Overview

overview

7

Static

static

3

Firmware U...PS.exe

windows10-2004-x64

Firmware U...PS.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    32s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 00:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Firmware Update - HD-HD1PA-V2.3.2-GPS.exe
  • Size 2.8MB
  • Sample260731-am5a7azerc
  • SHA256 f2f482abf5e73417a3ee50401a4886a2b9bdb628fdcfc4a3a414ec91f08866ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 26 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Firmware Update - HD-HD1PA-V2.3.2-GPS.exe
    "C:\Users\Admin\AppData\Local\Temp\Firmware Update - HD-HD1PA-V2.3.2-GPS.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2380
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa399d055 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Firmware Update - HD-HD1PA-V2.3.2-GPS.exe
        • Path C:\Program Files (x86)\HD-HD1PA-V2.3.2-GPS\Firmware Update - HD-HD1PA-V2.3.2-GPS.exe
        • Size 628KB
        • SHA256 6e4ebdc3b7453a3287cc5566964b59ecd52a3987ffb633407776c56e684b841b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aaiw240646801.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\aaiw240646801.bmp
        • Size 326B
        • SHA256 ea7860c41776b228b3c6e8286a237933c15a015451cdc78de891c1ca86ff080f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aiw240646796.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\aiw240646796.bmp
        • Size 113KB
        • SHA256 16968789dc9f45321180fceb397c3d1849804707e93cc39299d797e2fe3f7891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aiw240646812.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\aiw240646812.EXE
        • Size 47KB
        • SHA256 6b4a95a4468d79c1d09a0a4eca5a504d406c4bbe532d8475f68aa6ddcf91572b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Command.ocx
        • Path C:\Windows\SysWOW64\Command.ocx
        • Size 144KB
        • SHA256 4d1651b8e64e241d16d4e9837221f7d8aa54a295b2b2dedc0585aa86b9f4de04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSDBRPTR.DLL
        • Path C:\Windows\SysWOW64\MSDBRPTR.DLL
        • Size 315KB
        • SHA256 2d7d1659ea576e38d24adb7e0419b258d1f0c162f3f4c699199870dba2fa33b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSRDO20.DLL
        • Path C:\Windows\SysWOW64\MSRDO20.DLL
        • Size 388KB
        • SHA256 ec78c70c84b13655eaaece238c281f899420a505d2d10aff4e2659549c12334d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSSTDFMT.DLL
        • Path C:\Windows\SysWOW64\MSSTDFMT.DLL
        • Size 117KB
        • SHA256 3d5c3074fc645da3b68c859a709a5fbefb7df43f458af01ffda55bfc1456e7fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        comdlg32.ocx
        • Path C:\Windows\SysWOW64\comdlg32.ocx
        • Size 159KB
        • SHA256 2206e0f530032cb55e1fa00fdfb0c2d71d5b09b1f969089fb8f651fcd2489e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mscomctl.ocx
        • Path C:\Windows\SysWOW64\mscomctl.ocx
        • Size 1.0MB
        • SHA256 152121a5d1ac8f12002c18afc294bb1ebcecc1d61deec6211df586c11acde9b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mscomm32.ocx
        • Path C:\Windows\SysWOW64\mscomm32.ocx
        • Size 117KB
        • SHA256 8f359dfdf68a00f99925b873f8095b78ed500929483f582c63722058ce31bed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download