5a05dacd5f8813ed710543a3166faf96c2b633c7b8497165dbe07dc974e40893

Analysis

max time kernel
142s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_c0b012.exe
Size 40.7MB
Sample260809-wvgezstbjd
SHA256 5a05dacd5f8813ed710543a3166faf96c2b633c7b8497165dbe07dc974e40893
MD5 798bca57c0443391180b8c13824ac13a
SHA1 bee85b9e8ef0e08473c68e8357b6b1e1da35d324
SHA512 eb2d8350004a5110c594f944f26b231a93c8e0f5cf6d4cfd2c30cc5fe72bd81f8a569d66b9fa4520c185b32fb630baf678336fdaf23d620c50f6cf8a8f9f6768
SSDEEP 49152:UJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntk:Uu/9nmHZLxG80DuKA3XAD8ntZfh6fgC7
TLSH
T114974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2816	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2784	WrsdA6.exe

Loads dropped DLL 1 IoCs

pid	Process
2784	WrsdA6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\VaslO6\\WrsdA6.exe\""	WrsdA6.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1716	cmd.exe
5972	cmd.exe
5484	cmd.exe
5412	cmd.exe
1940	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	WrsdA6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2520	cmd.exe
3616	cmd.exe
5852	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1416	schtasks.exe
1184	schtasks.exe
4484	schtasks.exe
5032	schtasks.exe
3060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
1860	install_c0b012.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe
2784	WrsdA6.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_c0b012.exe
"C:\Users\Admin\AppData\Local\Temp\install_c0b012.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1860

C:\Users\Public\VaslO6\WrsdA6.exe
"C:\Users\Public\VaslO6\WrsdA6.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\VaslO6\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\VaslO6\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4908

C:\Users\Public\VaslO6\WrsdA6.exe
"C:\Users\Public\VaslO6\WrsdA6.exe"
1⤵
PID:2668

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\VaslO6" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2520

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5944

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3616

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UxEnhance64.dll

Path C:\Users\Public\VaslO6\UxEnhance64.dll
Size 3.1MB
SHA256 b7cc2e660d5b7e884b5f6f50f97c730f5d5468a06241a17cc7139ae6bec69be7
MD5 393573aa1a3ac34966a5be28f3cb207e
SHA1 369bd7cb62f6d90800a287d98ee74b7735cddc3f
SHA512 9a313e6a5407acb8001048262d12141c7ce9bda3ec63e8470856b8703fb9355f67de295571a872157cae9746a6ba3a489ff2fb1ec708af551c505f8a7ff631ec
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+B:P9m29xx3Tiqt06ox6+z2rNNrKoB
TLSH
T1FEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WrsdA6.exe

Path C:\Users\Public\VaslO6\WrsdA6.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\VaslO6\adoresd.dat
Size 4.7MB
SHA256 2b9d1e61bb2b81e552a0475bcf3ce4d0e9039ef02b4304cdd2d05a8e920516cf
MD5 52f60967de1bb1236ca307d9a5562974
SHA1 f3ebd55ed09c08af53c855d63cf9a37abb4fa12a
SHA512 81b5ec2565387e33582382179ddd74a6a14dc6460d169eaa552d2e2c31c0cfff85a647a7833bab0fa65f6afe8667747b8dbbb37f466ee17dfbddaec9c067544f
SSDEEP 98304:tmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:ou1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1953633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\VaslO6\msadox.tb
Size 8KB
SHA256 e5e5ad59e979dcfa063fccfca4f5f39c818264872ad3588914fc694e57d80c3a
MD5 161f740a13ed6b78e12fd4962e5bac96
SHA1 5f2a8d4db95e3b19610664a66a02496d025730f2
SHA512 bf7607220096f7dd0a82deca82441a521a483fb2895be0d694c1166c5c9fa0402b1a7437c0e9fa96cedcbff6ad1ea4f054a772ec35270dc8a28f986c0c3e57c8
SSDEEP 192:5qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:5sZqZOXQ3uqvR2Kfzp
TLSH
T157029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-1-0x0000000004780000-0x000000000478E000-memory.dmp

Download

memory/1860-2-0x0000000004790000-0x000000000479C000-memory.dmp

Download

memory/1860-504-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp

Download

memory/1860-524-0x0000000004780000-0x000000000478E000-memory.dmp

Download

memory/1860-525-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp

Download

memory/1860-0-0x0000000004780000-0x000000000478E000-memory.dmp

Download

memory/2668-578-0x00007FFE83060000-0x00007FFE83062000-memory.dmp

Download

memory/2668-573-0x00007FFE60500000-0x00007FFE60A1E000-memory.dmp

Download

memory/2668-585-0x0000023B679D0000-0x0000023B68261000-memory.dmp

Download

memory/2668-586-0x0000023B679D0000-0x0000023B68261000-memory.dmp

Download

memory/2668-587-0x00007FFE83050000-0x00007FFE83052000-memory.dmp

Download

memory/2668-584-0x0000023B679D0000-0x0000023B68261000-memory.dmp

Download

memory/2668-583-0x0000023B679D0000-0x0000023B68261000-memory.dmp

Download

memory/2668-579-0x0000023B679D0000-0x0000023B68261000-memory.dmp

Download

memory/2668-576-0x0000023B679D0000-0x0000023B68261000-memory.dmp

Download

memory/2784-546-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-530-0x00007FFE83050000-0x00007FFE83052000-memory.dmp

Download

memory/2784-560-0x00000268464A0000-0x000002684652A000-memory.dmp

Download

memory/2784-559-0x00000268464A0000-0x000002684652A000-memory.dmp

Download

memory/2784-558-0x00000268464A0000-0x000002684652A000-memory.dmp

Download

memory/2784-561-0x00000268464A0000-0x000002684652A000-memory.dmp

Download

memory/2784-563-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-565-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-567-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-550-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-531-0x00007FFE60500000-0x00007FFE60A1E000-memory.dmp

Download

memory/2784-556-0x00000268463C0000-0x000002684640E000-memory.dmp

Download

memory/2784-545-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-544-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-543-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-539-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2784-538-0x00007FFE83060000-0x00007FFE83062000-memory.dmp

Download

memory/2784-536-0x0000026845B20000-0x00000268463B1000-memory.dmp

Download

memory/2816-594-0x000002712EE00000-0x000002712EE22000-memory.dmp

Download

memory/2816-597-0x000002712EE30000-0x000002712EE4E000-memory.dmp

Download

memory/2816-598-0x000002712F1C0000-0x000002712F272000-memory.dmp

Download