Overview
overview
7Static
static
305e0bd96c2...59.exe
windows10-2004-x64
705e0bd96c2...59.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3vision.exe
windows10-2004-x64
6vision.exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
05e0bd96c228528c884563d0a58ecd420411c5bcf9fd3e389db11a12a3f84859.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
05e0bd96c228528c884563d0a58ecd420411c5bcf9fd3e389db11a12a3f84859.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
vision.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
vision.exe
Resource
win11ltsc2024-20260709-en
General
- Target vision.exe
- Size 542KB
- Sample260809-ylkgdsvdlf
- SHA256 128c35e8f2d9ab8cbc698bd4a7dbc125e9fc48f2af6d9efe260ee7a7433d252b
- MD5 58aa444a509bd6dda49576d3fc863a8f
- SHA1 ba728c3a0b3c5d63cd8c1c1d68bcb62cddfdc7d1
- SHA512 8fe822ab525f99f1218fd5709594e6c97cae1b8a67b095d6113ad698ed299ad6d630baf84571e16573ec2489c107fda5a8dfc8d5ea00e452cf2ded3939270d16
- SSDEEP 12288:JJyjTTqkR2W4nVyB94aZlpoBgpKf+qkf1SQ1Kf:JJy3Tqk03Vy/V/oBgE2Ffu
- TLSH T104C48E13A59547BDD05AC83483569A73B6327C8A1F31B8EF1AD436223E7BAE01B3D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\视力检测 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vision.exe\"" vision.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4508 vision.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4508 vision.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4508 vision.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vision.exe"C:\Users\Admin\AppData\Local\Temp\vision.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4508
-
C:\Users\Admin\AppData\Local\Temp\vision.exe"C:\Users\Admin\AppData\Local\Temp\vision.exe"1⤵PID:620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\视力检测\app-2026-08-09.log
- Size 1KB
- SHA256 912509a544068c7cfd4fae9ed178a76bfdd06f699d942467d0d1014f366a52cb
- MD5 e1d1a9b9210d7c8bb3d084a67a53944a
- SHA1 0eacce0df7d81eaa957615022928cec1f433e1ad
- SHA512 ef16ff0064acec31a40b75794810c29150bd1773dba21064d665a2b0a9ff2c81958df4ebb54e010b25786341dca1497148d7d78cfde975e771065441f9195b7b
- TLSH T192317A2E01EC8AAF1C828087D7CDB90DC960B5678EA5564DFF05385CA7C5D94BFD0D21
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\视力检测\app-2026-08-09.log
- Size 668B
- SHA256 6aea663a8b338b5f758fe607314e63d995c9863d3cae911ab789b17f60bfd4b4
- MD5 6c916da06cd89873d2be10d24823d16b
- SHA1 15512aa60c8552adf1edfaa10afdfe99611a6ec4
- SHA512 3c2683db91856e614a41e3d8b24585697a5bc5859222eb783420a1e11195ecdd615976865f44939d2ceb5bc5b170ea43b7323c77cd918abf26ebca6694b97ff2
- TLSH T18201215E02ED872F1811808AC7DEBA1DC851B96B0D325509EB44604D6780E90BEE1E22
- MD5 SHA1 SHA512 TLSH