Analysis
- user interaction
yes - max time kernel
120s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
- submitted
13/08/2026, 07:37
Errors
General
- Target filefy-release.exe
- Size 95.8MB
- Sample260813-jf9rrstsft
- SHA256 8235afd06fb2b5dbbfc2f1d2ea8db1526f78a0402282125d05db691336253bec
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"C:\Users\Admin\AppData\Local\Temp\filefy-release.exe"2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /F /IM svchost.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM svchost.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
libopenblas.XWYDX2IKJW2NMTWSFYNGFUWKQU3LYTCZ.gfortran-win_amd64.dll
libssl-1_1.dll
_multiarray_tests.cp39-win_amd64.pyd
_multiarray_umath.cp39-win_amd64.pyd
_pocketfft_internal.cp39-win_amd64.pyd
_umath_linalg.cp39-win_amd64.pyd
lapack_lite.cp39-win_amd64.pyd
_bounded_integers.cp39-win_amd64.pyd
_common.cp39-win_amd64.pyd
_mt19937.cp39-win_amd64.pyd
_pcg64.cp39-win_amd64.pyd
_philox.cp39-win_amd64.pyd
bit_generator.cp39-win_amd64.pyd
mtrand.cp39-win_amd64.pyd
pyexpat.pyd
python3.dll
python39.dll
pythoncom39.dll
pywintypes39.dll
select.pyd
ucrtbase.dll
INSTALLER
win32api.pyd
screen.png
memory/1732-1389-0x00007FFA90340000-0x00007FFA9080D000-memory.dmp
memory/1732-1390-0x00007FFA8FDF0000-0x00007FFA90331000-memory.dmp
memory/1732-1391-0x0000000067780000-0x0000000069533000-memory.dmp
memory/1732-1399-0x000001A6CADD0000-0x000001A6CADE0000-memory.dmp
memory/1732-1546-0x0000000067780000-0x0000000069533000-memory.dmp