000022FF4375000-memory.dmp

Download

memory/2776-58-0x0000022FF48D0000-0x0000022FF48EF000-memory.dmp

Download

memory/2776-51-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-70-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-90-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-78-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-77-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-76-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-75-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-74-0x0000022FF49B0000-0x0000022FF49D2000-memory.dmp

Download

memory/2776-53-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/2776-69-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-68-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-50-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-48-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-47-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-46-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-45-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-64-0x0000022FF48F0000-0x0000022FF49A6000-memory.dmp

Download

memory/2776-44-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-43-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-57-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/2776-56-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/2776-42-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-49-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2776-52-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/2784-80-0x0000025E0CA60000-0x0000025E0CB52000-memory.dmp

Download

memory/2784-94-0x0000025E0CAC0000-0x0000025E0CB16000-memory.dmp

Download

memory/2784-83-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/2784-81-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/2784-85-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/2784-87-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/2784-82-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/2784-86-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/2784-84-0x0000000140000000-0x00000001400F5000-memory.dmp

Download

memory/4836-117-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/5256-39-0x0000025577620000-0x0000025577645000-memory.dmp

Download

memory/5256-21-0x0000025577620000-0x0000025577645000-memory.dmp

Download

memory/5256-23-0x00000255775E0000-0x00000255775F5000-memory.dmp

Download

memory/5256-22-0x0000025577620000-0x0000025577645000-memory.dmp

Download

memory/5256-20-0x0000025577620000-0x0000025577645000-memory.dmp

Download

memory/5256-19-0x0000025577620000-0x0000025577645000-memory.dmp

Download

memory/5256-24-0x0000025577620000-0x0000025577645000-memory.dmp

Download