Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 15:58
Behavioral task
behavioral1
Sample
082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe
- Size 380KB
- Sample260908-teq85stfne
- SHA256 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994
- MD5 fc9d499610c3c67b40f53c03896147ba
- SHA1 4d0f1f6d75dab2bf5112108ba0303c8ae51b62da
- SHA512 bb53313edf0d9d6a60791a5ff813ea8304c6f31f12502b194b707723690c6b03f5907eb89b90ed8965c42f1f822f53ccf311f5961eb9db7d05cc4d37d711d1c0
- SSDEEP 6144:GuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+aGKhabsdOM:N6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aGCf
- TLSH T1928413EFB398B322D4B402B3AB4702C1C2B0753567B9DAFA7014550B299F1186E7B79D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe - Executes dropped EXE 1 IoCs
pid Process 4940 svhost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\z: svhost.exe - AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/4940-7-0x0000000000400000-0x0000000000525000-memory.dmp autoit_exe behavioral1/memory/2476-769-0x0000000000400000-0x0000000000525000-memory.dmp autoit_exe behavioral1/memory/2476-929-0x0000000000400000-0x0000000000525000-memory.dmp autoit_exe behavioral1/memory/4940-987-0x0000000000400000-0x0000000000525000-memory.dmp autoit_exe behavioral1/memory/4940-1093-0x0000000000400000-0x0000000000525000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2476-0-0x0000000000400000-0x0000000000525000-memory.dmp upx behavioral1/files/0x000e000000024333-5.dat upx behavioral1/memory/4940-6-0x0000000000400000-0x0000000000525000-memory.dmp upx behavioral1/memory/4940-7-0x0000000000400000-0x0000000000525000-memory.dmp upx behavioral1/files/0x000300000001e69b-125.dat upx behavioral1/memory/2476-769-0x0000000000400000-0x0000000000525000-memory.dmp upx behavioral1/memory/2476-929-0x0000000000400000-0x0000000000525000-memory.dmp upx behavioral1/memory/4940-987-0x0000000000400000-0x0000000000525000-memory.dmp upx behavioral1/memory/4940-1093-0x0000000000400000-0x0000000000525000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe File opened for modification C:\Windows\Driver.db svhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4940 svhost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe 4940 svhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2476 wrote to memory of 4940 2476 082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe"C:\Users\Admin\AppData\Local\Temp\082a2851a34c7b891923293b9ee6d288c7c5cf24e1bd285d78e72ba8e9de0994.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4940
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs.exe
- Size 380KB
- SHA256 c4d60cde4130b5fd1cf8b1e32be654fbf764910ac48cbbf7fce6bc2150a92e28
- MD5 601241e9414e93ab90688ac5cbd80391
- SHA1 5aaf1f3f6f215647b949721caf5fcd5abeecef23
- SHA512 40e9ba44dcab487dad5eba3aaa1b793af311715cad1d67507e0420e4c3cf30255c294e1ecf9d1c7017e22d2cc9f148a8bf0dee19313e9f7fdedd292387bf6e4d
- SSDEEP 6144:GuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+aGKhabsdOt:N6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aGCE
- TLSH T11F8413EFB398B322D4B402B3AB4702C1C2B0753567B9DAFA7014550B299F1186E7B79D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Driver.db
- Size 82B
- SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
- MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
- SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
- SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
- TLSH T163A0112832A830A28EE0A00EB0FAC000E28820A00E02882A0800002E0CA83B02C00222
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\svhost.exe
- Size 380KB
- SHA256 bf67bf5f891f43cfef14a2dab4d9ab83b88097ab68e214ef374edb25dc76d795
- MD5 67b76d0b9d03abce02d28bbbd5f28e5f
- SHA1 aa378840c225ec269c3bd7e58db0fcdd13ade5a8
- SHA512 9d6e89513a076cb0e6a7c4302deb24b2a09852191485db9428a357237d064a0cb8f73a89f69cad3b3b56db5f72c5ecfd6d784583db31749a3d7796961e3cd24d
- SSDEEP 6144:GuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+aGKhabsdO1:N6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aGCA
- TLSH T11C8413EFB398B322D4B402B3AB4702C1C2B0753567B9DAFA7014550B299F1186E7B79D
- MD5 SHA1 SHA512 SSDEEP TLSH