43ca3f305c0021a797528dc3d7ac4b3e181d5f62cbd9e723b3b7cf0bafd8d0fe

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
フリマル_セットアップ.exe
Size 2.6MB
Sample260804-pgc23szepa
SHA256 43ca3f305c0021a797528dc3d7ac4b3e181d5f62cbd9e723b3b7cf0bafd8d0fe
MD5 c2f06cb14752508d35d05764b879f048
SHA1 42930e511236325fb0a0d83a99c381c62f180f78
SHA512 7096c0ae9de480ddc3b358cc1a9e7bb83d9257d1122df56ee3d602a5b0801fd4ee9f2b4f961bce2e9806280627e9c323ba31b016bf02f4dca182d77ebd563be9
SSDEEP 49152:k3/TZF/AjMTCYtpBhYWdJ3O/UTLKMSiOGD9T4BOys0v25GllMpoKWtz762:o/AjMWYtpg6+8Kbw4BXjv4GllfKWtzO
TLSH
T1D0D5335D37F20197E9795B7458F017436A76FD636764C2EF02E0EE2D18224C86A33BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
21	416	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
416	powershell.exe
2204	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	フリマル_セットアップ.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1452	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1436	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2204	powershell.exe
2204	powershell.exe
416	powershell.exe
416	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	416	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1452	4184	フリマル_セットアップ.exe	84
PID 1452 wrote to memory of 2204	1452	wscript.exe	85
PID 1452 wrote to memory of 1436	1452	wscript.exe	96
PID 1436 wrote to memory of 5096	1436	cmd.exe	98
PID 1436 wrote to memory of 416	1436	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\フリマル_セットアップ.exe
"C:\Users\Admin\AppData\Local\Temp\フリマル_セットアップ.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe _launch.vbs
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Expand-Archive -Force -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\furimaru_setup'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\furimaru_setup\フリマル_セットアップ\インストール.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try{[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://www.python.org/ftp/python/3.12.7/python-3.12.7-amd64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\furimaru-python-setup.exe'}catch{exit 1}"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
TLSH
T17F71FE313275B0D4C8567F071E2819C453BF4386EAA4AF4CB25C621EDD2641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0796303e0c95ffd59557bd9307f74cdb80235d32a7dcd5eeb11a71c140ea4912
MD5 dd5e87db9b03fc640d5a53b98a283ba5
SHA1 718deacc460ce0e05e11310e44d1c3b763ff6921
SHA512 42da658b3a12fd9479c2990848baf4e9cb96ce650a60ba3fa13592d9056c04e182594c1f2acffa8b6d362b9e580d649fcfb9343a63d5c37cfa2cd282c1912f9f
TLSH
T11F318827B3DC89E4C896063A009E9D2077B692D391DECFDBBBC4D604A57F688CF61190
MD5 SHA1 SHA512 TLSH

Submit Download

_launch.vbs

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\_launch.vbs
Size 715B
SHA256 b4fbb4da2aead64fcb9d3ad277620f335531b06aeb24965574f34266da25fbad
MD5 651e81aed075c18dc2ad2b8652e2acc0
SHA1 bcfbf5e55022d6d44022759faa48bd1108d992a2
SHA512 c48c7e193c7897f32c28fde5d482a979c5605f6ef44005abbc48bee00c5ede4dcd4dfaaa29c1a2dd33195593d8681add3085249766d050a717fccd6473f8d3e0
TLSH
T16E014E1FF252E220841382D269FE886DD858C1B08931DCF4BDB8DC88C00C5F013A62CB
MD5 SHA1 SHA512 TLSH

Submit Download

setup.zip

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.zip
Size 2.5MB
SHA256 0bd7da184d3948b1221577c7e2979b37d41968c0c244dc443fb814a7e6fc3e6f
MD5 cf4ff3a8cd47d3fb499f915d62e528e0
SHA1 d3da2153b712dc9befc4ccdfaf7312310f594e33
SHA512 3ca83ec1dfd6b91f4ccd8e98226855a9ab35cf1ea199d7636219368c12e88c8581720ad29858d65177eb3b3a10681d63d6e873343c19d50f306fa0b1868fc301
SSDEEP 49152:wupQtVZ6jMFA/RqYoCJ3tmU/U+6pdwOVUTd9jt4Dv2+u/ldQlpEDDE25s:DIZ6jMu/jD9y+aid9JqvHu/lEEcv
TLSH
T194C5337C1BB08C6ECEB4E47D54F33E5AD997C94E9985C04F42D4ED28A1A60A9F933438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i1qb5x4c.5yi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1qb5x4c.5yi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

インストール.bat

Path C:\Users\Admin\AppData\Local\Temp\furimaru_setup\フリマル_セットアップ\インストール.bat
Size 1KB
SHA256 33467b7694485d933c849791b0d2d3aa645e410abdaaa94bfb1b756c37db132b
MD5 fe399c3ec9d3acf9ecc55ff40dd862a3
SHA1 6e33fe0842306082ae2ae348f9f04ffc2b6e8b78
SHA512 8064551670f1f3bd91539ef843c21163f42cb6a2dbcf9ebfa6e105ece9bae49b40dbd4778ff774be1c4ce5bb376dc98ecb0b6136376ab568201206c6ff1afc03
TLSH
T19141244F3A08D4B9D4B4C7AD7A6D43532307A0F741469DFD547AC4287C0F3AFA626662
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2204-5-0x000002D8E10E0000-0x000002D8E10F0000-memory.dmp

Download

memory/2204-6-0x000002D8E10E0000-0x000002D8E10F0000-memory.dmp

Download

memory/2204-7-0x000002D8FB270000-0x000002D8FB292000-memory.dmp

Download

memory/2204-15-0x000002D8FB600000-0x000002D8FB612000-memory.dmp

Download

memory/2204-16-0x000002D8FB5E0000-0x000002D8FB5EA000-memory.dmp

Download