6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mysterious_Retrac_Cracked.rar
Size 11.2MB
Sample260809-2nkrqaep2y
SHA256 6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240
MD5 4bd9245d03af9a2576706ea46150c56e
SHA1 b5d64a7bbbe57e0fc1f286326c79bf9a98161954
SHA512 637fcc7eaa44f7db797a2a3d509174e94d97b1c3c73b03c30dcfb7ead28975096cf87bab80be5785268057650e9a9a0709cc3495c17e401e37098cb47005f623
SSDEEP 196608:NUfTbFKYqUkezSMOoLTnIAmYlSOm8+QaLkxYKYgetVLid0rh9WH+cbvhEoWCZc:kbFJnjSMOETntmYlS38+QaLFKYgetxBp
TLSH
T1DAC633A5751F086399F1155053CD8AFF20B3B5C3ACFA53454ADDA0D280A8EF42879BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution vmprotect

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4724	Mysterious (2).exe
1384	Mysterious (2).exe
3780	Mysterious (2).exe
820	1337patcher.exe
4396	Mysterious (2).exe
448	Mysterious (2).exe
960	1337patcher.exe
3604	Mysterious (2).exe
2356	1337patcher.exe
2776	1337patcher.exe
1788	Mysterious (2).exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000700000002449a-14.dat	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

pid	Process
4724	Mysterious (2).exe
4724	Mysterious (2).exe
1384	Mysterious (2).exe
1384	Mysterious (2).exe
3780	Mysterious (2).exe
3780	Mysterious (2).exe
4396	Mysterious (2).exe
4396	Mysterious (2).exe
448	Mysterious (2).exe
448	Mysterious (2).exe
3604	Mysterious (2).exe
3604	Mysterious (2).exe
1788	Mysterious (2).exe
1788	Mysterious (2).exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4436	cmd.exe
2820	cmd.exe
4328	cmd.exe
4172	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
3112	timeout.exe
3712	timeout.exe
1048	timeout.exe
1984	timeout.exe
908	timeout.exe
2132	timeout.exe
3856	timeout.exe
568	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
820	1337patcher.exe
960	1337patcher.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3736	7zFM.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	3736	7zFM.exe
Token: 35	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	820	1337patcher.exe
Token: SeDebugPrivilege	960	1337patcher.exe
Token: SeDebugPrivilege	2404	taskmgr.exe
Token: SeSystemProfilePrivilege	2404	taskmgr.exe
Token: SeCreateGlobalPrivilege	2404	taskmgr.exe
Token: 33	2404	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2404	taskmgr.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4436	3736	7zFM.exe	86
PID 4436 wrote to memory of 908	4436	cmd.exe	89
PID 4436 wrote to memory of 2132	4436	cmd.exe	90
PID 3736 wrote to memory of 2820	3736	7zFM.exe	95
PID 2820 wrote to memory of 3856	2820	cmd.exe	99
PID 3736 wrote to memory of 4724	3736	7zFM.exe	102
PID 2820 wrote to memory of 568	2820	cmd.exe	103
PID 3736 wrote to memory of 1384	3736	7zFM.exe	104
PID 4328 wrote to memory of 3780	4328	cmd.exe	108
PID 4328 wrote to memory of 3112	4328	cmd.exe	109
PID 4328 wrote to memory of 3712	4328	cmd.exe	110
PID 4328 wrote to memory of 820	4328	cmd.exe	111
PID 4172 wrote to memory of 448	4172	cmd.exe	115
PID 4172 wrote to memory of 1048	4172	cmd.exe	116
PID 4172 wrote to memory of 1984	4172	cmd.exe	117
PID 4172 wrote to memory of 960	4172	cmd.exe	118

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mysterious_Retrac_Cracked.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO89EAD238\PATCH.BAT" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:908
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO89E9F678\PATCH.BAT" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3856
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:568
- C:\Users\Admin\AppData\Local\Temp\7zO89EA1198\Mysterious (2).exe
  "C:\Users\Admin\AppData\Local\Temp\7zO89EA1198\Mysterious (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\7zO89E08DA8\Mysterious (2).exe
  "C:\Users\Admin\AppData\Local\Temp\7zO89E08DA8\Mysterious (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PATCH.BAT" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\Desktop\Mysterious (2).exe
  "Mysterious (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3780
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3712
- C:\Users\Admin\Desktop\1337patcher.exe
  1337patcher.exe patch.1337 -ns "Mysterious (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:820

C:\Users\Admin\Desktop\Mysterious (2).exe
"C:\Users\Admin\Desktop\Mysterious (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PATCH.BAT" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\Desktop\Mysterious (2).exe
  "Mysterious (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:448
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1048
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1984
- C:\Users\Admin\Desktop\1337patcher.exe
  1337patcher.exe patch.1337 -ns "Mysterious (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960

C:\Users\Admin\Desktop\Mysterious (2).exe
"C:\Users\Admin\Desktop\Mysterious (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3604

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404

C:\Users\Admin\Desktop\1337patcher.exe
"C:\Users\Admin\Desktop\1337patcher.exe"
1⤵
- Executes dropped EXE
PID:2356

C:\Users\Admin\Desktop\1337patcher.exe
"C:\Users\Admin\Desktop\1337patcher.exe" C:\Users\Admin\Desktop\patch.1337
1⤵
- Executes dropped EXE
PID:2776

C:\Users\Admin\Desktop\Mysterious (2).exe
"C:\Users\Admin\Desktop\Mysterious (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1337patcher.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1337patcher.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
TLSH
T1C5D023603795D1C549577F54181D2A4881FF0255B1109D14749572DEDD345671F311E7
MD5 SHA1 SHA512 TLSH

Submit Download

Mysterious (2).exe

Path C:\Users\Admin\AppData\Local\Temp\7zO89EA1198\Mysterious (2).exe
Size 13.1MB
SHA256 11183ee281a62104b75592c713d8959ff86d35b639a266da4ea8af80d632709d
MD5 53433e3efc9d9c660b6380399c08e13d
SHA1 7beef788f1e236a7259d1d5c8cb09591bfa7fe8d
SHA512 41b03fe779281f2fc59d1806fbbd6d73d6fa31fa973cb785a7cbec67c50866d39dd04b0b4220d965583d076d9588be1458396f09a5512e864a66d80ce7393208
SSDEEP 393216:mUZm6G8MC6lYFUTBu8IWlKALU51fb8njA6m:m4m6G8MCEYFeMGEcwf6m
TLSH
T1F3D623EA90E522E4E9D309C0768E53CE26D0A15D49DD6C2C399B2C439F36DEF414AE73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PATCH.BAT

Path C:\Users\Admin\AppData\Local\Temp\7zO89EAD238\PATCH.BAT
Size 324B
SHA256 fb433d0b0035234ab82b0bf7a610b89b88e660714df01409ff2135d9cc005500
MD5 3409e0a96094afa88bc1c30feebd8f1a
SHA1 c40ac05c6e67b0f05dce0ed762d14c6258fe9184
SHA512 d94b686071acb42e2d42a8292b9f3154e66a37a908f5b7921be2a9ec583210f44a27b1d1304046ad8f3d78c1c4f555ce998e177c6644c317d7babc1130e66844
TLSH
T1F0E07D9B61CF464A59E012212B2F36D1F49B522BB804244A3476D2AA0747ADA624D98D
MD5 SHA1 SHA512 TLSH

Submit Download

1337patcher.exe

Path C:\Users\Admin\Desktop\1337patcher.exe
Size 17KB
SHA256 4e2882e38b927e1e6c457d3fb492b59d014ddb83790b860f4102ba553fa333b7
MD5 a5e0fd3a628c3b7ddff91e7113b2a68b
SHA1 5eb1642d333f0ac6aa67c7cdfddffe4ef6dc21ed
SHA512 5ea45ab813b268e538f808f700eca68d639d6dfdf98c58aa5f965a5f47373700842be9b77db7ea5e1900042187a7733a73d1adeb0d12a07f4be7107c34b9df69
SSDEEP 384:nDx0aLJE0vtNXwfBLU6TDjxts6uKf29MmKftc:Dx0adEiNgJ40tJeMxfO
TLSH
T1E772D70AB7EC8614F5FF537854F3030106B5B80B6936CB5F2A8D55AF1E237808862BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch.1337

Path C:\Users\Admin\Desktop\patch.1337
Size 144B
SHA256 97a152f6623929e02ffb1292398482db7fd57f27d85b91684f78b90c73e7d345
MD5 8fc48371869ebcf36532b2836d032395
SHA1 df95907acde14493593d7cee8093b616318e5580
SHA512 1b5a6e240f2d6c0a297cebfe7e986d90a3133359c4858509eb07a6338155a592ee55fcefb7690c3f62574c2b5d754317678bb0861bf298d717a5e30801754c75
TLSH
T195C0118200280FCAC8C023C02BAF3080FCAEBA022CC3000300088F80A00A0BE0B8B03A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-43-0x0000000000D80000-0x0000000000D8A000-memory.dmp

Download

memory/2404-51-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-53-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-52-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-58-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-63-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-62-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-61-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-60-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-59-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download

memory/2404-57-0x000001B8FD870000-0x000001B8FD871000-memory.dmp

Download