2fd9c70e9f85afc6bdb5baeaa833332bffe5f7307db4abc1de808641b301e655

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fix.exe
Size 1.1MB
Sample260817-keclbaac85
SHA256 2fd9c70e9f85afc6bdb5baeaa833332bffe5f7307db4abc1de808641b301e655
MD5 2b14797a411cc72dd8fadec4508c8317
SHA1 f8442cea55dd760bc59f17f088da27ffd2e85b86
SHA512 49da5236f7193c9ec29ab7ca2b971bc0677205d8caeef7d789f7a4569bddeff3914ab70d1ef38438a82880a2be7ec60c98eaaaefc05f9b560cd5d139ff21c9a4
SSDEEP 24576:A2drl6xgP2VZlfLW5ByvJCD/jhs7lMWRQB:NdJ6yu3RQBUJG2hDc
TLSH
T164350257B7A155BCE159C07883578673B633B8CE02317DBF12E886302E29E966F1C729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5012	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5312	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5032	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5012	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 5032	5672	Fix.exe	89
PID 5032 wrote to memory of 5012	5032	cmd.exe	91
PID 5032 wrote to memory of 5312	5032	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Fix.exe
"C:\Users\Admin\AppData\Local\Temp\Fix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /Q /D /C C:\Users\Admin\AppData\Local\Temp\cafebabefca4d3d3.cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$c = Get-Content 'C:\Users\Admin\AppData\Local\Temp\cafebabefca4d3d3.cmd' -Raw; $s = $c.IndexOf('-----BEGIN-----') + 15; $e = $c.IndexOf('-----END-----'); $p = $c.Substring($s, $e - $s).Trim(); Set-Content 'C:\Users\Admin\AppData\Local\Temp\payload.b64' $p -Encoding ASCII"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\payload.b64" "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cafebabefca4d3d3.cmd

Path C:\Users\Admin\AppData\Local\Temp\cafebabefca4d3d3.cmd
Size 792KB
SHA256 c321a93da1730d791c1d805465465237e8cf623c6f5846189fe127a7c2abd974
MD5 7082a63a95d6a09def56249453c9044b
SHA1 682a76a87a0fa0c4090a95fb6768b736f2a2d096
SHA512 b1ab97b754dafe090ead8cf1097b61f4813324451af3de1e54f7bb70c56249528b7d04b64bfa13083766b5c2e427571277eca860b592861a99e7d3f6b6f88df5
SSDEEP 12288:wDE1aGgt+gBAd+txZ1btQ/byeD81AERPwtY/HKGL6a9EO7aoXSwfNBnbltinnPvt:ST44AQx1bkbmIGCXoSyNBR4nPvt
TLSH
T1FE0522375F52FCC75B3A6810B0553E794D102A4793A617E5FAC8294F28BBA01CF1F6A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.b64

Path C:\Users\Admin\AppData\Local\Temp\payload.b64
Size 28B
SHA256 0672d9adf283b31a6e5dfa35e84ba706dcd1c1e4bae7c7e88781dee25b7ac57b
MD5 8bfaff11b779ccd7b4a5c5567529bf6f
SHA1 762c5820460856e4abee91a1e387f135f9dbe42d
SHA512 47c6d47f3003ad3555708655309d77497a46b5d82e72a4abc0a99f9fc9059442132f9b3e8172f2c1d99fde4f880d7503fd4111208379a94183be53871f9d2dbc
MD5 SHA1 SHA512

Submit Download

memory/5012-11-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-12-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-7-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-8-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-9-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-10-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-5-0x000002C52D9B0000-0x000002C52D9D2000-memory.dmp

Download

memory/5012-6-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-13-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-14-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-15-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-16-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-19-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5012-2-0x00007FFE8B8FF000-0x00007FFE8B900000-memory.dmp

Download

memory/5672-21-0x00007FF6AA310000-0x00007FF6AA367000-memory.dmp

Download

memory/5672-22-0x00007FF6AA310000-0x00007FF6AA367000-memory.dmp

Download