d95ea9366ce5c6de2c79ce321eaaebef35f1f4e9f3eea54d1d3884d597a127c2

Analysis

max time kernel
4s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
almk h2acked.exe
Size 3.2MB
Sample260825-mlvrkshj2z
SHA256 d95ea9366ce5c6de2c79ce321eaaebef35f1f4e9f3eea54d1d3884d597a127c2
MD5 b179aaf8f8eaa9c764f79686f058deb5
SHA1 a3e7906bdfbf0c9ded05e81ed5408aaebbc37a9b
SHA512 396d2582ca244df5fe5a790698b721b74246dd3caa385270af5df6938f6e6718ea6c46f21c593d69e93c361f4973b15aa20695c108bfa9b3d350f015185acb39
SSDEEP 49152:xv7JTHkNRg6thCr/2yU1dLU1o+NWT7uDU2AM9Fw7MbcJv4NoQ45XEWkrwRd66bKr:
TLSH
T11BF5E42229EF509DB3A39AAC5FC8F8BF9959F673160E30F620711B46C722D818D52375
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
3968	nasm.exe

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	almk h2acked.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nasm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmp\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BD21D50-EC42-11CE-9E0D-00AA006002F3}\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{978C9E23-D4B0-11CE-BF2D-00AA003F40D0}\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020820-0000-0000-C000-000000000046}\Verb\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F058-0000-0000-C000-000000000046}\ToolboxBitmap32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{048EB43E-2059-422F-95E0-557DA96038AF}\Verb	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.drf\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppXak1hygz1tpjjnxhr1pwtcgnkpr24r5e7\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msrcincident	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.epub	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rqy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sol	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020803-0000-0000-C000-000000000046}\DataFormats	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.csv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dcs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllSyncRootObjects\shell\PauseSync\Command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsdm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppXb2m1ge7jcjp5f6g67dvz4x2sd3wwm24r\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppXc9bt84rtp5qvmzkascgmn4pfe2g3hxeg\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\Conversion\Readable\Main	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64818D11-4F9B-11CF-86EA-00AA00B929E8}\DataFormats\GetSet\1	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vhd	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppX40nx3azkcssh7ybcbzzjpgf1mg561cyz\Shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020811-0000-0000-C000-000000000046}\NotInsertable	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020832-0000-0000-C000-000000000046}\DataFormats\GetSet\4	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BD21D60-EC42-11CE-9E0D-00AA006002F3}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.crt	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.it	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\OpenWithList\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vqf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\msiexec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F056-0000-0000-C000-000000000046}\LocalServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ms-windows-store-license	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pfm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CleanPC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020803-0000-0000-C000-000000000046}\DataFormats\GetSet\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020811-0000-0000-C000-000000000046}\AuxUserType	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5512D110-5CC6-11CF-8D67-00AA00BDCE1D}\ToolboxBitmap32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9432194C-DF54-4824-8E24-B013BF2B90E3}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C18EAE4-BC25-4134-B7DF-1ECA1337DDDC}\MiscStatus	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020821-0000-0000-C000-000000000046}\InprocHandler32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2260	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 5880	1340	almk h2acked.exe	89
PID 1340 wrote to memory of 3968	1340	almk h2acked.exe	91
PID 5880 wrote to memory of 1260	5880	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\almk h2acked.exe
"C:\Users\Admin\AppData\Local\Temp\almk h2acked.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\system32\reg.exe
    reg delete HKCR /f
    3⤵
    - Modifies system executable filetype association
    - Modifies registry class
    PID:1260
- C:\Users\Admin\AppData\Local\Temp\nasm.exe
  "nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbr_temp.asm

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.asm
Size 541B
SHA256 4c1766d9cc1c70e3fe4d1e1e415806d1fed2595c416e818cab633ee3f5ffec17
MD5 3c1773de62f3e857e2d8acdef70a275d
SHA1 385a867d552dfdce16ad2322e9ad56135416c563
SHA512 3b465a694f4db23ed511f9b8dac8a7b1c41609689117df990d4da00fe0acd7021a4d116b8b78f38838797936be87b099dfc9a6619de2332ce0a8a96ab4192abd
TLSH
T12EF0274D1DC25BD916FF4599EDC17E0BE2CD821F819A2C25B31C4737CFB65A025602AC
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.bin

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.bin
Size 512B
SHA256 d797c1403c70b8c1c30edae7f20d5c41c64b2ccd1b51a87858604f9ea4d26151
MD5 cdf1f302d95949455fb9ce371d1024ae
SHA1 9a2616fc2ec0439b4d89ca30224488603eddf313
SHA512 dad21df65219deef243458c0cea5572627f7e23c4c243d15124f1d6c06977eff2748447ce1ffee8a0e59bf89307eb37a19d3cd5fcaa8a717fce20855136a8ae1
TLSH
T1A2F0228E020203BCC02C00303830800800F800B0280EE00F88C30C238E00023BF38082
MD5 SHA1 SHA512 TLSH

Submit Download

nasm.exe

Path C:\Users\Admin\AppData\Local\Temp\nasm.exe
Size 1.2MB
SHA256 a4735165141570d966b577d594c0541c29baed4978078c1c7237b855f8592a87
MD5 2f17bab79b9e5caa79c4f493a18fb06c
SHA1 f3eb8a09529b82fc08e919517e098644ddc01004
SHA512 37c62999e11f3a44c02bad2ad9941213c0264312f228de32466818ec84d745312f941f4adf6e4bf3f49d5d91e8df56dbf39b7966ed8d4b214b484c93635ca154
SSDEEP 24576:2zYx3PgYWwocek/r2+AAYNh3tBULAkS7Le:2koA/qhlL3rmzS7
TLSH
T1A4459422A687D9A3C40E1270DDC7D32977B2E0F46B368B87BA4C97AF7D213A11CC5546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-5-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-3-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-1-0x0000000000420000-0x0000000000762000-memory.dmp

Download

memory/1340-6-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-10-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-11-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-12-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-13-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-14-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-4-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-33-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-2-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-0-0x00007FF916AFF000-0x00007FF916B00000-memory.dmp

Download

memory/1340-30-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-31-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/1340-32-0x00007FF916970000-0x00007FF917314000-memory.dmp

Download

memory/3968-28-0x0000000000400000-0x0000000000539000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads