4c686d554c2e323030f0ac7d9dc7cf179ae59273ab5edc35d837e1afa7e5db7a

Analysis

user interaction
yes
max time kernel
74s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apkeasytool.exe
Size 1.9MB
Sample260905-ms95vaar4x
SHA256 4c686d554c2e323030f0ac7d9dc7cf179ae59273ab5edc35d837e1afa7e5db7a
MD5 ecd05b7c5af91af8b7264d5dbdea1d68
SHA1 58a9b57885ca2935026723df9c23a84dcbef4936
SHA512 603cd417e50b2c4f24a4fc4647d0d40d43ad5041928cc8093f4c1dd9e7b973d73c84de5fe51ef3c31e80c4c1e4cea57214b0cbe6f1306a1690015b94f6d2fedc
SSDEEP 24576:LKySd3yqpKeJjeD8nV4YNgBv689CIcLfz3ZP9F8nVWTyFoBkkAu:NSd34Y4fcpP8nVFan
TLSH
T13C954A2031678205D86907B45C32C1EE1A363FDABA17C75E3486775EBE336538B13AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware execution spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1324	cmd.exe
1596	cmd.exe
2968	cmd.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 6a00310000000000255dc0551000332d455854527e310000520009000400efbe255dc055255dc0552e000000d0b502000000190000000000000000000000000000004d110c0133002d004500780074007200610063007400650064002000410050004b007300000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000255dc055100054656d7000003a0009000400efbeae5c7501255dc3552e0000004d5702000000010000000000000000000000000000004d110c01540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000ae5c750112004170704461746100400009000400efbeae5c7501255dbc552e00000038570200000001000000000000000000000000000000bb5a5f004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000ae5cd20310004c6f63616c003c0009000400efbeae5c7501255dbc552e0000004c570200000001000000000000000000000000000000e3fbbb004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\Registry\User\S-1-5-21-125073035-2952146151-721812867-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000ae5c75011100557365727300640009000400efbec5522d60255dbc552e0000006c0500000000010000000000000000003a0000000000c06c720055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000ae5c4709100041646d696e003c0009000400efbeae5c7501255dbc552e0000002d570200000001000000000000000000000000000000e0f53a00410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
664	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
788	apkeasytool.exe
788	apkeasytool.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
664	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	apkeasytool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
664	explorer.exe
664	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1324	788	apkeasytool.exe	80
PID 788 wrote to memory of 1596	788	apkeasytool.exe	82
PID 1596 wrote to memory of 3896	1596	cmd.exe	84
PID 1324 wrote to memory of 4516	1324	cmd.exe	85
PID 788 wrote to memory of 2592	788	apkeasytool.exe	86
PID 788 wrote to memory of 2968	788	apkeasytool.exe	88
PID 2968 wrote to memory of 4668	2968	cmd.exe	90
PID 788 wrote to memory of 3784	788	apkeasytool.exe	91

C:\Users\Admin\AppData\Local\Temp\apkeasytool.exe
"C:\Users\Admin\AppData\Local\Temp\apkeasytool.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "java -jar "C:\Users\Admin\AppData\Local\Temp\Apktool\apktool_2.6.1.jar" -version "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Apktool\apktool_2.6.1.jar" -version
    3⤵
    PID:4516
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "java -version "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:3896
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "java.exe" -version
  2⤵
  PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "java -jar "C:\Users\Admin\AppData\Local\Temp\Apktool\apktool_2.6.1.jar" -version "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Apktool\apktool_2.6.1.jar" -version
    3⤵
    PID:4668
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\3-Extracted APKs
  2⤵
  PID:3784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 9d111bff2eabfc82d45c17fe025b39359627acba4135c861e28aaec7faab8792
MD5 67382d1a1306d88c53fc2cac525f9587
SHA1 497cf897b1c35143d469c848c0ce54c671c7d7f0
SHA512 c09205ef11b39d2900c0b7a83de683540b9380f034c5aedf309d22997201c9d75c36330d6860e2788f32fc7728892b6d3d9ba43a9d8835b82b575b2b5a14c685
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 042ed00f5fc0cb4239c97a88eb0383e74f3ac9363268dfd2b8d0315a77d2876b
MD5 ed55bc557f750ef8c872d839a7ef7340
SHA1 7fe322a51e442bf05fa3e0357d071370777b0653
SHA512 c1a461926e9d78eb60e2cd0ab7296e2a0fcbe02dcf12b31957a1f2c7ab63065507d4db4ef55caf9c769fe6f45f832dcd17ab90f76344a235585b38ec28416a84
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e691bc76de7ff6aecf7cb7e7381c7dab89e8c48ab99343ca316450e6de8869e1
MD5 25716f0ab7eb3919913188df2ea8c8eb
SHA1 b92856e1b0fca436c65dd5e30f0b079608d32f05
SHA512 16344f3274b52385dc53a00ef1ffbadb9cc80a7122221992c334fe79d9e87a34e9dfedd1b7ef4d3cbe9b6ce5c1034013f95141ebf61b50ffad6eefa6c6a8ec95
MD5 SHA1 SHA512

Submit Download

memory/788-1-0x00000190E7D50000-0x00000190E7D60000-memory.dmp

Download

memory/788-2-0x00000190E7D50000-0x00000190E7D60000-memory.dmp

Download

memory/788-3-0x00000190EB1A0000-0x00000190EB224000-memory.dmp

Download

memory/788-4-0x00000190EB220000-0x00000190EB240000-memory.dmp

Download

memory/788-65-0x00000190E7D50000-0x00000190E7D60000-memory.dmp

Download

memory/788-64-0x00000190E7D50000-0x00000190E7D60000-memory.dmp

Download

memory/788-0-0x00000190CBE40000-0x00000190CC02C000-memory.dmp

Download

memory/2592-46-0x000001DF1F8B0000-0x000001DF1F8B1000-memory.dmp

Download

memory/3896-28-0x0000021E75ED0000-0x0000021E75ED1000-memory.dmp

Download

memory/4516-30-0x000001AD2EEB0000-0x000001AD2EEB1000-memory.dmp

Download

memory/4668-59-0x000001B07DDD0000-0x000001B07DDD1000-memory.dmp

Download