7390eb3dfd3a40787c72a8da8172ca6b47eef7f1426bb05437006a059dbd1036

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ประกาศปรับตำแหน่งและเปลี่ยนแปลงเง�.exe
Size 1.8MB
Sample260810-lewvmazyas
SHA256 7390eb3dfd3a40787c72a8da8172ca6b47eef7f1426bb05437006a059dbd1036
MD5 998b324e393ae3921a7efe1b77b5d1cc
SHA1 2b4deeb0c6fe3603fe5a67e8c45d020f6eb72b63
SHA512 3695eba8d66b07d70010ae6b064dafc37a1c999f81ee939ce6cd3f1b54b6657d8cc961b58c9b8ba31f5c2ed27169178031de647b90b561cfc8cf9c2fa5681796
SSDEEP 49152:tOCz2umklwAnhMekOybldJ3wzqEzZrLEy/jB/sN4X:v2umkThwxldJ3wuEzZHEwT
TLSH
T13395236AB7A851FAD06BC07AC9E04702BB733464176087EF07918B766F331C19C79B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4760	TGFile.exe

Loads dropped DLL 5 IoCs

pid	Process
4760	TGFile.exe
4760	TGFile.exe
4760	TGFile.exe
4760	TGFile.exe
4760	TGFile.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5220	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5028	wscript.exe
1212	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	ประกาศปรับตำแหน่งและเปลี่ยนแปลงเง�.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64	TGFile.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib	TGFile.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}	TGFile.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1	TGFile.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0	TGFile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64\ = "script:C:\\ProgramLog\\Windows\\AppData\\Local\\Microsoft\\Log\\log.s"	TGFile.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5044	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5220	powershell.exe
5220	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 5044	4376	ประกาศปรับตำแหน่งและเปลี่ยนแปลงเง�.exe	90
PID 5028 wrote to memory of 1212	5028	wscript.exe	93
PID 1212 wrote to memory of 5220	1212	wscript.exe	94
PID 1212 wrote to memory of 4760	1212	wscript.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ประกาศปรับตำแหน่งและเปลี่ยนแปลงเง�.exe
"C:\Users\Admin\AppData\Local\Temp\ประกาศปรับตำแหน่งและเปลี่ยนแปลงเง�.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramLog\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5044

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" C:\ProgramLog\run.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\ProgramLog\run.vbs" hide
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Expand-Archive -Force "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\set.zip" -DestinationPath "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5220
- - C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe
    "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe" "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\4.lua"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:4760

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4.lua

Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\4.lua
Size 5KB
SHA256 b20d8e55acd3726b4fb1e485ed15827dd25ede2c0e1db7cdd17390f39866a63f
MD5 74a7b6a3349698cfeb2620db1892803e
SHA1 6a734771cc4015399cb8e85fe8dacbb4367a4e44
SHA512 181c0e185dddc4c49ad4b83f93464a8be76f46bbdbd29e722073be8e7b935787b6304e162b79de8c945283747239b1a4b520695c6e0f198428ccd87420e61629
SSDEEP 96:2ESN7pIrohqFcUyGFxstpXKID9DNpbYbm65nbnrnWV/m8EYT+2r5/Gni4XRgZoPt:fMp65FHkhQprWY8aI5unjXyoB5zudIPr
TLSH
T156B19843948B82F1E83621A9DE069410E84A5357267DD2123CBEC2463F397DCE0F5EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TGFile.exe

Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe
Size 27KB
SHA256 09cd30b1b25da3ff6661be589d5c31460e51e9ee8e7925df37826456bb8da2bc
MD5 f1e0d6013f5117046c1b1a048166d225
SHA1 96bd05457588618be0494ec32c58113443d61459
SHA512 7544dc4ead8dd9e6b58ab79da62e89afc3c98b73c1562c9053bacbe600b08f4457fbd22f01d7e127960c0d0b4ba5cd8dc375e33f25d4044fc8969c2761b925e8
SSDEEP 384:TU0xnb4moWtuXDSaa0RXDvuSOf050DcZIYiOJ0Pi/ay8RbmL4nNyNa:RxnbvVu2KRXD2SOMOLYibP6a5ALq
TLSH
T163C28E6A4B651899D617E038F0901617E9B0B2721BA091EF7308CB948F533D3BFBE316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libepsbase.dll

Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\libepsbase.dll
Size 262KB
SHA256 5a2fdc4111ce15f24e9283eb6b135046fdf47b14b193646b61798b72ce3c687c
MD5 11341b8b8c20a2c3a7f2d3b80899cd0f
SHA1 b27f270209693de75071003a4a60795bb224688d
SHA512 9ca1e79949f6c1960ee2cc25a8b8014e6433b9bf6d852600c31cc2c200f7d7d3b679c57b51b24265a1a94f287f201402c66a3f1eabc8c822430150a08dfdf448
SSDEEP 6144:rVNcb9gwAGl+qDW/lBy5N5PZX9V50DErkkysOYOQE:DcblAGl+D/lB1DBNsOtZ
TLSH
T187449E5AB2640CE8E637B079C566C207F2F27C1D8390E7DF4A60A5541773AE2727D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua51.dll

Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\lua51.dll
Size 476KB
SHA256 355e34c71f6b3178092862529382566088aa80abeba67eb09fdf47852889b612
MD5 09a36334668b5891b1a627e5e8b8203a
SHA1 bfc2eb1d84bd250cc0f8e86e0553d0f89bf1ae8b
SHA512 fef60f7e8b6a608587de20b931fc0f23c5c090a01d8dc98a33f55235798936db3e72edf42e7429be90d51fc4a9370d1ac8a21cc50e4aac661f4ce15b8798881e
SSDEEP 6144:qrPB2x/Z4epBQFAPLVV+iJP/z3qGTR8LPfiK7WBOrqVt/GnNcjnudD1CpZUqWe72:ZDBA+2XiKaB9Ge997L1DCr+kBV8s
TLSH
T1D7A45B49E6740669C5AB807889535D0FD3B6384507A09BDF07E4BBA72B33FD9263B324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\msvcr100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH