59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38.exe
Size 1.5MB
Sample260831-fe873axtft
SHA256 59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38
MD5 25a4b6b9e328601965dc166357508daf
SHA1 0fd0a981edddb2cad09d917e7f8c005a6a6bdf25
SHA512 8eea9497342a01f95451c994e700e215bba1ac381536b881d60a8e3f55feda91b5ab790790209b9022162e9520218f7d46081ab9cca3983aff93a4909e81f1fe
SSDEEP 49152:nXr8WkDUmozjFolLvzK/eAN9B/zmYaMjdmsk8iEXF8:78WLmozjilHRkr3a6p1F8
TLSH
T16D75234A67E554B5E0B523B6A1F24343AE72F8712B3846FF22C8D27E19335D0A634B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1228	Widespread.exe

Executes dropped EXE 1 IoCs

pid	Process
1228	Widespread.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2196	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Widespread.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4576	schtasks.exe
4696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe
1228	Widespread.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4140	5116	59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38.exe	84
PID 5116 wrote to memory of 2196	5116	59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38.exe	86
PID 2196 wrote to memory of 4072	2196	cmd.exe	88
PID 4072 wrote to memory of 2740	4072	cmd.exe	90
PID 4072 wrote to memory of 1228	4072	cmd.exe	91
PID 1228 wrote to memory of 4576	1228	Widespread.exe	92
PID 1228 wrote to memory of 4696	1228	Widespread.exe	94

C:\Users\Admin\AppData\Local\Temp\59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38.exe
"C:\Users\Admin\AppData\Local\Temp\59f4f6f6b7e5e1deb590efa6e3818dcfe2f6099ee7e047c075aa55b6161d3d38.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SYSTEM32\makecab.exe
  makecab.exe /jkdhfihu3478yr983834803
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\cmd.exe
  cmd /v /c Set HfbtWaYqh=cmd & !HfbtWaYqh! < Herself.mov
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\system32\findstr.exe
      findstr /V "Accepting" Block
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\91760\Widespread.exe
      Widespread.exe W
      4⤵
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Smoke" /tr " rundll32.exe pcwutl.dll,LaunchApplication 'C:\Users\Admin\AppData\Local\VeloTech Labs\VeloBoost.lnk'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4576
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "VeloBoost" /tr " rundll32.exe pcwutl.dll,LaunchApplication 'C:\Users\Admin\AppData\Local\VeloTech Labs\VeloBoost.lnk'" /sc onlogon /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4696

C:\Windows\system32\rundll32.exe
rundll32.exe
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\91760\W
Size 943KB
SHA256 a7fce23629bddcf64a617a190ce431af78ab29e1a5b7b5ebde4499733a1a04cd
MD5 2a1a4edbefee39e3a2ad317e3dc09bca
SHA1 5d39b75acaa5d7fa60627e1f103955bac7991ad8
SHA512 1ec1970a95075d18bcccbd3182d1d20091c8f4eb2ea5d5f219aecf840fed8015512964b7ca4240f201eb92c02e3e4f8438c789c571a53213cd90b65061dc8e08
SSDEEP 24576:BEjas7LlpBu61DkIz2LzwspavB3XZFU9NK/WVq2ERCStVjL0:emsV3oI8F8vB5F6NK/IwsS7jL0
TLSH
T13F253311FA4D6E7DF99C60DBF706AB419CAC7A6223DCD5BE72C6C70900738A73A20255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Widespread.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\91760\Widespread.exe
Size 957KB
SHA256 02862289fbed08ab4a6e0cbf5bff34579827738aa8b01b388af3877184813b65
MD5 ebc8e59a17bbfc7b73365e3a6b4dac48
SHA1 b864a62b6fa7a2cd17207668469565da890177ce
SHA512 55d4466e3adeb6ef9fbccf766f421a390829265c96e2b84508bdbf939187002214424c1816e3824a8ab558de32944a8d9e4bfbb88eca23b53ff8dc0542b646aa
SSDEEP 24576:OpLy2+H1AvYVJjWrA4A73log5w3aHGrMB:OM2+H1A4jWq71j2rM
TLSH
T1A9259E0373D18022FF93AA721D5FE7265ABC6D2A0323956F13D81DB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Block

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Block
Size 2KB
SHA256 e75070caa751ab74ea51c28ec109a07b5de2ae19c10546bbdc7ca06079e74f53
MD5 4fc2f023fff5455f2f24beced1352071
SHA1 29fac06879c37c9a5560af9e2ac429758275d487
SHA512 7772592501e0c281e4eadc29fb19b0a4d4538e53459276452178db774c98fecc6e50b9362c8c5a933e6c185b7c5359aca3ea55fbbb81c7ce52aab047a6ca723b
TLSH
T1215151F3BEF145A4E7E50035E88E4B15C40D4DBAF36693CA0FD526236BD1E686648046
MD5 SHA1 SHA512 TLSH

Submit Download

Herself.mov

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Herself.mov
Size 6KB
SHA256 81843c7bf6788f917de60beacd84f5c6ddd6819e75762c0e1cf3eaba5de7c6e2
MD5 78bfefc9b68c30d4b35ef34f0e97f8b4
SHA1 b8c8edaae5ff4de72bf762f9a20fbb4958cab7c3
SHA512 2afd05250320897dba48a94e900a7e6a38eb6121af74326865b9df46247b5b4828845e05ce4ccafa6cdfb2bc819d66a6b476f1aea17bba29e72ab9759a123be1
SSDEEP 96:ve7jnB1Jou8Nx0c7u5YtXKY89MEF+hZCWLPZg41GIULEm4jM08FwYj+/o0vtH0ON:venBH60c73tXK5+Lh4UWEm4oN0vtH0ON
TLSH
T10EE119FA399D00D2118BB9AAEEF4D5CD7A32D6152E93517C5F8706C4C558C686332E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hose

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hose
Size 338KB
SHA256 f45330afa93bf452634a4c6df8b0b618f00b1c5cfaef0ace84a200c6ef4487bb
MD5 18e3a28c82c57e76336928df7da8e5a7
SHA1 40d7b71c3b48eee5777483834fe68ea98d6b6560
SHA512 316a91e2cae49598692c519a2f7399e90a6ee080b0c689e295c72c22bfa5a3066eb9f3ee51c4b5c9388c335568f75ed46664fa9eb2b4e9827e5d9057d1615e5d
SSDEEP 6144:MmcLvyhtkv9axZHTx4pQf3WYSDoP8M/AOghDP2uAV5GPsk:MpL6h29iZHTxQQftAHP2uAVqsk
TLSH
T19A74AE02A8C1C171C8931C705C6BEBA29E7C9D3507286DCB77D91CB6DE609C29F27E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Leone.mov

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Leone.mov
Size 185KB
SHA256 0e30d871aba6a3f834051ad693c8032083f556bb5994421acabdd8d5cb208592
MD5 9d2922222091760f9186b7dc2ac58589
SHA1 b04b5e838427608a5cf8cac4345a5923fe7876e9
SHA512 bf8d64f5ecebbc76ddb9556f503805d2380c30f6aab9d0616b7dad9f9e7e815b72345734b91496eb41212f30ef0d742e5b70fb21b07b15b613cf281abef961a5
SSDEEP 3072:j/m8+6whvzqz4M2/Bx6w4Lbz9wmp74wPx0uUvciF/558q8ZhYuPS8cVx4NRPyDv/:gpqxeCtOI0iiF/0qaYuPSbv4NRPyDFAY
TLSH
T136041268919F87DCD7AC2EC9C72E4D0F4D3CD113386AAA2A9B825D192CF6A631750D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Responses.mov

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Responses.mov
Size 145KB
SHA256 3972c826dc62bf88a45306144d174a0923f0d4bf00b5eb9f3afa879764bce306
MD5 ebbd30fcaaf5309230218a69277d1318
SHA1 19cca16febfc47e469adc61210fe2a4a53db807c
SHA512 708683cd5caefdc18ed2d5c6416a74f8012475c15f7d3ac1aee2e51c19465e54e7ec38789904c68f69d13dbbc79dd333a667b706a355bedc31c1568b4d6c4d0c
SSDEEP 3072:SeDmqkilVQhuxuj7OBPh2m3uJhJzsTK7bLSRDBC9OvSZa2DvokvQya40E4SLA:SeDIilV4cujmh2meJb4YOCuZyokvQyaP
TLSH
T18BE323207A14781FF5DE55EF3E9860545CD32D7253F9C2B8B0A6AE0A86B43233D0A17B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Struggle.mov

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Struggle.mov
Size 173KB
SHA256 0a6c3cd3d62a0e3beaae882e7bdbe6937c6aba332f042dc2b2e921ede61409dd
MD5 2fea05f58165cb87795b17751986ece7
SHA1 2fff722df9ec8cd6da608b16bec3c61374925513
SHA512 e002feb455ecfd5913102082a6963803e623813bef3ad790733fee703f154f16dc513dde48059b1733ab83740c91685659242d346997ef9d9239e92b0a3359b5
SSDEEP 3072:oo68JDQN6ebrxd93iVBo4p254tQr3kfFMj64GTMhyKTWL4hoQpt:LhC6eD93izttffSoEIL4hX
TLSH
T1DB041309F70F840AD89600BDFF996BC0BEB8BE29F68FC1C715C09749247D4A1A51E799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unusual

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Unusual
Size 217KB
SHA256 7742a66e2b61648e71ef54e912a5ace6850fdf27fbdfb8a3809f18d185d653b4
MD5 3b8147cdb8a24cb7a279d5b77ad7f6bc
SHA1 0143ced0d43441d6577bd0d95b1275565b4776a0
SHA512 e78bdef25ef624c4c79f89111766d8cfc0648971a42c41cf754f310e4a40f18cc42a1c53891ec0978198e6c6efc101c4cdc16c5426ad21a4834b470aa071e9f6
SSDEEP 3072:/faB6OJRkrJrRj4nHDWy4ZNorgK4+vQR3iJp6vS0eQ:HaB6WGrRcHaBZ2r1T63Q6J
TLSH
T13624740223A4811BFFD7F57B265FE32E46B97D9E8753513E11182BBAA830370466D632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wet.mov

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wet.mov
Size 266KB
SHA256 dfedce23abc5382804c593802bc34406632bf6696f488b75e0141d9ce208f740
MD5 b0aa1f7340b4ff90a2a42f9b2868af66
SHA1 1a3046291e21101fbbdadaa24a164c565a66e782
SHA512 e5886dbf4d9333d0bef83a21a93865263ee124c7225d0b1f72a2ac218094f9ad4b2a6fe474fdde4f76be6c16cdb19e3c3544ca396fc328d9048472721efd6fa5
SSDEEP 6144:Rgh2A+PFc/KuEWcfxZpiwtmpRTwvvek36Mj+dJbqK0EG4ypkxrBJ:QcWchiGmp5wvB3ZjvK0Z4yqV
TLSH
T1784423D3ACC83DFDFD489087A112B3928819EEA65B98A83D755FCB15127345C39F039A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wilson

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wilson
Size 399KB
SHA256 a4f76a5767d29f4d0c9162a553f630c50109bb9147f4f9132553ff0d18cbe7e6
MD5 c0106ce215a30406aa09608bfb905730
SHA1 f72ab158375b0263245fdb58e9e22d6c767ef462
SHA512 a75a9554f67ca565f9de67d20aa3d660c7d07091b8f302807333896d0d5bc67f08c7ba15f9175aef35c243c4091188194b4268eff693b3e5ff79f0f81f9a79b5
SSDEEP 12288:KfjW/TASDSnPN/FYmb739cpkLogdLe4Fdw3:6jWrA4A73log5w3
TLSH
T1A6948E0377D300A2DDA313B09E5FFA26B7B9991B0125D67F13DC08B9FAA2461591B1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow.mov

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wow.mov
Size 174KB
SHA256 1c76c9308dd2c17951b96afceae331bbb54ef0c5f63d74d86e45fec4ff7edf61
MD5 b8a682c61026928a93643118a0432ff8
SHA1 d3ec4eb025995fefd9e1126f2c9e0f0bde9cb55b
SHA512 5862769919624bcaa22dbd37f8bce81e1e12b7b765a9b2be0824c845d299a9f92207379860bb3e103ad37abb3605ecdd0e953c126764bc6088bd06479224c0ac
SSDEEP 3072:4Tfz+euQX/3sFSzGPyvE5lItKUjaaEmqgnGsWF9A6wqKxL4c3aKocYMl4k:4meP3LzEyvE56tKUjadmBnGsgGXqKxL3
TLSH
T1B5041362BF31AFB5A472F6A27382DD24F95C37C20788BDF95B6982674103CE5D326150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-49-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-61-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-45-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-46-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-44-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-47-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-50-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-53-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-62-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-43-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-60-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-59-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-58-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-57-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-54-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-52-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-51-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-56-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-55-0x0000000000730000-0x0000000000798000-memory.dmp

Download

memory/1228-63-0x0000000000730000-0x0000000000798000-memory.dmp

Download