86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Size 6.1MB
Sample260825-cvefvadr6x
SHA256 86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847
MD5 ffd8aeb6e1857bfa1c8939797a0fcca9
SHA1 ffbd9afa966852797ccb39044c50a8d5d0a060d2
SHA512 1513f7e31f44ea16bf7d5fdc16dc56526de625acd51cb3ed8eaa523b7f87bfe5a5b1271dc9788e685c044480f50d477a4af80022035409338b288ab9edbacb84
SSDEEP 98304:dHMRrb9qYxRNIwkWxm35RnaYyGFe0KE9DEBv204ezsGD/lrf7OlRCrPTZiE4g:aRrRqUNIwkWxcIGOv2QwQp4Crdt4g
TLSH
T10656330271C8C9F6C12318339199BB25B97C7D705EB68BCBC35520CC6E671D1AB32AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3544	AFUWINx64.exe
556	amigendrv64.sys

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5668	powershell.exe
5232	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
372	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5668	powershell.exe
5668	powershell.exe
5232	powershell.exe
5232	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
828	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe
Token: 33	5232	powershell.exe
Token: 34	5232	powershell.exe
Token: 35	5232	powershell.exe
Token: 36	5232	powershell.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe
Token: 33	5232	powershell.exe
Token: 34	5232	powershell.exe
Token: 35	5232	powershell.exe
Token: 36	5232	powershell.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe
Token: 33	5232	powershell.exe
Token: 34	5232	powershell.exe
Token: 35	5232	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 372	1440	86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe	89
PID 372 wrote to memory of 5668	372	cmd.exe	91
PID 372 wrote to memory of 4168	372	cmd.exe	92
PID 372 wrote to memory of 5232	372	cmd.exe	94
PID 372 wrote to memory of 3544	372	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe
"C:\Users\Admin\AppData\Local\Temp\86c15a8dd4c8ef6d5037ed7f86e6c0afc06ae0eb5838f1e33fe84a081dfec847.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\BIOS_Update.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -command Get-WmiObject -Class win32_bios
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- - C:\Windows\SysWOW64\find.exe
    find /i "4.30"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Suspend-BitLocker -MountPoint 'C:' -RebootCount 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\AFUWINx64.exe
    AFUWINx64.EXE AME10V4.30.bin /P /B /K /SHUTDOWN
    3⤵
    - Executes dropped EXE
    PID:3544

C:\Users\Admin\AppData\Local\Temp\RarSFX0\amigendrv64.sys
C:\Users\Admin\AppData\Local\Temp\RarSFX0\amigendrv64.sys
1⤵
- Executes dropped EXE
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 3af002b562b55f196d7dc86d5540d0fdcc5c861c63c000f7ff229b07bf17698b
MD5 628769bfcaa17c391ac148766a289376
SHA1 c600d443ea55da534c2c6a631d5f258c57fc6e4c
SHA512 c0161a506d6dd80a9c96846365d5548a652c4b8b818b5d5fac4bd71545eca838b77ba8e990ba457e8072727607f9c538403d0122e44889c7a59ab22f8dc6143b
SSDEEP 384:g1TBRGMO1icGW14bjCv/Kh+geysdr2PnmIAXr4B+lWo2tzKwUvYbhNogcIrZyJ79:MTaM6mWinCv/Kh+td6OIAXrq+mVrbhNu
TLSH
T13382B858212F5DC7D89222B0509602E7FBE0D0CEDB3651D8BF2BCA2F5C91E7A5F50520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AFUWINx64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AFUWINx64.exe
Size 1.1MB
SHA256 5546d46684d7b269de49ac0b6f209d3cbea53c6ac3507a67f162eed812abfea8
MD5 e3fc5237328f26a88e06a035a0b9e6bb
SHA1 f1c33c562286bf685e5addff378f76f240e478bb
SHA512 3bd73269f8529e78d4e7ad624f6abec5ac4bb992aac02352b0aa798bf371e51a4d5ede00c00f8ae3c5f6ab6722f2de48925ec0e1852111ef86fb7d9b8d0efe03
SSDEEP 24576:fZuX0nhSbV8qIwMyoWInaqCGQsE6Xr+Rbx02o:4X0u8OMyzInaqCGA68F
TLSH
T10735294BE7E721E9D876D1388593323AF9B0785483349FD793844A1A0B32BF4A63E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BIOS_Update.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BIOS_Update.bat
Size 301B
SHA256 986bfb28bca50f24280a538df50453bd987678bb1496ef49c7c8e083a1cadc27
MD5 ea10188e3b46fb90afccc56e108e20f6
SHA1 527c520aab5026f60e191fb4e8bb97910f2852c2
SHA512 f6fe47ad512509f207e9f4847b6ff1004022168adfd4c732a8b2e7d3e72fc8e36ee3f36384cbf88ca4703b955254e2daaf97c54bbf417ed1541a15270c8f77b5
TLSH
T113E07D333197A0CE9E4F68D2944C4A116D914A4C25C65743F0F4A6C9090208DE83064C
MD5 SHA1 SHA512 TLSH

Submit Download

amigendrv64.sys

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\amigendrv64.sys
Size 36KB
SHA256 749ce31af74d2fa40b7b3f1ce3d7f0fa63934e854bf5bd0f88fa6f79c3a2003f
MD5 0ac8bc34e0d2945d9c771ceb04c70900
SHA1 09947d49fc8ce5270dc26da70f764473014e572b
SHA512 6931726ac10d364b443127da3f2e8bdae7fb7c6f3c2af9972ef28cf836ed9224bbf70003183440a28bafcaf62297dcb677c49391099dc0c7ce677ef6b33fdcc9
SSDEEP 768:1m+8+TKluoYFTa4rN3iPmbLm+cj8e9zL:1mV+kuoOu6B7e+7az
TLSH
T121037DC277382092ED8B893492D9DA736CB4B3D12B1196DB11B0C1A49D727D2AB3916F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_swwnouww.plv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swwnouww.plv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5232-45-0x0000000007960000-0x0000000007FDC000-memory.dmp

Download

memory/5232-36-0x0000000005B50000-0x0000000005EAB000-memory.dmp

Download

memory/5232-46-0x00000000073A0000-0x00000000073AA000-memory.dmp

Download

memory/5232-44-0x0000000007220000-0x00000000072C3000-memory.dmp

Download

memory/5232-40-0x000000006FC20000-0x000000006FC6C000-memory.dmp

Download

memory/5232-43-0x0000000007180000-0x00000000071A0000-memory.dmp

Download

memory/5232-47-0x0000000007570000-0x000000000759A000-memory.dmp

Download

memory/5232-39-0x00000000071E0000-0x0000000007216000-memory.dmp

Download

memory/5232-38-0x0000000006000000-0x000000000604C000-memory.dmp

Download

memory/5232-48-0x00000000075B0000-0x00000000075D4000-memory.dmp

Download

memory/5668-21-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/5668-26-0x0000000006010000-0x000000000602E000-memory.dmp

Download

memory/5668-31-0x00000000077D0000-0x0000000007D8A000-memory.dmp

Download

memory/5668-30-0x00000000071E0000-0x0000000007202000-memory.dmp

Download

memory/5668-29-0x0000000006530000-0x000000000654A000-memory.dmp

Download

memory/5668-28-0x0000000006590000-0x0000000006626000-memory.dmp

Download

memory/5668-27-0x0000000006050000-0x000000000609C000-memory.dmp

Download

memory/5668-33-0x0000000073110000-0x00000000738CC000-memory.dmp

Download

memory/5668-25-0x0000000005B70000-0x0000000005ECB000-memory.dmp

Download

memory/5668-22-0x0000000005B00000-0x0000000005B66000-memory.dmp

Download

memory/5668-20-0x0000000005330000-0x0000000005352000-memory.dmp

Download

memory/5668-19-0x0000000073110000-0x00000000738CC000-memory.dmp

Download

memory/5668-17-0x00000000053D0000-0x0000000005A1A000-memory.dmp

Download

memory/5668-18-0x0000000073110000-0x00000000738CC000-memory.dmp

Download

memory/5668-16-0x0000000002B20000-0x0000000002B56000-memory.dmp

Download

memory/5668-15-0x0000000073122000-0x0000000073123000-memory.dmp

Download