e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patch_upload.exe
Size 5.0MB
Sample260808-mabjkadn2x
SHA256 e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c
MD5 8b928cec3cd7ac732db5781397ef2032
SHA1 9e779c56135bf86013b67cb1c45ddedd96c328b2
SHA512 8f3da7b5923259f87a35a955551e67cc127ac088e3caeb2378254280e2ed2687fe6d67e2f5c40b7445c85768def0778bb761d6243513fcaf7d062007a68b479f
SSDEEP 98304:J7nDM57bzHRaNPzwhtE0tFZPEz3uMOfe7qFwGP86M32Aj:J7DM57bzxCk30up1Puv
TLSH
T15236F12ABE5E613DC05A5AF54523C3105A377E6164FE8D1A42F0FB08CB33448DEEB666
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution installer persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x0003000000000741-18.dat	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral1/files/0x0003000000000741-18.dat	NirCmd

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	patch_upload.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	patch_upload.tmp

Executes dropped EXE 11 IoCs

pid	Process
5768	patch_upload.tmp
2388	nircmd.exe
3636	nircmd.exe
2404	nircmd.exe
4216	nircmd.exe
4104	nircmd.exe
2136	nircmd.exe
5004	nircmd.exe
1528	nircmd.exe
5264	nircmd.exe
1148	nircmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local\is-7KL59.tmp	patch_upload.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\Protein\Protein_x64.4.2.dll	patch_upload.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local\wintrust.dll	patch_upload.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local	patch_upload.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 23.0\Protein\is-HACQV.tmp	patch_upload.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch_upload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch_upload.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5304-0-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup
behavioral1/memory/5304-37-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup
behavioral1/memory/5304-41-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5768	patch_upload.tmp
5768	patch_upload.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5768	patch_upload.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 5768	5304	patch_upload.exe	88
PID 5768 wrote to memory of 5828	5768	patch_upload.tmp	89
PID 5828 wrote to memory of 2388	5828	cmd.exe	91
PID 5828 wrote to memory of 3636	5828	cmd.exe	92
PID 5828 wrote to memory of 2404	5828	cmd.exe	93
PID 5828 wrote to memory of 4216	5828	cmd.exe	94
PID 5828 wrote to memory of 4104	5828	cmd.exe	95
PID 5828 wrote to memory of 2136	5828	cmd.exe	96
PID 5828 wrote to memory of 5004	5828	cmd.exe	97
PID 5828 wrote to memory of 1528	5828	cmd.exe	98
PID 5828 wrote to memory of 5264	5828	cmd.exe	99
PID 5828 wrote to memory of 1148	5828	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\patch_upload.exe
"C:\Users\Admin\AppData\Local\Temp\patch_upload.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Users\Admin\AppData\Local\Temp\is-QKL5O.tmp\patch_upload.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QKL5O.tmp\patch_upload.tmp" /SL5="$402DC,4159888,1234944,C:\Users\Admin\AppData\Local\Temp\patch_upload.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nircmd.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.cmd
Size 1KB
SHA256 26786e0cec865055c9f683e5b223ac53a4f79096e5c9557f8b19724608b6f23b
MD5 31a0172a08721aa7a574248770aaed7b
SHA1 56bb344dafb785df689d00675cdfd679600477b7
SHA512 615afddd81a8f31f94e65e9a93e7adecc27b4d59c8dc5fe6b4b2282301bd0af338d8a6d3a423348b3b51437fefeef1dbf5734b32a33d2847ab9b3a3e4579ee7d
TLSH
T1FA217E505173A2A5324B4B39AA0995C0F09EC74D63453C1F1892A890EB8FF0DFB370AF
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\is-7EIRI.tmp\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
TLSH
T13AC34926732400EEC467E875DA119327C6F1BC550576E71FABD18CA7AF073A2BD29B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch_upload.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QKL5O.tmp\patch_upload.tmp
Size 3.9MB
SHA256 6cd551879065a6cbdb4adf6b171279ee3b562506de6aa62f1773bc78db0a8f92
MD5 0466ce09f089c44d98ec9dc6c686be8d
SHA1 f3294e7a3df27d346f73b44d018cd8c670d533c1
SHA512 6c5d85f316a0720ce302b3460f45da353922fccfd8fd83f0df90b6dd1363e7582dced3969b5fadd2f52e8ecec8c090fa4829942b5fb01fbfa3c25f6c732896e7
SSDEEP 49152:orHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/8333v:ornwboEuM4mQiEC0DK333v
TLSH
T1AB163913FE44A83AC05A2AF54527C75499377F2169EEDC1256E8FB0C8E37040FAEB646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5304-0-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/5304-37-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/5304-41-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/5768-5-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/5768-39-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/5768-38-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/5768-40-0x0000000000400000-0x00000000007F1000-memory.dmp

Download