Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 22:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe
- Size 8.7MB
- Sample260804-2tl7qszwdy
- SHA256 5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc
- MD5 6e4a6f708b321651ee23e92f5c958c33
- SHA1 c4aaa1d19524ca3f2c1993367f8ad772b4681e05
- SHA512 241353640de2e9856bbcc42a407332537e86c50fa98207f7c46308d3ec6863683e55aae4f1b92ba858b9aab3ef8ca3e9e9708d702f43065a50a984d0810373f3
- SSDEEP 196608:I4FECEhw7uiuWyCYhuSi+MDa2ansBGdPnkctddEWioZBJGXl:zFENwyi0VcyMKnIgPnRnrQX
- TLSH T1DE962341A7F84174F4F36BB0A6BD8A625A79B8510B31D2CF53958A9C1DB2BC0DD38327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\adfuwinusb.inf_amd64_696636b394834f68\AdfuWinUsb.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4}\SET3CA2.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4}\SET3CA2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4}\SET3CB2.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4}\SET3CB2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4}\AdfuWinUsb.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\adfuwinusb.inf_amd64_696636b394834f68.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\adfuwinusb.inf_amd64_696636b394834f68\adfuwinusb.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb1b3539-73fe-5e43-9630-f9183568b7e4}\adfuwinusb.cat DrvInst.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log 5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe - Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe"C:\Users\Admin\AppData\Local\Temp\5e0a19342578173cfe08d7218c770c276e591a9717ea0f13824b532253307cdc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1996
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e8234223-093f-0545-97dd-02e3d893ca98}\AdfuWinUsb.inf" "9" "444117203" "0000000000000188" "WinSta0\Default" "00000000000000E4" "208" "C:\Users\Admin\AppData\Local\Temp\Driver"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Driver\AdfuWinUsb.cat
- Size 7KB
- SHA256 c740271edbe9ce90a6eea8572749afce80e7c68e4fa5b4077547287d68c21f44
- MD5 319ccfcb238bb2b6dd7e9ecb0047f6fb
- SHA1 166ae513c4ac2ec028d1cd0ea70666847fdf8a28
- SHA512 a05550e8f2f22100569d1ae70ad7d393e514ed9fcc5ff4a4dae0c1667e2d917bc0072adea2813106c441038e8c4e245c5fad519fcf91cfaab5f5a0d27199657b
- SSDEEP 192:YCj2guPumu2eZeRTVcdh+3Ef5KYpBjSAIX:YKZOTC+3Ef5dpBjhIX
- TLSH T1A9F109D6C97C96C6DDC3AC3053D8EC87BC39E7C39C00555952AADBA85C863E1A70452D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Driver\AdfuWinUsb.inf
- Size 3KB
- SHA256 2bac4d21416345e81119081dabc1faf050d1552aee015f18146956e35f5cab45
- MD5 734e344059a40ded65fb2de5eee414ae
- SHA1 25963158038c4cf55e8d85de404282ff40248b3a
- SHA512 102ba02c4170ae286e992cc66a8188b8464d44ed9063c16fa865424616effb47a56e7a9561db35fd8d580c4d7f727b33ec48214ed731640a14c24187652ee173
- TLSH T15261CC492D4D2D216EA3F62B1283189CD5983097E2486176FAA7845FCED490F318E6BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\adfuwinusb.inf_amd64_696636b394834f68.ini
- Size 311B
- SHA256 e94b3ec28eabf6035b61b8b6fb8ec57d24effa62ea4e45330bd4a63e14abe4ea
- MD5 e0da992b52036cfc961c575db0056e20
- SHA1 030da0f4f55fdff82cb5dd2e493e328f2184b15c
- SHA512 1e421d648a6f6563a4933cc3cada2e553dd7f9ba378a637c220eb8762c2770f65850b42c7582d98174dac3e17ebac9aa52836a9353154795f5a72c8f5bcb789e
- TLSH T15DE07D0210EF50CB2817821A9BA20BB4CD1FF3C30C60304DF330C52C1F2ADA10EA1409
- MD5 SHA1 SHA512 TLSH