84c7ae138ff0f6612c07795cdd51d8b1fa87c25437fcece1fcd7c18385921724

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mechvibes-dx.exe
Size 15.8MB
Sample260804-b56gmsel71
SHA256 84c7ae138ff0f6612c07795cdd51d8b1fa87c25437fcece1fcd7c18385921724
MD5 9a0fcc4f2caf67c5426583f43374430e
SHA1 79354c7959fed7e101e08ecadb794efcd45ab45f
SHA512 40e0fdda0436655dcf7fb03a0629a933e94ad1be4328db260fe357d58ce75975d2d42d711358af2d6849c299201b99b62762899e9ffeefe2b0c35bf1b533667d
SSDEEP 98304:Esoe15CrjJEzExgIsUo5+j+AY5gwMsxqmW1kb3Nh6XaWszakETLcQAN37Npmd:Esj2E4xPDokjXJk7zakFmd
TLSH
T1ACF619257B4FA9ADC11AC470838646B25A7134CB0B35B9FF44D586783FA9AF42E3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mechvibes-dx.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1728	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	mechvibes-dx.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2568	mechvibes-dx.exe
2568	mechvibes-dx.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1728	2568	mechvibes-dx.exe	84
PID 1728 wrote to memory of 5092	1728	msedgewebview2.exe	85
PID 1728 wrote to memory of 4732	1728	msedgewebview2.exe	86
PID 1728 wrote to memory of 4732	1728	msedgewebview2.exe	86
PID 1728 wrote to memory of 4732	1728	msedgewebview2.exe	86
PID 1728 wrote to memory of 3676	1728	msedgewebview2.exe	87
PID 1728 wrote to memory of 2232	1728	msedgewebview2.exe	88
PID 1728 wrote to memory of 2232	1728	msedgewebview2.exe	88
PID 1728 wrote to memory of 924	1728	msedgewebview2.exe	89
PID 1728 wrote to memory of 924	1728	msedgewebview2.exe	89
PID 1728 wrote to memory of 924	1728	msedgewebview2.exe	89

C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe
"C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=mechvibes-dx.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2568.2384.14548249140604916490
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x138,0x13c,0x7ffd2310b078,0x7ffd2310b084,0x7ffd2310b090
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView" --webview-exe-name=mechvibes-dx.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,7890011498144063171,17178830892142349784,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView" --webview-exe-name=mechvibes-dx.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,7890011498144063171,17178830892142349784,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView" --webview-exe-name=mechvibes-dx.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1708,i,7890011498144063171,17178830892142349784,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:8
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView" --webview-exe-name=mechvibes-dx.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,7890011498144063171,17178830892142349784,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f37587ca680fce6c812519844ecc103f9303b2d7c85ebe0e57874a0c3125e089
MD5 a13d659e329b57503fbe1fdb90f5682e
SHA1 232920196a9ba5cc3cb838f467c6534c3cf82379
SHA512 eaf72eaf7992951b15a9e5c732dac8f2b127590c610dfe927f549cc47e7cbbe67e18b78a5bae1e2c5cc721afe1af5c374d82634c1e417cf5daf04ef1ca437187
TLSH
T108D0121373230674C01125731152610A4402C50B404540049C388A2E5A044D01A06452
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5834d8424c34f9d20980a5259a7a5b8d2e938b0934c368920a81289eed4b4e94
MD5 ae3f408c24645a5a670e1c7887ba4ba5
SHA1 a20212c186b09ba57c76de53b7e1c96a2caf67b3
SHA512 c944e79ad00c5ebff7f7a84af8b1e478ad92615d3420006ffe9a779d1fa14f66b0665aac8b04c4866d0cc89e0b23c809ac0edbf4819a4f058fe93db6bcf6d1b1
TLSH
T1E0D00411D3331540D143157311744103C1074C01004105044D30051544405C01105115
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 3a95a9ef26112a0dd8290a3f76fb0ca839b54edff219fc21d5855fc6cc2b5ff1
MD5 ac3cc5b9eca268e475b26d405b97b6ad
SHA1 3b35071ba5fe5af077eef8a45c1880832e262cdc
SHA512 f9f481484a884eb704837a383a86e38878fe0360fa1f82ff8e35dbc338fdd38df5751ff2f9c11269713cc491269df610fdd66ff20510c089a1cb10e0353985e2
TLSH
T15131B5B2C4E12F3399C1534AB4462A637DA100B5C2140F1464ED072902D76DCE6BAD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 c5334ad934764fd8b0dc01ab9026461f16d7dcbd916f8e4922094708bd4a8023
MD5 57f187242aaeaf9b0216a6a6c2025835
SHA1 4c0ed87b30e8508426d328d30abb389929bb3b6d
SHA512 b96d101b78eee716e6dc9db67f07ce8c254ce5e50f782547d2c04a344080bc07aa4b0de4cb8cdf98e82112b4fcc5c2433e6d7d461f5b70b9adc56ae807b5510d
TLSH
T18D51C733A8946A378AE24748BC4A3F23EDB201A1D6552F6059ED1B1801DB6DC7346D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 306a5581837359a1b6b0ccdaf1b7281300600013c132d28a2d7c967e8b7eb9bd
MD5 ed99f996a8c8994aa139d45cdc806124
SHA1 c68e0baa871bb4dc0fd5665d25487d181874e9fd
SHA512 e1140cfd92ffa8e49a5569b97ed1eae5648251941c210a29cefb24e2033132ba6c5f3eae106f0184ae4f8df9aec4aba45e212ca1b5eab3e3d7be9731c139b1cb
TLSH
T12471B83698E4A9374EE29A09FC862B12BAE10173D5943FA4D9EC0F1D01D73DC2352D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 bf8a1381ec64533e688afe3e6b2cd8917a1f42fff4a843f112fc76de193ca3ca
MD5 8b434b993311d6c874b4afb871de097c
SHA1 6422f1daa639201b55def0890871d8c9d4329753
SHA512 894de5c66b509346c1ac4ac21954bb136bc6c38c3f1871599193fbc400e7a50e704672b0301e39c0e4df578f2d73812d4181e5af293dd4f23fc1192fb6718fce
SSDEEP 96:zuUWg3NkCESifmJn418Frh/cInURoDotoN5X6DNBUZm6OJZ/NrTPl6a:zRWg3Nb3JrooDUaMTUZm3b
TLSH
T1E691B626A8B4A9378DF2D649B8463F13BAA15163D1D42FA4D9EC0F1D01D73DD1382D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587664.TMP

Path C:\Users\Admin\AppData\Local\Temp\mechvibes-dx.exe.WebView2\EBWebView\Local State~RFe587664.TMP
Size 1KB
SHA256 5362c8bf08cd9a606c48141cfd58cc2928db49ba5ddc28ff88c9443b950fbb3a
MD5 015ff12fa6f52ca5867053eb3b79485b
SHA1 dff73fe0bbdbd586cba0721441558a464a99caa3
SHA512 bf81ad7fad054bce7d284017560be00d3adb40dbab62dbb2e050c89e3545959696eb1c2276b5c1934004dce10fc6568f156e3be23c966ca3171a482c96294f0c
TLSH
T1F6216273C4E26E77A9C14259B45276573C9001B5C2180F18A4ED122A03DB9EDD6BBD33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/924-149-0x00007FFD3F2F0000-0x00007FFD3F2F1000-memory.dmp

Download

memory/2232-59-0x00007FFD3ED30000-0x00007FFD3ED31000-memory.dmp

Download

memory/2232-58-0x00007FFD3EFB0000-0x00007FFD3EFB1000-memory.dmp

Download

memory/4732-29-0x00007FFD3F2F0000-0x00007FFD3F2F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads