Overview
overview
10Static
static
3hgf.zip
windows10-2004-x64
1hgf.zip
windows11-ltsc_2024-x64
1Power Off.exe
windows10-2004-x64
1Power Off.exe
windows11-ltsc_2024-x64
8UNKNOWN.zip
windows10-2004-x64
1UNKNOWN.zip
windows11-ltsc_2024-x64
8a/Axam.a.exe
windows10-2004-x64
7a/Axam.a.exe
windows11-ltsc_2024-x64
7processhac...up.exe
windows10-2004-x64
7processhac...up.exe
windows11-ltsc_2024-x64
8virusvippro.exe
windows10-2004-x64
virusvippro.exe
windows11-ltsc_2024-x64
main.pyc
windows10-2004-x64
3main.pyc
windows11-ltsc_2024-x64
3Analysis
- max time kernel
3599s - max time network
3598s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 23:13
Behavioral task
behavioral1
Sample
hgf.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
3600 seconds
Behavioral task
behavioral2
Sample
hgf.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
3600 seconds
Behavioral task
behavioral3
Sample
Power Off.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
3600 seconds
Behavioral task
behavioral4
Sample
Power Off.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
3600 seconds
Behavioral task
behavioral5
Sample
UNKNOWN.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
3600 seconds
Behavioral task
behavioral6
Sample
UNKNOWN.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
3600 seconds
Behavioral task
behavioral7
Sample
a/Axam.a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
3600 seconds
Behavioral task
behavioral8
Sample
a/Axam.a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
3600 seconds
Behavioral task
behavioral9
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
3600 seconds
Behavioral task
behavioral10
Sample
processhacker-2.39-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
3600 seconds
Behavioral task
behavioral11
Sample
virusvippro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
50 signatures
3600 seconds
Behavioral task
behavioral12
Sample
virusvippro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
84 signatures
3600 seconds
backdoordefaultoffice04costuradefense_evasiondiscoverydownloaderexecutionacrstealerasyncratcobaltstrikedestiny_stealerformbooknanocorenightwirephantom_stealerquasarratonratremcossalatstealersvcstealerxredxworminstallerkeyloggerminerpackerpersistenceprivilege_escalationpyinstallerratrevoked_codesignspywarestealersuricatatrojanupx
Behavioral task
behavioral13
Sample
main.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
3600 seconds
Behavioral task
behavioral14
Sample
main.pyc
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
3600 seconds
General
- Target a/Axam.a.exe
- Size 11KB
- Sample260807-27e1ksdn8x
- SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
- MD5 0fbf8022619ba56c545b20d172bf3b87
- SHA1 752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
- SHA512 e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
- SSDEEP 192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
- TLSH T186329E8A7BBA6451C3D6C13347934E3863502D542D3A5F4A2AF5B3BB8CB0160F8106F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 4 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.exe - Executes dropped EXE 1 IoCs
pid Process 2432 Axam.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe" Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe" Axam.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Kazaa\My Shared Folder\Invisible_man.exe Axam.exe File created C:\Program Files (x86)\KaZaA Lite\My Shared Folder\AjeedNASA.exe Axam.exe File created C:\Program Files (x86)\Morpheus\My Shared Folder\Blaster.exe Axam.exe File created C:\Program Files (x86)\Grokster\My Grokster\XXX_HOTSEX.exe Axam.exe File created C:\Program Files (x86)\BearShare\Shared\fxbgbear.exe Axam.exe File created C:\Program Files (x86)\Edonkey2000\Incoming\setup_flash.exe Axam.exe File created C:\Program Files (x86)\limewire\Shared\Super Mario.exe Axam.exe File created C:\Program Files (x86)\KMD\My Shared Folder\Axam.exe Axam.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Axam.a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Axam.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa" Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command Axam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon Axam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1" Axam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe Axam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa" Axam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*" Axam.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3672 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe 4236 Axam.a.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4236 Axam.a.exe 2432 Axam.exe 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE 3672 OUTLOOK.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a\Axam.a.exe"C:\Users\Admin\AppData\Local\Temp\a\Axam.a.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4236
-
C:\Users\Admin\AppData\Roaming\Axam.exeC:\Users\Admin\AppData\Roaming\Axam.exe1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2432
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Autoexec.bat
- Size 302B
- SHA256 941689078f2ed21767fd0aa5ad330df33b8a0ac96acccb2020f307558d6087cb
- MD5 3565a089a0f8b2b5afb04ec4379b44dc
- SHA1 4075ac633db35b158e4142860a2fd4f331780f9c
- SHA512 112538d7d1af9c02536db20acfc6cea3225341d0f1468ad49ab980a65c74c9111fbf2514776e4e40bd2fbb13d1703dc47cc647b780dc503be99f6fa712c925a5
- TLSH T1D5E012633B80FC7017C009A48D7A406C3E4511A33D035D83104F00F419443C0B20C032
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Axam.exe
- Size 11KB
- SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
- MD5 0fbf8022619ba56c545b20d172bf3b87
- SHA1 752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
- SHA512 e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
- SSDEEP 192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
- TLSH T186329E8A7BBA6451C3D6C13347934E3863502D542D3A5F4A2AF5B3BB8CB0160F8106F4
- MD5 SHA1 SHA512 SSDEEP TLSH