Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 10:48
General
- Target appinst_up007.exe
- Size 43.4MB
- Sample260820-mwdwtavepd
- SHA256 f7248283f37c09ece046aa11873ec67d4d9c6922ee12420e9161a34398214430
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Drops file in System32 directory 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\appinst_up007.exe"C:\Users\Admin\AppData\Local\Temp\appinst_up007.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\iCD36z\qA1Kz2.exeC:\Users\Public\iCD36z\qA1Kz2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\iCD36z\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\iCD36z\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
1BA79029EC3FFD076F5DAC2F70A18685
1BA79029EC3FFD076F5DAC2F70A18685
UxEnhance64.dll
adoresd.dat
msadox.tb
qA1Kz2.exe
memory/1116-545-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-559-0x000002A0DBCF0000-0x000002A0DBD7A000-memory.dmp
memory/1116-533-0x00007FFB850F0000-0x00007FFB8560E000-memory.dmp
memory/1116-532-0x00007FFBA2B10000-0x00007FFBA2B12000-memory.dmp
memory/1116-567-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-538-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-565-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-541-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-557-0x000002A0DBC10000-0x000002A0DBC5E000-memory.dmp
memory/1116-540-0x00007FFBA2B20000-0x00007FFBA2B22000-memory.dmp
memory/1116-546-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-547-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-548-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-552-0x000002A0DC730000-0x000002A0DCFC1000-memory.dmp
memory/1116-561-0x000002A0DBCF0000-0x000002A0DBD7A000-memory.dmp
memory/1116-560-0x000002A0DBCF0000-0x000002A0DBD7A000-memory.dmp
memory/1116-558-0x000002A0DBCF0000-0x000002A0DBD7A000-memory.dmp
memory/4800-527-0x00007FFB93E70000-0x00007FFB93E80000-memory.dmp
memory/4800-0-0x00000000001E0000-0x00000000001EE000-memory.dmp
memory/4800-504-0x00007FFB93E70000-0x00007FFB93E80000-memory.dmp
memory/4800-526-0x00000000001E0000-0x00000000001EE000-memory.dmp
memory/4800-2-0x00000000001F0000-0x00000000001FC000-memory.dmp
memory/4800-1-0x00000000001E0000-0x00000000001EE000-memory.dmp