b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56

Analysis

max time kernel
101s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
www.exe
Size 187KB
Sample260804-ffttrsfr31
SHA256 b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56
MD5 8499e96009ed7f684a8854a4c44f1e32
SHA1 2170055dc72f796f7a185e4655dcfbb22b04c518
SHA512 7c74f6edd7885ce4b45871125a645be858ef25dfb0342132298da3a015a45ec87ee8a9e8a98d36fe336def3b2bfcb901b1eb551c505dde9b0a1f68559a1651f9
SSDEEP 3072:PV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPyoNdquWTD4xVictLu:Ct5hBPi0BW69hd1MMdxPe9N9uA069TBE
TLSH
T1A8141896B1A45165C7F382B7E5204E2AD6713D601615A3E727783AFB1B3B294CB3C3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2904	powershell.exe
1096	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\wallpaper_new.jpg"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1344	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2904	powershell.exe
2904	powershell.exe
1096	powershell.exe
1096	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1344	2332	www.exe	80
PID 1344 wrote to memory of 4636	1344	cmd.exe	82
PID 1344 wrote to memory of 4364	1344	cmd.exe	83
PID 4364 wrote to memory of 864	4364	net.exe	84
PID 1344 wrote to memory of 2904	1344	cmd.exe	85
PID 1344 wrote to memory of 1096	1344	cmd.exe	86
PID 1096 wrote to memory of 2396	1096	powershell.exe	87
PID 2396 wrote to memory of 3408	2396	csc.exe	88
PID 1344 wrote to memory of 4856	1344	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\www.exe
"C:\Users\Admin\AppData\Local\Temp\www.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8037.tmp\8038.tmp\8039.bat C:\Users\Admin\AppData\Local\Temp\www.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4636
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://i.ibb.co/RGFK3SSx/Gemini.png' -OutFile 'C:\Users\Admin\Pictures\wallpaper_new.jpg'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$code = '[DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);'; Add-Type -MemberDefinition $code -Name Wallpaper -Namespace Win32; [Win32.Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\Pictures\wallpaper_new.jpg', 3)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f3nsy0f2\f3nsy0f2.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC7E.tmp" "c:\Users\Admin\AppData\Local\Temp\f3nsy0f2\CSC66C00D386E34461B7F6F281BC76A8A4.TMP"
        5⤵
        
        PID:3408
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f5d3c064817c82403567234b39eef76a84bea1c8201b7648bdd83ce5a7ffad15
MD5 b9d6991ff53b9449c6309c88b29c8ecd
SHA1 b216bee89e62e442573322614cc9ef4670847209
SHA512 e634d699f9cf9f0c66c954058cba643e8e60bee950bf730677652c3066ce79bfa2d7b8e3de82c9d3d2e8035236fd7c756771a45da072c335611ff9d069f0c44f
TLSH
T1F0117A33B79CC135C8E9117A1089AD01B1B4C3C7049EDE8B7A84C509E57F58ADBA45E4
MD5 SHA1 SHA512 TLSH

Submit Download

8039.bat

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\8038.tmp\8039.bat
Size 750B
SHA256 27de25693b38984a6d670dfbd12baa7044feb19da7b1ba269fe633194945fe81
MD5 8eb90c6406c8e54a2946160ca9c4b51f
SHA1 ba7574e93cb311cb70cf0944d727b2047cd9e73e
SHA512 942ef8ad0b9386531593be15987dfa9fe4dbc828f34b191403f36f501c6a8a2d9212e52305bb52c1af4996ba9e94643af2c2de6eddd4999a047e233ee8a55c9e
TLSH
T1F501B523300141794A22C568D8936023FEBA62DBB55A31CB30F0F1116E4FE1AD6F2A4D
MD5 SHA1 SHA512 TLSH

Submit Download

RESEC7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEC7E.tmp
Size 1KB
SHA256 b9c761119158330cc5e0a27fbd616fe2d573ff62306f76e4f89f1ac14118ab4e
MD5 904093ea625a3ee8aedc4f3e2ae8b878
SHA1 43e4f29658db8abedcec70a18465f8f1e5af9509
SHA512 c54c75871f1996ff24e78bbf1ad7a96a5af9d82697c913238a4adde0129a669a3105e4f0fd802e09ac6138955c8308e19e6e148b68a5b5d25d3bdbf4b602c8db
TLSH
T186218C0593E94B1AF077473269FA072F5634FD55AF61A75B8540422C2C81604EEB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_umfvfdqc.dz2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_umfvfdqc.dz2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f3nsy0f2.dll

Path C:\Users\Admin\AppData\Local\Temp\f3nsy0f2\f3nsy0f2.dll
Size 3KB
SHA256 63cc9e3bd8427d956200498d1baaa9558a3f3934518e1f4523b84d8858589447
MD5 880f079456427482faff4cc0e5b3ee92
SHA1 58c1fc3ace6153c5caba544aeca5f6155b030f60
SHA512 56dcd2609dfa0d5b04cc48d68a4ebe78ab1de5c757796092ce13c5487483b5ffd87760ac31c437c238ca16a88ae2624d3c74976fddaf8b7b7a52ccd2d826878b
TLSH
T14F51EF2A63E8466BE47B0B306DF3872737B4F8109FB2A75D08C00318AC607645D72BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC66C00D386E34461B7F6F281BC76A8A4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\f3nsy0f2\CSC66C00D386E34461B7F6F281BC76A8A4.TMP
Size 652B
SHA256 65931d510136f1fcc17ef0721555ae9239235af8b794c85459b663aa0e935c88
MD5 9970517a9409691cdce99f316790fe6b
SHA1 fe790ef6509b43ef92464be4a083afbf27370ade
SHA512 6919924272dd1fc154c3c24702d1f3c95c24f45c2ffbce74c59a204cafa9ce3ca3dda8b9af8b2e69f0691ae5a08a2098fae1999dd79ccecf2d63edacc8bab1c0
TLSH
T1AFF05E09A3F8020EF0F34B71BDF6436395A8BC65DE32A3ED148043192864610D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

f3nsy0f2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\f3nsy0f2\f3nsy0f2.0.cs
Size 274B
SHA256 21504fd073038a8709b2bcbf3556708c7c2b9dda80dba5af80158866fc22f6bf
MD5 1fd21394b33e86f5137153f93fafb2c8
SHA1 ffafab07693283f79c4cc3f5ca0d4fda5f93bbea
SHA512 6d80b1f74188a6165b4a7510abd8ae730b32c33e5d33108b766a9a5ade159cb3d81bfdd992f66ac090642430dbd4afc6350c6432cb3a2eba4e797c447c1b0489
TLSH
T17CD02B24B693DAF88443081B4C83A0B57737916B72DB7A0579F86110CF8B4182932A29
MD5 SHA1 SHA512 TLSH

Submit Download

f3nsy0f2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\f3nsy0f2\f3nsy0f2.cmdline
Size 369B
SHA256 e94d66a5ba4be175143881a16e9b3e606445f2524135c56dc3b8323bdc26aa15
MD5 2b0f92993becf089f45798929ccaf8e0
SHA1 15897eba53f54244eec25d99b136f99eef28dedd
SHA512 dd18009e6ec2095142af014a115dc319874a65e36c7a583d2b20b8414c6ddcc862ed6cc2a8a56a984376f95b9c92490f4a84110154ad0c3d6e93c47dd04147df
TLSH
T170E0C02A6756CBFD05DD1007216EC4ACCE7207432D92BF8450D0480DD017C02A7D2BC5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-37-0x000001D1E2CA0000-0x000001D1E2CA8000-memory.dmp

Download

memory/2904-11-0x00000214B9A40000-0x00000214B9A50000-memory.dmp

Download

memory/2904-4-0x00000214D52C0000-0x00000214D52E2000-memory.dmp

Download

memory/2904-3-0x00000214B9A40000-0x00000214B9A50000-memory.dmp

Download

memory/2904-2-0x00000214B9A40000-0x00000214B9A50000-memory.dmp

Download