94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe
Size 8.3MB
Sample260916-taepjsbe83
SHA256 94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a
MD5 e2f774b15a85c98a78e162617b3b85aa
SHA1 483c58dca09636c458896fb7b7afbe75300cc441
SHA512 97de2d0b8c1addd640b136fecdf84f5773f3e683eca56b29dc3f2a9dbb7ada71c7ad332c21f90b1d122d3d2d3d4e4ada301e3f77d690232c424a1580da4d7f0c
SSDEEP 98304:DuLUz+7O7GTXLfJBcNOdXvG3hvspHoqjcj3l2QMPX9wFbs2dQWoLuPXz07Lm2v7m:DVz3KX7QOxOwpgj3l2adLoq/ggA2TJp
TLSH
T171963305BBFD3051D5B71BB5B8F9925300A6BB78D87A83BF4610A49F0874EA185F072B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2144	activ.exe
560	DRIVER~1.EXE
416	DRIVER~1.tmp

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 1864	2144	activ.exe	90

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1864-9-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	activ.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	activ.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1864	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DRIVER~1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	activ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DRIVER~1.EXE

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0007000000024443-16.dat	innosetup
behavioral1/memory/560-18-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/560-30-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2144	activ.exe
2144	activ.exe
2144	activ.exe
2144	activ.exe
2144	activ.exe
2144	activ.exe
2144	activ.exe
2144	activ.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	activ.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2144	2184	94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe	86
PID 2144 wrote to memory of 1864	2144	activ.exe	90
PID 2144 wrote to memory of 1864	2144	activ.exe	90
PID 2144 wrote to memory of 1864	2144	activ.exe	90
PID 2144 wrote to memory of 1864	2144	activ.exe	90
PID 2184 wrote to memory of 560	2184	94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe	93
PID 560 wrote to memory of 416	560	DRIVER~1.EXE	96

C:\Users\Admin\AppData\Local\Temp\94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe
"C:\Users\Admin\AppData\Local\Temp\94fdf3a5270ed4899048a7f303a0deb1137ead6d1d22aec252b509ad8f98fb4a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\activ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\activ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    PID:1864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 12
      4⤵
      Program crash
      PID:1524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Users\Admin\AppData\Local\Temp\is-8KS5D.tmp\DRIVER~1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8KS5D.tmp\DRIVER~1.tmp" /SL5="$70252,8222983,54272,C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1864 -ip 1864
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DRIVER~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
Size 8.1MB
SHA256 d683072cd4de4229eb049e7487404b62e54a6a15c4a3330a3000246f5b3b58bf
MD5 d2a03af165bf2d22c4ae680d283f8bc0
SHA1 e7b1a8c1a58a907ff8dff5626cc035406615664f
SHA512 7cfcf832c94af4d396dd7369e91bf23c31c37b5618046032ffde3264feb9a57c86474724ab439ac167fe32c662e7fd62821d8ec5bfd0bc9dd216defc3fbe6ffb
SSDEEP 196608:Zyj3eSyMAlVsd20rhN1FHMAabSC2TCgsgs:Zyj3e/uks5FKGCsCvn
TLSH
T13E863308FAFE34B4C5134BB9F8B9D162C0D7E32894BE437B59556C4E0A5CE7202E176A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\activ.exe
Size 156KB
SHA256 f46086930e85ecff3eba9f826c93eacef88be25dc0b95a6bd0f387fdf04d26a7
MD5 b65eac3657eab0478ddd181a735d1eb2
SHA1 d7f609e094b410bcfd2935095e400605b839da6f
SHA512 30ae723126cfff61ab149215e21da0dd6ac9ab1d4557bea4eb514fcdfa8828a61e5291c2dc36e73457e6e7c637d543891627526bd2840ef2550706996b4a6a82
SSDEEP 3072:Zp4IrS53S6hDYLJORNbX0kl9kK4IEGA4eDa6KoDkIuFq9Zl4FQrysLcHNXzj8aMV:ZuIrS53SDERNbEkbkKlEGBeDa6KoDkI0
TLSH
T1F0F38EEDD6088E5EC4BACEB9ADC95091C37F4085074FC24BADE115D92E1B7EE86061CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DRIVER~1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8KS5D.tmp\DRIVER~1.tmp
Size 688KB
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
SSDEEP 12288:YRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:yObekYkfohrP337uzHnA6cHswHE/6gU3
TLSH
T130E47C32F2A08837D1B31E789D1B86955936BE103E38A59737E81F4C4F796817A273D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-43-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-45-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-57-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-55-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-53-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-51-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-31-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-33-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-35-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-37-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-39-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-41-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-49-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/416-47-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/560-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/560-20-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/560-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1864-9-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/2144-7-0x0000000003030000-0x0000000003040000-memory.dmp

Download

memory/2144-8-0x0000000074572000-0x0000000074574000-memory.dmp

Download