997b17174a1794599ff328f246f5977d0f1bdee26f3d728dccfe808751e7f6c1

Analysis

max time kernel
2s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 11KB
Sample260907-yz4gesvfla
SHA256 997b17174a1794599ff328f246f5977d0f1bdee26f3d728dccfe808751e7f6c1
MD5 c210bfa0b7038694d6aa7ef29faf0c96
SHA1 185c9db04ce53377f1fd8a1dafbeb3812fdca723
SHA512 c184fb2232a2327c9067203a7079403a0073355157341473ac1615f76d63ee2c2c3320135276ff0c41eef8da873d92081a6c701156315420b8bc8f360ab96f9a
SSDEEP 192:6o3Wy2N2BZXfxeuoRcVPFJxTEZmFhEac8:6ogNYfADcVPFwZy
TLSH
T18D32E71E6E864331DD6049B0E2B54A09517D5DE33386FADBE733D1C70AD6D4680C16AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Downloads MZ/PE file
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3708	sc.exe
964	sc.exe
3732	sc.exe
4316	sc.exe
3716	sc.exe
3436	sc.exe
3656	sc.exe
4300	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2972	taskkill.exe
2288	taskkill.exe
2312	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1768
- C:\Users\Admin\AppData\Local\Temp\1507627203.exe
  C:\Users\Admin\AppData\Local\Temp\1507627203.exe
  2⤵
  PID:3548
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "winmgr"
    3⤵
    - Launches sc.exe
    PID:3436
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3716
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4316
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "winmgr"
    3⤵
    - Launches sc.exe
    PID:3732
- C:\Users\Admin\AppData\Local\Temp\3649428012.exe
  C:\Users\Admin\AppData\Local\Temp\3649428012.exe
  2⤵
  PID:3412
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:2972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    PID:2312
- C:\Users\Admin\AppData\Local\Temp\2430721673.exe
  C:\Users\Admin\AppData\Local\Temp\2430721673.exe
  2⤵
  PID:4524
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "AWRWBLMS"
    3⤵
    - Launches sc.exe
    PID:964
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "AWRWBLMS" binpath= "C:\ProgramData\sdncmkuhthxf\epaqkjxbzwey.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3708
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4300
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "AWRWBLMS"
    3⤵
    - Launches sc.exe
    PID:3656

C:\ProgramData\winmgr\syswinprdrvc.exe
C:\ProgramData\winmgr\syswinprdrvc.exe
1⤵
PID:3780
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  PID:3224

C:\ProgramData\sdncmkuhthxf\epaqkjxbzwey.exe
C:\ProgramData\sdncmkuhthxf\epaqkjxbzwey.exe
1⤵
PID:1328
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

epaqkjxbzwey.exe

Path C:\ProgramData\sdncmkuhthxf\epaqkjxbzwey.exe
Size 115KB
SHA256 9db81e28d38a008276070b3a97a3b5337c5829250238e7bbbf8a835d0212628e
MD5 e725501bd3e1831d023b54bdcaf61679
SHA1 e3db77d56d192e6a52e08fe15050c94c80b89385
SHA512 27009d5696f5c018f0339553b7ddf851841e689e995299de2396fb3425491ac91e541cbfc9d896c66a0e797e5bb203c2b988eacfb4a70187a5c99cb357138112
SSDEEP 1536:LQD1Wi28FwkTjMKAH8dhkxFjf21o4lNoZTzqdSnVLcrZmipWO6JrIe3BD:cD1vGgdc8jG72130JqdSnV4rIXJrIe5
TLSH
T194B3BFDA6C81FBFCDBE54434D9161FE382AAF060475064D7A5F19E01363B2E0A673A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epaqkjxbzwey.exe

Path C:\ProgramData\sdncmkuhthxf\epaqkjxbzwey.exe
Size 189KB
SHA256 878f19f9c75f91866a0c52a320773df6a860324e88c4333b5f23a48ebd0680c7
MD5 91deef17a52f41bdf9d75aba0e82ba40
SHA1 b5e4bf99f1a9b77a6ab0b8d741fce9e5c7690916
SHA512 4f23cafed0923d601cf0f4b9ba13312bf70443c9dd3659a15f1d123822581a44b4d73a6a00e9b7f7e4caddd5b14def438dab743dccce962bf24345dfb28ccaf7
SSDEEP 3072:cD1vGgdc8jG72130JqdSnV4rIXJrIeiTS4DY9FRRFrhh7FtLyQxqJ:Spn31hdKVP6zT9YF9tfLm
TLSH
T13F14E0862C40FBF8D7E14436C96B2FB3C2AAF461535028D765B15F017A2B2E4A77390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syswinprdrvc.exe

Path C:\ProgramData\winmgr\syswinprdrvc.exe
Size 156KB
SHA256 f5fc498f52a669e0d515a1f26b4a7aa679859a3468e154451f99463dcc2a526f
MD5 aab4d64d06af729464f08c71daea9df3
SHA1 18ce00ea405056909780d03f0a3fc9273b2bc7a0
SHA512 db3b0f14647ea1e5fa42e9ee2e19c1009509742c6cc950e52c443e4abf4812887af8581ff2f2a7eb2f9972f2b0d8e90c2add8283ca860283e211c8ee1a33711b
SSDEEP 3072:wbRpZEfncQJteBMt8XcxsWsydvJZdZ/NhGmlHD45hiL6cdw24RbGMy1P:tnXBANWXdvBZ//GmlHkQKA
TLSH
T1CBF3E1867893B4B8D55541F88949AF337677F259CB3228F703E12D553E30AE0543AFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syswinprdrvc.exe

Path C:\ProgramData\winmgr\syswinprdrvc.exe
Size 143KB
SHA256 619319efd0a83c8094dcf601b21eee5c360f5a079e5556250eb3afd27b00f2a5
MD5 3d8a7d4304a7eed0cf614cb40f23a0b6
SHA1 2eeb0021d191df9585c96f4e84ad51f302be2ada
SHA512 63526319b23151b7adbf4a3c6b821dd52d644176e3939c5cdf9f5fc9c137883ea1e4f8c5f195df58f06ef6dfe698594813c44d8d9fb78ea8807f876683483d62
SSDEEP 3072:wbRpZEfncQJteBMt8XcxsWsydvJZdZ/NhGmlHD45hiL6cdw24RbGMx:tnXBANWXdvBZ//GmlHkQKv
TLSH
T196E3E1867893B5B8C55541F8CD49AF337627F259CB2228F707E128553E30AE0553AFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1507627203.exe

Path C:\Users\Admin\AppData\Local\Temp\1507627203.exe
Size 149KB
SHA256 1d9565b4dfd241121f77ea1a34a5c05001d9dafd91031f2a194501090fe367ce
MD5 2691e0a1be9ca8a4be7d7c9880da7424
SHA1 554e3677adfe7c1544bc02589d481e8b2dfd7a18
SHA512 aeb6277984926af8e3b0d4def619ccc0415274edec557fe0fd00342e3e3822147ad75dadbb5c4696a9beeecd63df1d7e1b1769e8d28063a787366de697b92e4d
SSDEEP 3072:wbRpZEfncQJteBMt8XcxsWsydvJZdZ/NhGmlHD45hiL6cdw24RbGMyJ:tnXBANWXdvBZ//GmlHkQKq
TLSH
T105E3E1867893B4B8C55541F88949AF337677F269CB3228F703E12D553E30AE0553AFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1507627203.exe

Path C:\Users\Admin\AppData\Local\Temp\1507627203.exe
Size 169KB
SHA256 1fe2402d7c5faa13613e36a7e0e1b5ef3ebdd6734108c91c7009bd0edf65e1bc
MD5 57b8edd6d757ea9be2b37cde7ec0b68c
SHA1 24a4dd519bc37675568254599a05a6a9a1ba0a41
SHA512 93f30dcd917b4c2a62fb1540aa0c5545a326fe9527dbb34aeb00366f9d56fa7a7fedddbba4273b627c371abed3ca13faae09b9ebd04f57b90a71a47469065c4d
SSDEEP 3072:wbRpZEfncQJteBMt8XcxsWsydvJZdZ/NhGmlHD45hiL6cdw24RbGMy1Cwu:tnXBANWXdvBZ//GmlHkQK/wu
TLSH
T12304E1867893B5B4D45541F889499F737677F26ACB3228F303D12C553E30AE0693AFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2430721673.exe

Path C:\Users\Admin\AppData\Local\Temp\2430721673.exe
Size 105KB
SHA256 9835c42f23418e27ea9e32b64108fa654fec3a6bc34a37c1101a9f88a545b75b
MD5 f499817923b0f926a8557fb1d7c63b62
SHA1 36181d91d80de3de88287857300fcfff09944205
SHA512 280e5337dcf7a5bb835ffb6e03351e4acd71faedfaa7ba3dccfaad001c6b3648d40a26bafb9ff5d8facf8c74d95a2d8ea5c2adf632840fdcb8035883b4241ecc
SSDEEP 1536:LQD1Wi28FwkTjMKAH8dhkxFjf21o4lNoZTzqdSnVLcrZmipWO6Jrx:cD1vGgdc8jG72130JqdSnV4rIXJrx
TLSH
T151B3BEDA6981F7FCDBE44434D9161FE383AAF060876074D7A5F15E02363A2E0A673A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2430721673.exe

Path C:\Users\Admin\AppData\Local\Temp\2430721673.exe
Size 93KB
SHA256 7a17dc429a8cb1394e06204e7100333bd44812babb3247cea17962ff735c8e50
MD5 d3d4c76e4f47ea1b0a5a9f3863b8db6c
SHA1 50162e5fa0e60587b0e1cf10d05c365c0e7901d5
SHA512 3229b212839fe6223997ea81f875b55018313fb4456672b55908d50989d6fe345d80405331e1b18c89b2ffb6098575e21cebd743712285475742dfaa9c4db52f
SSDEEP 1536:LQD1Wi28FwkTjMKAH8dhkxFjf21o4lNoZTzqdSnVLcrZmt:cD1vGgdc8jG72130JqdSnV4rIt
TLSH
T1AF93AE8A6981F7FCDBE44034D5162FE3839AF060872074D7A6F15E02363A2E4E673A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3649428012.exe

Path C:\Users\Admin\AppData\Local\Temp\3649428012.exe
Size 97KB
SHA256 df769be4b28ef04cd3e0dd2d9adb5b18116bef8cc7a831031f5f62c30c56abda
MD5 d9305dd9ded99de929d425ccbef042fd
SHA1 bc844563bb368c0d8086cff00047930000b9a36c
SHA512 ecf7ca5b34ad6d06102c9177a19877ab60d81e03daed302cbe88d384aacd00a5eb26de73f58e6d5d4bfcb8f51448cf42043f0211f1a16affbacd26fb04b1e59c
SSDEEP 1536:auwxsVPGOcYAzyUnEsGZTd5d+unjwbznbEfwrW9d1:aMbjUnEhpWZbzAor2r
TLSH
T163A3F78B6CA540E4D4EEE079DA27B607BE723414073837E72DB09A610F26FE165BDB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3649428012.exe

Path C:\Users\Admin\AppData\Local\Temp\3649428012.exe
Size 122KB
SHA256 f1518e43ec81985542e7381743725743ecc5b8117e2fd6dc780103d818655444
MD5 927b92c39095e14faa3362616b4b1ef3
SHA1 e13aa2632321c284194ff68ef5cfa18dea2b0595
SHA512 7861155c9d1e92cc2696e1d47e8a99e48819c10225767e80fd2e4fb83b04fed2f52feb9b8a8439edc08a5fedfa3fefaabe94fb48947a73021c5c9474bac9accc
SSDEEP 1536:auwxsVPGOcYAzyUnEsGZTd5d+unjwbznbEfwrW9dX0zcAWmcZzJAS:aMbjUnEhpWZbzAor2GgWS
TLSH
T135C3075B6CE540E4D4EEE1B9C627B217BEB27414073837E32EB099610F26EE161BCB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-23-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-15-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-25-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-20-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-21-0x0000028AED0C0000-0x0000028AED0E0000-memory.dmp

Download

memory/3224-17-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-10-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-13-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-11-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-24-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-27-0x0000028AED130000-0x0000028AED150000-memory.dmp

Download

memory/3224-26-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-16-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-22-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-14-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-49-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-50-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-9-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/3224-12-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/4220-43-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4220-42-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4220-44-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4220-45-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4220-46-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4220-48-0x0000000140000000-0x000000014000E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads