c9b1e323ceb9af146919be77535da0295781d5b2da939d9b36e37e438498d342

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cv2.exe
Size 157KB
Sample260810-agkdtsxgra
SHA256 c9b1e323ceb9af146919be77535da0295781d5b2da939d9b36e37e438498d342
MD5 5ba8f55f320b00cfdba0d67aaaf5e4af
SHA1 b8a868386f704dd6d78d8afaa0b5da83fbd6769c
SHA512 53e35c0fa2cfd9cee326860edfca18e70400dfb15a9fa27a36da1b61f4185a0652c76203536f1a9a1c1ef688f5268e810cec03c6282e322739b28c51a40a7dd2
SSDEEP 3072:+gTQvKsrxF6lQI+fytmuEqy5oG9Y90SxcwNb/H:+xrjEcVuW5HYxLV/H
TLSH
T11DF36A217290C032E59710318AE9DBB64E7ABC720B76A5CB77D90B7A1F242D1CB3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	4960	cv2.exe

Executes dropped EXE 1 IoCs

pid	Process
4128	ANAHOpDywsyEktA.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System\a1.mentah	cv2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ANAHOpDywsyEktA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cv2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	ANAHOpDywsyEktA.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1100	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	cv2.exe
4960	cv2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	cv2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4960	cv2.exe
4960	cv2.exe
4960	cv2.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4960	cv2.exe
4960	cv2.exe
4960	cv2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4128	4960	cv2.exe	89
PID 4128 wrote to memory of 1100	4128	ANAHOpDywsyEktA.exe	91

C:\Users\Admin\AppData\Local\Temp\cv2.exe
"C:\Users\Admin\AppData\Local\Temp\cv2.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\ANAHOpDywsyEktA.exe
  "C:\Users\Admin\AppData\Local\Temp\ANAHOpDywsyEktA.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\HWID.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HWID.txt

Path C:\HWID.txt
Size 271B
SHA256 a5c92ce843b3b1f589708442219bf35363ac4c78470b2d4c5c9f86eafca89a2d
MD5 5f36409c4cb3488a3ccb80f18d33e524
SHA1 64aed8d0919dbd747f4f010217b709bcf2327148
SHA512 18a3f415abff28df86c12d17c6461fd2c4acb959514896fb0dd0a4ff06e3c4074ea916d49ea023e6fc2ca2798f6a9c11dc0e10891583e2a145dc773dce110509
TLSH
T182D0950835557D450B1B11C783E303F4F34C83388D43891D4940534D3921D75B5ABAC2
MD5 SHA1 SHA512 TLSH

Submit Download

a1.mentah

Path C:\Windows\System\a1.mentah
Size 200KB
SHA256 dc5551cfae167ae89957f9121b7acda608ccfd5204b2a2167a2409660b2f4a53
MD5 d85da9aff2c21dc11bfc5ea7c58089ec
SHA1 bb1c6516e54587f5c5d522036e9fd0f5c0083787
SHA512 1bee2dfa03ab08a1192f2465d155af9a92c86f420981262329199496f8f9b9fc7136c8c809975dc4ca975ccc366252be4ee26cf0d1fd7e162b0f90ccd4c6325b
SSDEEP 3072:e+TjU5VeOBNX3sU+Jyk5nPlq3MGI6JsAY1+u5dJgzT:e+TYBNMPgkRI3+Ws51Jj+zT
TLSH
T186146C353281C033D9A715708EF8D77A5ABEB832076554CBB7E40B799F643E28A3534A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download