Overview

overview

7

Static

static

3

filefy-release.exe

windows10-2004-x64

filefy-release.exe

windows11-ltsc_2024-x64

Resubmissions

13/08/2026, 07:54

260813-jrm25sdl7t3

13/08/2026, 07:37

260813-jf9rrstsft7

Analysis

  • user interaction
    yes
  • max time kernel
    312s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    filefy-release.exe
  • Size 95.8MB
  • Sample260813-jf9rrstsft
  • SHA256 8235afd06fb2b5dbbfc2f1d2ea8db1526f78a0402282125d05db691336253bec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasionexecutionpersistence

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\filefy-release.exe
    "C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Users\Admin\AppData\Local\Temp\filefy-release.exe
      "C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"
      2⤵
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4100
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4280
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4688
    • C:\Users\Admin\AppData\Local\Temp\filefy-release.exe
      "C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3896
      • C:\Users\Admin\AppData\Local\Temp\filefy-release.exe
        "C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"
        2⤵
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          3⤵
          • Executes a command shell one-liner
          PID:2448
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c taskkill /F /IM svchost.exe
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2988
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM svchost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2876
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x494 0x2e8
      1⤵
        PID:4772
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4928

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_bz2.pyd
            • Size 84KB
            • SHA256 9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_ctypes.pyd
            • Size 123KB
            • SHA256 1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_hashlib.pyd
            • Size 64KB
            • SHA256 7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_lzma.pyd
            • Size 159KB
            • SHA256 4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_socket.pyd
            • Size 78KB
            • SHA256 241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_ssl.pyd
            • Size 151KB
            • SHA256 31c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\base_library.zip
            • Size 764KB
            • SHA256 ab34fb921a79e9b635d5dd17f3c1b24456d07e4165defdb3c1d047eff0efdb48
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libopenblas.XWYDX2IKJW2NMTWSFYNGFUWKQU3LYTCZ.gfortran-win_amd64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\libopenblas.XWYDX2IKJW2NMTWSFYNGFUWKQU3LYTCZ.gfortran-win_amd64.dll
            • Size 32.9MB
            • SHA256 1b5a211815d41b2d08a38c44fea9fb8977bae24948502ed92362fda5500ff6ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiarray_tests.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\core\_multiarray_tests.cp39-win_amd64.pyd
            • Size 111KB
            • SHA256 80145a27e3bdb7956bb07ae7fe607fe1ee0a99415120fa03e04e5a8a78369583
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiarray_umath.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\core\_multiarray_umath.cp39-win_amd64.pyd
            • Size 2.8MB
            • SHA256 bd7d9fa3ae229d3feba0a6928864a889bd18e79178bd175831c8b1c15896b909
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _pocketfft_internal.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\fft\_pocketfft_internal.cp39-win_amd64.pyd
            • Size 110KB
            • SHA256 a9867e8f5fb3ea63452b5eb0e8bcddab66aaad2c78f8afc181f9008300d4439f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _umath_linalg.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\linalg\_umath_linalg.cp39-win_amd64.pyd
            • Size 152KB
            • SHA256 693faeb641dd31d6a8bae75f39ff8247b2f78674085af9f498fed5781d3f3442
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lapack_lite.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\linalg\lapack_lite.cp39-win_amd64.pyd
            • Size 21KB
            • SHA256 f67a41070f53c36cb3fd6ce63e6a4bea2188d2b2e4fbc781d217b659d6328268
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bounded_integers.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\_bounded_integers.cp39-win_amd64.pyd
            • Size 240KB
            • SHA256 0da710a2f2715665f77b19ad9c323faea2f6ee46bd5cf55198a7b4a29ee3aeef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _common.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\_common.cp39-win_amd64.pyd
            • Size 178KB
            • SHA256 0a265cb553a442e0263c50f6e16e275610c70d147ef67018a6d36f9fae9ea852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _mt19937.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\_mt19937.cp39-win_amd64.pyd
            • Size 77KB
            • SHA256 cba3580cc5a75a8f9f2d9625c41f06add1bc695be682cfeba8c746f6cbc24adf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _pcg64.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\_pcg64.cp39-win_amd64.pyd
            • Size 84KB
            • SHA256 27de083773c95c8746f8e850ec915add871b2efad3d639ef8139a66ff12fbec0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _philox.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\_philox.cp39-win_amd64.pyd
            • Size 70KB
            • SHA256 9632299af99b18178e330f72c274d84ecb70fb66ecb7f11809536eb30e13e787
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sfc64.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\_sfc64.cp39-win_amd64.pyd
            • Size 52KB
            • SHA256 bb2e8adb9393d1cb4278bf4f7d1c2d15f21f728ac5879d0393a7940ef957a553
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bit_generator.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\bit_generator.cp39-win_amd64.pyd
            • Size 148KB
            • SHA256 f0fa06345b9ff035b0f051b857abc83ac99778d2a563db56b384602fd3375028
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mtrand.cp39-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\numpy\random\mtrand.cp39-win_amd64.pyd
            • Size 570KB
            • SHA256 06c5424b5317301684f00beb8d9b2056720a7d3e8c3331a1ce2ff5138637f4ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\pyexpat.pyd
            • Size 199KB
            • SHA256 ab0814b19fd6b10d2729a907cf449f8a858a42b3f1288fb1c93b62950059295d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\python3.dll
            • Size 58KB
            • SHA256 84cb29052734ec4ad5d0eac8a9156202a2077ee9bd43cabc68e44ee22a74910a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python39.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\python39.dll
            • Size 4.3MB
            • SHA256 e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pythoncom39.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\pythoncom39.dll
            • Size 543KB
            • SHA256 bceebaba98080a11b7eb83c8d43357a8b3387eeb03f40acccd834cf8f47316a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes39.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\pywintypes39.dll
            • Size 139KB
            • SHA256 4ece6771f1206b99dba4e5cf988051472f530bf90bb3114d3fd7377b3f34dfa6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\select.pyd
            • Size 28KB
            • SHA256 5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\ucrtbase.dll
            • Size 986KB
            • SHA256 ace7a1a8dc840c1d082e955f48b63fa29cfa30f7920b7df8d5dad05280d433a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            INSTALLER
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\wheel-0.37.0.dist-info\INSTALLER
            • Size 4B
            • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
            • MD5 SHA1 SHA512
            Submit Download

            win32api.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\win32api.pyd
            • Size 131KB
            • SHA256 b541e3d53be2db7da8e1c16496958fc6c8034ccc8ac763fd00e4a6fbd1162944
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            screen.png
            • Path C:\Users\Admin\AppData\Roaming\screen.png
            • Size 434KB
            • SHA256 58c146884a069904241b0936d612cd85db9134bed915640b5d4e413ac0e5ca25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1676-2843-0x0000000067780000-0x0000000069533000-memory.dmp
            Download

            memory/1676-2731-0x0000022E9A8B0000-0x0000022E9AD41000-memory.dmp
            Download

            memory/1676-2730-0x0000000067780000-0x0000000069533000-memory.dmp
            Download

            memory/4100-1404-0x0000000067780000-0x0000000069533000-memory.dmp
            Download

            memory/4100-1389-0x0000000067780000-0x0000000069533000-memory.dmp
            Download

            memory/4928-2776-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2777-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2778-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2788-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2787-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2786-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2785-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2784-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2783-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download

            memory/4928-2782-0x0000024E61D50000-0x0000024E61D51000-memory.dmp
            Download