56c6b80e9f525e9010b47112f8085751e8e3fb744e111df3330b481df6a7e954

Analysis

max time kernel
149s
max time network
157s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/09/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
covid20.exe
Size 4.8MB
Sample260913-qech7sthqa
SHA256 56c6b80e9f525e9010b47112f8085751e8e3fb744e111df3330b481df6a7e954
MD5 fde53eb92140afb22152cfa283ef26cc
SHA1 b975f240e69307f809e54fabf6ea547183edf130
SHA512 df5eaa0e429e618d7c94eab0dd6021d774abe50ad2d200d3608d1d1c50b70e65eccff564baa2fd2b86a5dad999ff7edb04152ac5cbff209fae7d93c329dff771
SSDEEP 98304:i1EB4Av3kOW561R4+8QxEmKDxUmEhc0R2lIP9W0uJPg4dWzN/ODIw9AtVje7gQ:EEi4z1R4+LKDPEK0RBFduJ44dWpiHAtM
TLSH
T1973633D2C65D6703CDB2F77672479BB9BDA3C045E6291A602C5333A6452CBC123186EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery execution ransomware upx

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e0000000283d2-23.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	covid20.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
5000	CLWCP.exe
1576	flasher.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5060	WScript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\Desktop\Wallpaper = "c:\\covid20\\bg.bmp"	CLWCP.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3300-0-0x0000000000400000-0x0000000001A7B000-memory.dmp	upx
behavioral2/memory/3300-37-0x0000000000400000-0x0000000001A7B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	covid20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLWCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flasher.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2368	3300	covid20.exe	84
PID 2368 wrote to memory of 5000	2368	cmd.exe	87
PID 2368 wrote to memory of 1576	2368	cmd.exe	88
PID 2368 wrote to memory of 5060	2368	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\covid20.exe
"C:\Users\Admin\AppData\Local\Temp\covid20.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8037.tmp\covid.bat" "
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\8037.tmp\CLWCP.exe
    clwcp c:\covid20\bg.bmp
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\8037.tmp\flasher.exe
    flasher 5 c:\covid20\covid.bmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1576
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8037.tmp\corona.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CLWCP.exe

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\CLWCP.exe
Size 505KB
SHA256 13b4ec59785a1b367efb691a3d5c86eb5aaf1ca0062521c4782e1baac6633f8a
MD5 e62ee6f1efc85cb36d62ab779db6e4ec
SHA1 da07ec94cf2cb2b430e15bd0c5084996a47ee649
SHA512 8142086979ec1ca9675418e94326a40078400aff8587fc613e17164e034badd828e9615589e6cb8b9339da7cdc9bcb8c48e0890c5f288068f4b86ff659670a69
SSDEEP 12288:kDupRTrjf1nJp2NLtVu4jPau4p+lE3dWq:SExrj1DAt84DaTU4dW
TLSH
T1B7B48E61F2E14537C1671B389C6B62A89D36BF103E2879876FF91D4C4F39781392A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.bmp

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\bg.bmp
Size 21.5MB
SHA256 d8f864128f2a79e2ff8179255ebfd06619325fec86103722b6418c3cbb41823f
MD5 cb065726febf9c1a581f3008e678f524
SHA1 f9a0058a57213cf7ce72eddf0616a938c8f4f4b1
SHA512 b54a81cff5951b34478e777bc27cc4fd4a292b548f38162602c01e2594848e40fcfea5becfd789153c9a4fa75c354834a3a37cf3032c9857e9246bf850d24880
SSDEEP 196608:qrw6AlPWBud7HQ02GstwRwYmRy45ADq4DtZMUUBlXXX4Tb78wA4Bztp/4Zmfuwtd:qrwllPOqrQ0nstmHvMU2lXXoTu8lB/
TLSH
T15237FAD25464D70AF49E072D105633AF50F8D572C9AE80B3ADBE24CF1F684B6522B4AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

corona.vbs

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\corona.vbs
Size 130B
SHA256 82ac48c4f7edbab182aa0a8c320d5616ccdd2f0e83dc733b91e45521f85462a3
MD5 e61624dced063c4ba5352bf487f12410
SHA1 40bd08928900cd97f444ffaa78d93dcaf913b274
SHA512 2a27db12d2af35e7b51a307eb8860800075867922d3d63a69da608c96bec045f3c64ac757674d2a40d7f4d9e55179fc2bddc17691919e18e109a5d4669c607ac
TLSH
T1B9C09B61A35450D5158D13017C92C825111425CE7200569D3CD5114D6479097D6729B0
MD5 SHA1 SHA512 TLSH

Submit Download

covid.bat

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\covid.bat
Size 445B
SHA256 2c68caeada2c251c5fc12694b7288a5790114ced4142867179e75d313efaa50c
MD5 b08e02e536917f897acb2d21f42f0a97
SHA1 a078f1addfd3eeb0f0cb5fd206ff78e9dc0f3e45
SHA512 1d1901c3c676bb6d99a39d1a0bab1a6ee378090390bb5e7fe66cf754b8dd772ac0b79ba1215fa758445db1deac200afcc5e1e1e32b2562df946c82b530ca95ab
TLSH
T127F0EC02B790D0401A46FD06F977F77D745423CB73009EC83ADB508C4A7635879AE9E0
MD5 SHA1 SHA512 TLSH

Submit Download

covid.bmp

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\covid.bmp
Size 147KB
SHA256 548c9e22a04650efec06a0414d205d24600e08e0fac1beed7e8b4c03730962bb
MD5 738bbd119d8877f8342e1ff00fe60dff
SHA1 fc11d85e3c5b46bd877e06985fec1a601ce396ed
SHA512 f7a12c9a1403c9a1953387c5871d6e7865ba80c405f37c51f5c3e093bab9235b8a8ba62ad8b27f2079407e9672d47ac365c9cb08033ef349bd8c9906a30fefad
SSDEEP 3072:0aszBvivs6aeVjlvlayUf79lly18t+uFsb4Wypn:GzZTePlaVf7nAU04Wyh
TLSH
T190E3B8D16F5DFF0273CAE824C2FEBECAC8D674960B5656B9F17CB14A830E6A0455D202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flasher.exe

Path C:\Users\Admin\AppData\Local\Temp\8037.tmp\flasher.exe
Size 246KB
SHA256 30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
MD5 9254ca1da9ff8ad492ca5fa06ca181c6
SHA1 70fa62e6232eae52467d29cf1c1dacb8a7aeab90
SHA512 a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a
SSDEEP 6144:/85Z+Y97t0Kc0Nd5bHzvvj/R87Z3BxonZ:/8vd2KxNPjs3gZ
TLSH
T16B3412475FB40175C85B39F248EE6A3052EEB13B40E2C32B2216479FAF4AA41DC0F667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1576-27-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/1576-40-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3300-0-0x0000000000400000-0x0000000001A7B000-memory.dmp

Download

memory/3300-37-0x0000000000400000-0x0000000001A7B000-memory.dmp

Download

memory/5000-26-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/5000-25-0x0000000000471000-0x0000000000472000-memory.dmp

Download

memory/5000-39-0x0000000000400000-0x0000000000484000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads