Overview

overview

6

Static

static

1

pwfree-64b...ne.exe

windows10-2004-x64

6

pwfree-64b...ne.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pwfree-64bit-online.exe
  • Size 42.3MB
  • Sample260831-ph2rtstygs
  • SHA256 8b186b8acf0e302cd18cc94d75129d10eff7573d99afd1ffc940d234394c4bf1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryinstallerpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
    "C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\is-K8846.tmp\pwfree-64bit-online.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-K8846.tmp\pwfree-64bit-online.tmp" /SL5="$400B0,43446255,1148928,C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
        "C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe" /createtask
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3412
  • C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
    "C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1300

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP120.dll
        • Path C:\Program Files\MiniTool Partition Wizard 13\MSVCP120.dll
        • Size 644KB
        • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCR120.dll
        • Path C:\Program Files\MiniTool Partition Wizard 13\MSVCR120.dll
        • Size 940KB
        • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Core.dll
        • Size 5.3MB
        • SHA256 a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Gui.dll
        • Size 5.7MB
        • SHA256 be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Widgets.dll
        • Size 5.3MB
        • SHA256 3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        partitionwizard.exe
        • Path C:\Program Files\MiniTool Partition Wizard 13\partitionwizard.exe
        • Size 268KB
        • SHA256 13a44ba07699e8bd18b6fc3af00e93234f90314616768eea01d73afb7845e1a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Program Files\MiniTool Partition Wizard 13\platforms\qwindows.dll
        • Size 1.2MB
        • SHA256 d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt.conf
        • Path C:\Program Files\MiniTool Partition Wizard 13\qt.conf
        • Size 46B
        • SHA256 3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594
        • MD5 SHA1 SHA512
        Submit Download

        updatechecker.exe
        • Path C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
        • Size 178KB
        • SHA256 52dc9a1db1bb3dc1e85a7bb3052bf58b76ea7a9d1ade5e2e5e1a5f6f7a8e227a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pwfree-64bit-online.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-K8846.tmp\pwfree-64bit-online.tmp
        • Size 3.3MB
        • SHA256 87732995a2014ed992b63c820b765dc32ecb0376722f9505a1104e221d92d175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1136-8-0x0000000000400000-0x0000000000526000-memory.dmp
        Download

        memory/1136-0-0x0000000000400000-0x0000000000526000-memory.dmp
        Download

        memory/1136-420-0x0000000000400000-0x0000000000526000-memory.dmp
        Download

        memory/1300-416-0x0000000068C00000-0x000000006914A000-memory.dmp
        Download

        memory/3412-407-0x0000000068C00000-0x000000006914A000-memory.dmp
        Download

        memory/4080-6-0x0000000002530000-0x0000000002531000-memory.dmp
        Download

        memory/4080-9-0x0000000000400000-0x0000000000760000-memory.dmp
        Download

        memory/4080-402-0x0000000000400000-0x0000000000760000-memory.dmp
        Download

        memory/4080-10-0x0000000002530000-0x0000000002531000-memory.dmp
        Download

        memory/4080-419-0x0000000000400000-0x0000000000760000-memory.dmp
        Download