750d8f527f24018edb62cfafd937eb6ad93c7b716c8cc36749536cdf37b2ae72

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inst_smt016.exe
Size 55.2MB
Sample260805-gal3eaec36
SHA256 750d8f527f24018edb62cfafd937eb6ad93c7b716c8cc36749536cdf37b2ae72
MD5 dfe31e070b54180dfd356875d830aa22
SHA1 4141221bcb63077015d2f609e27cc85da4e33b0e
SHA512 f036e4353b5dee0ced3867d89c161bc47cb0e0063a165921ce7eb138bd4e5cb566091d898b62abb207059ab1c5bf1a146d8c0048d7b86213ffada928cbf370ed
SSDEEP 196608:nnnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6b:nSRe9QD7
TLSH
T1FDC78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1620	pOVLVl.exe

Loads dropped DLL 1 IoCs

pid	Process
1620	pOVLVl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\sYaNC0\\pOVLVl.exe\""	pOVLVl.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5736	cmd.exe
5948	cmd.exe
4312	cmd.exe
1704	cmd.exe
5416	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	pOVLVl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5112	cmd.exe
1248	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5348	schtasks.exe
3356	schtasks.exe
1872	schtasks.exe
4108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
4276	inst_smt016.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe
1620	pOVLVl.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\inst_smt016.exe
"C:\Users\Admin\AppData\Local\Temp\inst_smt016.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Users\Public\sYaNC0\pOVLVl.exe
C:\Users\Public\sYaNC0\pOVLVl.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\sYaNC0\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\sYaNC0\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4312
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5736

C:\Users\Public\sYaNC0\pOVLVl.exe
"C:\Users\Public\sYaNC0\pOVLVl.exe"
1⤵
PID:4084

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\sYaNC0" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5112

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4268

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UxEnhance64.dll

Path C:\Users\Public\sYaNC0\UxEnhance64.dll
Size 3.1MB
SHA256 e1d4691575b64d2c29a1e2e116de76d01c235672689408d12ff52cf130f7bc5e
MD5 40ca89f50af170f7e8a3a1f4a545f552
SHA1 e988f6d184264888f8ab0fd10079a88b0178d5b9
SHA512 46cfa08df2b18c7b0fd03daab37c2000c2c4fd5ca99fe61887c42ff2bfff252625f55ce9b93b740d39d5ec89442c090065abe817557af58b1c95aaf8771bbddc
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+w:P9m29xx3Tiqt06ox6+z2rNNrKow
TLSH
T154E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\sYaNC0\adoresd.dat
Size 4.7MB
SHA256 2d0e99a0e03a5e1582397c8c8ed1695fb34dea7bd2305ecc6b6a0b162796ef4b
MD5 f5b069d56328a5dd75d402e475f210a1
SHA1 e2e81438853441541bb21c109a18068ffb3a2562
SHA512 35a11c637c6b513e7e5988149c36d4fcc4fa53cad304433b7337edce0bee3077bc6bc7b990475bd1d5799b0de393ee64813e33aa2404c66f01ba53f67fe51360
SSDEEP 98304:Mmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:fu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T14D3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\sYaNC0\msadox.tb
Size 8KB
SHA256 f10563edeacce3d3b5daedb5974f46d663b7988d50d058395a4d28631ec1c2f8
MD5 0ce3284b5db1e42adc5b8acfa3dd57f4
SHA1 aea498afde828803ac405f31e44795fb999ca27b
SHA512 c37c3e64a9e84b315df95dbafb2844fcb28bf8624d83eda7f1513556775e45f63453f7e5ce8325cd79f7c7433266484913ea77c1214bbbfe9ad0ba4148d056bd
SSDEEP 192:+qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:+sZqZOXQ3uqvR2Kfzp
TLSH
T1FD029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pOVLVl.exe

Path C:\Users\Public\sYaNC0\pOVLVl.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-537-0x00007FFC2A4C0000-0x00007FFC2A4C2000-memory.dmp

Download

memory/1620-555-0x00000142F9890000-0x00000142F991A000-memory.dmp

Download

memory/1620-564-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-563-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-535-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-530-0x00007FFC0DBE0000-0x00007FFC0E0FE000-memory.dmp

Download

memory/1620-529-0x00007FFC2A4B0000-0x00007FFC2A4B2000-memory.dmp

Download

memory/1620-554-0x00000142F6D90000-0x00000142F6DDE000-memory.dmp

Download

memory/1620-542-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-538-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-544-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-543-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-556-0x00000142F9890000-0x00000142F991A000-memory.dmp

Download

memory/1620-545-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-550-0x00000142F8F60000-0x00000142F97F1000-memory.dmp

Download

memory/1620-557-0x00000142F9890000-0x00000142F991A000-memory.dmp

Download

memory/1620-558-0x00000142F9890000-0x00000142F991A000-memory.dmp

Download

memory/4084-590-0x000002CBF8730000-0x000002CBF8FC1000-memory.dmp

Download

memory/4084-591-0x000002CBF8730000-0x000002CBF8FC1000-memory.dmp

Download

memory/4084-594-0x000002CBF8730000-0x000002CBF8FC1000-memory.dmp

Download

memory/4084-586-0x000002CBF8730000-0x000002CBF8FC1000-memory.dmp

Download

memory/4084-595-0x00007FFC2A4B0000-0x00007FFC2A4B2000-memory.dmp

Download

memory/4084-583-0x000002CBF8730000-0x000002CBF8FC1000-memory.dmp

Download

memory/4084-585-0x00007FFC2A4C0000-0x00007FFC2A4C2000-memory.dmp

Download

memory/4084-592-0x000002CBF8730000-0x000002CBF8FC1000-memory.dmp

Download

memory/4084-580-0x00007FFC0DBE0000-0x00007FFC0E0FE000-memory.dmp

Download

memory/4276-524-0x00007FFC1BDC0000-0x00007FFC1BDD0000-memory.dmp

Download

memory/4276-0-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/4276-523-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/4276-503-0x00007FFC1BDC0000-0x00007FFC1BDD0000-memory.dmp

Download

memory/4276-1-0x0000000005670000-0x000000000567B000-memory.dmp

Download