Overview

overview

10

Static

static

5

Tax-202609070119.exe

windows10-2004-x64

10

Tax-202609070119.exe

windows11-ltsc_2024-x64

10

hdp_elev_shim.dll

windows10-2004-x64

3

hdp_elev_shim.dll

windows11-ltsc_2024-x64

3

nw_elf.dll

windows10-2004-x64

9

nw_elf.dll

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/09/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Tax-202609070119.exe
  • Size 1.9MB
  • Sample260911-pdb1lsem6w
  • SHA256 4bfa832e0b5d59d5498d85071020167e97b06c69aa43cca2cfccd0c91d535c1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistencetrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Enumerates VirtualBox registry keys 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tax-202609070119.exe
    "C:\Users\Admin\AppData\Local\Temp\Tax-202609070119.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Windows security bypass
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Identifies Wine through registry keys
    • Windows security modification
    • Adds Run key to start application
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\Tax-202609070119.exe
      "C:\Users\Admin\AppData\Local\Temp\Tax-202609070119.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Enumerates VirtualBox registry keys
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4904
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /F /SC ONLOGON /RL HIGHEST /TN "SystemTelemetry" /TR "C:\Windows\system32\rundll32.exe "C:\ProgramData\Microsoft\SystemTelemetry\nw_elf.dll",SignalChromeElf"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1736
  • C:\Users\Admin\AppData\Local\Temp\KVF1E095E0.tmp
    C:\Users\Admin\AppData\Local\Temp\KVF1E095E0.tmp
    1⤵
    • Executes dropped EXE
    PID:1216
  • C:\Users\Admin\AppData\Local\Temp\KV01E095E0.tmp
    C:\Users\Admin\AppData\Local\Temp\KV01E095E0.tmp
    1⤵
    • Executes dropped EXE
    PID:5792
  • C:\Users\Admin\AppData\Local\Temp\KV3FA095E0.sys
    C:\Users\Admin\AppData\Local\Temp\KV3FA095E0.sys
    1⤵
    • Executes dropped EXE
    PID:5056
  • C:\Users\Admin\AppData\Local\Temp\KV3EA095E0.sys
    C:\Users\Admin\AppData\Local\Temp\KV3EA095E0.sys
    1⤵
    • Executes dropped EXE
    PID:5940
  • C:\Windows\system32\rundll32.exe
    C:\Windows\system32\rundll32.exe
    1⤵
      PID:1460

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          3
          T1543

          Windows Service

          3
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          3
          T1543

          Windows Service

          3
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Impair Defenses

          5
          T1562

          Disable or Modify Tools

          5
          T1562.001

          Modify Registry

          6
          T1112

          Virtualization/Sandbox Evasion

          4
          T1497

          Credential Access

          Discovery

          Query Registry

          4
          T1012

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Virtualization/Sandbox Evasion

          4
          T1497

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          KV3EA095E0.sys
          • Path C:\Users\Admin\AppData\Local\Temp\KV3EA095E0.sys
          • Size 29KB
          • SHA256 eb57b6db9b6876a51c7bc05ef011adcf0909a7351da8a329d6a1aee52a286459
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          KVF1E095E0.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\KVF1E095E0.tmp
          • Size 37KB
          • SHA256 381dbc9012d02b3a42916813b99e481b1cc89d15da918b58db40ce330cc13fca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hdp_rebuild_stage.log
          • Path C:\Users\Admin\AppData\Local\Temp\hdp_rebuild_stage.log
          • Size 2KB
          • SHA256 c602a4d5e40d25cefd90551a64e1359e5f7c842b0d709e80fcedcd55dd0c4502
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hdp_rebuild_stage.log
          • Path C:\Users\Admin\AppData\Local\Temp\hdp_rebuild_stage.log
          • Size 641B
          • SHA256 1c4ef7006fe2c2a21ff4513d9518bb4c6f46ff514e9e10a3d6f435bf23954adb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hdp_rebuild_stage.log
          • Path C:\Users\Admin\AppData\Local\Temp\hdp_rebuild_stage.log
          • Size 4KB
          • SHA256 19b829cdc4a17ce3545011dc8edd8b97c1827c86864ac5ae659f00cfa6dc0e53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hdp_rebuild_stage.log
          • Path C:\Users\Admin\AppData\Local\Temp\hdp_rebuild_stage.log
          • Size 1KB
          • SHA256 361432c9f0f4ce790f14934c2f43553b498bf379edfb5ffe65b45d492f15ba20
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hdp_rebuild_stage.log
          • Path C:\Users\Admin\AppData\Local\Temp\hdp_rebuild_stage.log
          • Size 2KB
          • SHA256 9b97fe4b0cd60b515aa6f57b3142b673dae4a1d78c57e43dbb4957b9f7dd2e56
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hdp_rebuild_stage.log
          • Path C:\Users\Admin\AppData\Local\Temp\hdp_rebuild_stage.log
          • Size 2KB
          • SHA256 f8a9ad49d07c466a31d80b74742c98581f868284864c504fb3c921d97e7ab81f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hs_rt32_674295e0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\hs_rt32_674295e0.dll
          • Size 601KB
          • SHA256 da5940a74630f1b9aef507d90f6196dba600b29f41d161ce18784efed58c3454
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          procexp.dat
          • Path C:\Users\Admin\AppData\Local\Temp\hsda6095e0\procexp.dat
          • Size 37KB
          • SHA256 98e934450b2f36ef51b78ed3c66a51ef0103b207137b442045b01833c68ece73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nw_elf.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nw_elf.dll
          • Size 1.8MB
          • SHA256 f586d4c364cfc479ccf6348512e1acae73169fde71a9fe502bc59637322cc7f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2024-155-0x0000000074920000-0x00000000749AB000-memory.dmp
          Download

          memory/4904-39-0x0000000002320000-0x0000000002337000-memory.dmp
          Download

          memory/4904-25-0x00000000022E0000-0x00000000022F7000-memory.dmp
          Download