8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
Size 86KB
Sample260916-sdnk7asane
SHA256 8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7
MD5 bd4b668231d8dbd92a5e3584efc2f9db
SHA1 73fbe97e038fa8bdfba6bbfd87ba480bbbc1958e
SHA512 0d0426e3c4c051aafa509097500d385a123a2e3a277ebf4d440bfd35e04b22b443e3713910117928a172362c8723929d4d6b0b8495e0b821e8c29a652d451eba
SSDEEP 1536:I1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7Ha4h+DGunCeN:XbpfhDOW7hBhr4pX5r9x29E9z5HaZDGA
TLSH
T1A3835A0AE60644FAEC911671C08FEAEFB6297C32C071BE0BD7D57D14BA62DC63915A06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	COM7.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	COM7.EXE

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF Reader Launcher.exe	COM7.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF Reader Launcher.exe	COM7.EXE

Executes dropped EXE 6 IoCs

pid	Process
3900	ashcv.exe
4520	COM7.EXE
3940	COM7.EXE
4848	ashcv.exe
4260	COM7.EXE
3528	ashcv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM_LOADER = "\\\\.\\F:\\Program Files\\PDF_Reader\\bin\\COM7.EXE"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM_LOADER = "\\\\.\\F:\\Program Files\\PDF_Reader\\bin\\COM7.EXE"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM7.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ashcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM7.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ashcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM7.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ashcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2616	reg.exe
840	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3900	ashcv.exe
3900	ashcv.exe
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3940	COM7.EXE
3940	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
4848	ashcv.exe
4848	ashcv.exe
4260	COM7.EXE
4260	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3528	ashcv.exe
3528	ashcv.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
4520	COM7.EXE
4520	COM7.EXE
3940	COM7.EXE
3940	COM7.EXE
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3940	COM7.EXE
3940	COM7.EXE
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3940	COM7.EXE
3940	COM7.EXE
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3940	COM7.EXE
3940	COM7.EXE
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3940	COM7.EXE
3940	COM7.EXE
4520	COM7.EXE
4520	COM7.EXE
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3900	ashcv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 3900	3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe	88
PID 3360 wrote to memory of 4520	3360	8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe	89
PID 4520 wrote to memory of 2616	4520	COM7.EXE	90
PID 4520 wrote to memory of 4848	4520	COM7.EXE	94
PID 3900 wrote to memory of 4260	3900	ashcv.exe	95
PID 3940 wrote to memory of 840	3940	COM7.EXE	97
PID 3940 wrote to memory of 3528	3940	COM7.EXE	99

C:\Users\Admin\AppData\Local\Temp\8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe
"C:\Users\Admin\AppData\Local\Temp\8f71f2f8cea2e0d18b89aec41d5f44afa074f95f1d89d5372772b72e64cc12b7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
    \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4260
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COM_LOADER /d "\\.\F:\Program Files\PDF_Reader\bin\COM7.EXE"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
    \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4848

F:\Program Files\PDF_Reader\bin\COM7.EXE
"\\.\F:\Program Files\PDF_Reader\bin\COM7.EXE"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COM_LOADER /d "\\.\F:\Program Files\PDF_Reader\bin\COM7.EXE"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:840
- C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

COM7.EXE

Path C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
Size 86KB
SHA256 3ff720dd25f68e571c2f455004ccbd391ffb92ab4f384ea4bcbfa3627c135c35
MD5 b5a515fbf1a89bc57a7092cd656d018f
SHA1 2a427121132cdae666a4d490b5da5cc13950e4fb
SHA512 ccde59710ec7b954164b3cc08f497045e27cf4d4e83bcbbfb08b3414b0142e9a38c794039db61585aad957d096b86b68150c9dbbf06bab714d0395d3d111b150
SSDEEP 1536:B1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7Ha4h+DGunCeo:SbpfhDOW7hBhr4pX5r9x29E9z5HaZDGv
TLSH
T1D0835A0AE60644FAEC941671C08FEAEFB7297C32C071BE0BD7D57D14B662DC63A15A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ashcv.exe

Path C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
Size 86KB
SHA256 f0ff54be02e8789a4a4d00a23c016937360363e9e4fd1cfd9477ffe8b3c40a61
MD5 524bf48ba66e307c3274877f6afff8b6
SHA1 d92146207e22544a6110e9d6bb8b7656352a7e74
SHA512 d4cdf112e0a8fdff0463ce1856167a8e61ff958273c7df9a6179903d7a5638d4f03fea61b2e5809ae31369f3ec670d1b7263023f95f88d43626553940484a7a1
SSDEEP 1536:D1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7Ha4h+DGunCeN:QbpfhDOW7hBhr4pX5r9x29E9z5HaZDGq
TLSH
T16A935A0AE50644FAEC911671C08FEAEFB7297C32C071BE0FE7D57D14BA62DC62915A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDF Reader Launcher.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF Reader Launcher.exe
Size 87KB
SHA256 055b5c01ab44b326b72f3bcfa6544423f5ae3e701e2325b9560de2c6f9990b10
MD5 bd3e27d06a8234e8be04152fd24626a7
SHA1 fba9b0eeced46d28525d645057b0e1c72dac8246
SHA512 3469d96b627c0162b529654c902d394e5daa30cce5830d1b8c1915404c62c54104de111a41f85184849fb48d23a2b684b227b712f123cf218d36a15e60954780
SSDEEP 1536:W1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7Ha4h+DGunCeIf:hbpfhDOW7hBhr4pX5r9x29E9z5HaZDGb
TLSH
T16E935A0AE60244FAEC911671C08FEAEFB7297C32C071AE0FD7D57D14BA62DC63915A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDF_Reader.exe

Path F:\Program Files\PDF_Reader\PDF_Reader.exe
Size 87KB
SHA256 98b7b0c19071e1ec488d672312a8234f43b28facf6b03bbcf0f6eb43f31373b8
MD5 b1fa86f5099aca4e9e8508e8c289c187
SHA1 80ecb18d6f71229364d9ac3369a7cd55ccd1dbc0
SHA512 0747356ad4d00abc731ea346e5bfbdd39e7c02b22ab91b4095232f898e6bacf2421011a3e3f149bcfc90abfbe01f159bf409b9268d9596fb0879edf7331812e6
SSDEEP 1536:n1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7Ha4h+DGunCey:MbpfhDOW7hBhr4pX5r9x29E9z5HaZDGD
TLSH
T10B935A0AE60644FAEC911671C08FEAEFB7297C32C071BE0BD7D57D14B662DC63A15A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COM7.EXE

Path F:\Program Files\PDF_Reader\bin\COM7.EXE
Size 86KB
SHA256 c328c5ec962a18e7f1b813fa7d60b501081762f8e934790d5a76b8385872d1a9
MD5 44bb773957022492dd6e33a256f51ee9
SHA1 4e48931da4f9c522027479405a6811dc3005e4bf
SHA512 ff3824a659ec37e72ca3f4942228db587c11f4dcada0be4888256ecc4b2faae330a6aeec3b62f7cedea992b9ccb22ab5766002c5c5776e3649eaec65d94d54f1
SSDEEP 1536:u1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7Ha4h+DGunCed:pbpfhDOW7hBhr4pX5r9x29E9z5HaZDGU
TLSH
T13B935A0AE50244FAEC911671C08FEAEFB7297C32C071AE0BD7D57D14BA62DC63A15A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-12-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3528-42-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3900-15-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3900-32-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3940-37-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/4260-27-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/4520-17-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/4848-24-0x0000000000400000-0x0000000000549000-memory.dmp

Download