a811365d1d049694986e4685f485b44a726202291a1a24b209c9dad4ec11274c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InvioFE114.exe
Size 177KB
Sample260910-ajvmksvsfz
SHA256 a811365d1d049694986e4685f485b44a726202291a1a24b209c9dad4ec11274c
MD5 fa2c40bea82d9e033081c045d9301226
SHA1 62365c9d6f3328eab0b06ccb16231e8e51fde64f
SHA512 77bdb2ae81abb2f579ef8bb14105071b872a5ad4bb75963c8194d5dc46a4d3e590e75d38ad8e141c6f11302304aea5052500f6335f22f58dd903e7249f1f5b64
SSDEEP 3072:VMEMvxdknmg1tDbuLB+5xGT21JqaEvNPB+OM8ylv6y0rPUX0FwI1dxrI/25RO:VME1nmg1tDbJ5621YNPIOM8ylvObZFL8
TLSH
T17E04E015B7C584F2E4814B70587C6372D63AFF01AB70E28E879A4D5F6C30612BA1AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	InvioFE114.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3488	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InvioFE114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
700	InvioFE114.exe
700	InvioFE114.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 3488	700	InvioFE114.exe	87

C:\Users\Admin\AppData\Local\Temp\InvioFE114.exe
"C:\Users\Admin\AppData\Local\Temp\InvioFE114.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ScaricoOK.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ScaricoOK.bat

Path C:\Users\Admin\AppData\Local\Temp\ScaricoOK.bat
Size 117B
SHA256 f45caa63de860e2903a278c7ad430e6bf3148afb4724efdde46c6edab0a3da91
MD5 7a4f8ebd66192a63c506644b4cfa972b
SHA1 34432b7ba271fa9b0b5b1490c10db8bc20794a70
SHA512 70ef182f9416a86c4f09d158d90c7aae9cb806c834712a8f3826b617a063397e6b93fc014421bc288ac09167451cde3b14d449d4cd70a182d6237f8d6613d04d
TLSH
T101B011233C888A208000C0022CB88882F28300830C028C08A0830238EC808E2380C00A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-15-0x0000000000400000-0x0000000000420000-memory.dmp

Download