df825349958dd1963991dacb73f344fe4b0c2c2f8c6e56cd43f85ccbc8dcc74f

Resubmissions

24/08/2026, 12:38

260824-pt2wzagl917

11/03/2026, 14:47

260311-r51t6acv6l7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_Installer_patched.exe
Size 3.4MB
Sample260824-pt2wzagl91
SHA256 df825349958dd1963991dacb73f344fe4b0c2c2f8c6e56cd43f85ccbc8dcc74f
MD5 1a5ca53a1abbf680bd5c0f51618a4709
SHA1 f6417d460f36767b1a6d49a8477dbcb7aa5bbc5b
SHA512 61a5cf84899fbf88dffcbafc7d74d26f4bc4378ce342b5ed96b224b54ae7dfa9f7e4efb65b2f29d4727438d113cfea654d47c5a6a329ec1a1fd2abceafd4e64e
SSDEEP 49152:gJQRJQki6GqsCdtYHfmW3pLYD9WFib7nMaNsDrJzTAf2u2wn:g2R2ki6GqsCAHfmwUD9WFsQaNsDrin
TLSH
T155F52247A3E176E2D0B56332FDE732531731B4DC9B6A0F0F1688A078198F1C95AB179A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3880	Equations.exe
1480	Equations.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Setup_Installer_patched.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3880 set thread context of 1480	3880	Equations.exe	99

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
820	cmd.exe
2980	cmd.exe
1292	cmd.exe
3736	cmd.exe
972	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe
3880	Equations.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2772	1648	Setup_Installer_patched.exe	83
PID 1648 wrote to memory of 820	1648	Setup_Installer_patched.exe	85
PID 820 wrote to memory of 400	820	cmd.exe	87
PID 820 wrote to memory of 1828	820	cmd.exe	88
PID 1828 wrote to memory of 2980	1828	cmd.exe	90
PID 1828 wrote to memory of 1292	1828	cmd.exe	91
PID 1292 wrote to memory of 1464	1292	cmd.exe	92
PID 1828 wrote to memory of 3736	1828	cmd.exe	93
PID 1828 wrote to memory of 972	1828	cmd.exe	95
PID 1828 wrote to memory of 3880	1828	cmd.exe	96
PID 3880 wrote to memory of 1480	3880	Equations.exe	99
PID 3880 wrote to memory of 1480	3880	Equations.exe	99

C:\Users\Admin\AppData\Local\Temp\Setup_Installer_patched.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Installer_patched.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SYSTEM32\at.exe
  at.exe djhfjshdf937826457862398347
  2⤵
  PID:2772
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ZLWsHtn & type Recorder.wav | %comspec%
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type Recorder.wav "
    3⤵
    PID:400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\cmd.exe
      cmd /c set /p ="MZ"
      4⤵
      Executes a command shell one-liner
      PID:2980
  - - C:\Windows\system32\cmd.exe
      cmd /c findstr /V "Activation" Warming
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Windows\system32\findstr.exe
        
        findstr /V "Activation" Warming
        5⤵
        
        PID:1464
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y 542729\Equations.exe + Hop + Journalists + Celebrities 542729\Equations.exe
      4⤵
      Executes a command shell one-liner
      PID:3736
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y ..\Language.wav i
      4⤵
      Executes a command shell one-liner
      PID:972
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\542729\Equations.exe
      Equations.exe i
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\542729\Equations.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\542729\Equations.exe
        5⤵
        Executes dropped EXE
        
        PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Equations.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\542729\Equations.exe
Size 1.1MB
SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
MD5 7ac9278876c83c9b597fae68acb6fbf9
SHA1 18150c9b96bffd20c8203ff98a4fc153929bc2c9
SHA512 ddcedf90c53c148d85e36e039fc25712e242e9256ea8791d6cc15bb862b6b85a19a5583b5554f1afda9406affc4e953c4f8a2ddad6fe4d959a9fd5395dc870ee
SSDEEP 24576:r2XJHqX/Rr2YU9EPqYlsgSsJbD1tiP4+kUrp5B:yZql2nuxlRV1t1YrP
TLSH
T1B5355C0663A4419DFEA7E136960BC60BD7B17C4A07739A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Celebrities

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Celebrities
Size 330KB
SHA256 9e33aba1b013b5a5895fc4da7e21af542982f4d9d429113e239f80f3f97a9f5c
MD5 3974b7720b3f33f4ec9b21770abc667d
SHA1 b295a59baa8e01ec5e33b3b087036eba41811669
SHA512 20622597aad9c517be586d365b40ea82c6207414cccd6dc8250553da6a5551d74deebc5dfab822c2fcb003ce4594b7f88cd393815670e9036b598c3c282d47e5
SSDEEP 3072:323DjOH4IoVcfIHaAtrPzw6uId1bvhOYSQurhrRIb+c2oZxr6DWy4ZNo4TSQ:YxIoyIHddk6DPbvVGrRz3o+aBZ24
TLSH
T11974E60623A4459AFFA3F67B669EC76A06756D4E4763583F05283B3ABC306704F2C631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hop

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hop
Size 333KB
SHA256 499176e10d874eca843054f7a53f652e2a2a00ce8605177ae706c326313215c9
MD5 b5aa873ca40c646176e95ad87fa2c840
SHA1 59d1306320beadb6c25fbf8722285d8989b91a01
SHA512 4d464e5693085b0d1f2b7c41649300c8776e3758028f99666ee4adeae123b4dbd88b785976793649f2513a3b93640f4afaa69dbc399424ad3c2d7515f8bb5aad
SSDEEP 6144:C1vRBHPoonCJXJrq/hoVqkSXFsczqkC7aVUaUvi7:GZKFJXJH4zXGaVDUa7
TLSH
T141749E5566A411FED1ABD035CE5A9A0BE772744A1720BBDF03E14BB22F23BD0126F316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Journalists

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Journalists
Size 418KB
SHA256 287bd502b455ddaec45ba6e11819b5d9b022247110c6cac7ed8b282eac39c715
MD5 e9c458d062d8200b6409fffd6267ccbf
SHA1 a5cdb41fa6c87a14ddf1e1a313d6c2846b0447bf
SHA512 8e6e4bc88cb52b0a740775f961dd58c73afbb5e6319c16a181adb7e78a935ee54c96a1dbfba90200ff3b26d20ef11b1fd9e338c1493cfaa9a13719af3855fb57
SSDEEP 12288:/Rr5EXoi/azn4wYV/FfEPqG+sCilsgSyzJbD1kyLviPYowq:/Rr2YU9EPqYlsgSsJbD1tiP4q
TLSH
T166947C5A72B442DCD9AFE431C603C50BE7F1BC0647BCCA0F52A99A529F53B32692E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Language.wav

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Language.wav
Size 1.6MB
SHA256 ba82ac9b15b7b384ac235555c68e19b654648aa5f10ac375dc6efb4ba12f2f38
MD5 744213a953e3da82f0b0cbd9c3b1e132
SHA1 052096fce1bef7429a9da38bf019cdef8ead3bf9
SHA512 06d594aba12fd72268258a6fe928050417c9d2cc9a5e6f5e7fa2118fef95925fcff2259b647bdfcfc63bff801513947fcaf7798617a6a63c549bcbb39d5b0861
SSDEEP 49152:pCP7H4IyYDiODBW9W8EnMZHso8+U4EeUa:paH4ItHDBW93FZHso8C
TLSH
T1D7753376761BBC156F91F783F98B64D48CFA77E8AE3ED004AC84267D15C900E4AF424A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Recorder.wav

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Recorder.wav
Size 6KB
SHA256 d9e6777440ee7111b7257fb89431238074bf6b7aed14f87e7e4393b492f9aaf3
MD5 a528b3c85d10d884e3b9edd9a853c2ea
SHA1 d07ab549f41f82addb297ee241f0390bad4fd857
SHA512 a458fbe715da24f159fcec4515c75cf2dee7642f3d5be92a2727864571c49a988d03840eedda244a3c56b69feaadca19cb8fb2b3c338afc264fbefc549883c79
SSDEEP 192:89Cxl2Y9RY/bktrfO1WrHGsmyriar39lCEIzuTlA4WOBHI6YHShS:89el2GwktxrmspeO3zUQAGQHJ
TLSH
T149E1D7E5B9DE10A1758BFEBA05F055866337D357181D40B56E8B0BB8C20CE69233BDB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Warming

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Warming
Size 556B
SHA256 edf9694cc53cf692e4b66f972d39061e1da0f53e43ca46247d37c6b5b9ddb285
MD5 9f535d1912bd5535a4b50c83d57830f5
SHA1 0dddb118f04390cb1df58551c14d35fbe167cf28
SHA512 b28a4f1aca74a774a28b622dc12b5795eb347bf10f2a8aebab95d5c2e4b0872548421d427841b68ff87aa5a0a9c7f2c4756eb541324f57d9843c0053a7088990
TLSH
T1C5F022438AD6DCF4E00812B8C6A18855312E77D88246AF022F5E15ABAD664066BF9906
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1480-25-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/1480-26-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/1480-28-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/1480-29-0x00000170B9190000-0x00000170B91CC000-memory.dmp

Download

memory/1480-30-0x0000000000DC0000-0x0000000000DD9000-memory.dmp

Download