0db6a184a3312ec1f5d1d652297ae7d15751e1bb581ff7646052797177aa8098

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/10/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsTechnicalPreview-x86-EN-US.iso.cmd
Size 4KB
Sample261012-web6bsdv41
SHA256 0db6a184a3312ec1f5d1d652297ae7d15751e1bb581ff7646052797177aa8098
MD5 798a373ab70bc925f724217bf9182b2a
SHA1 b9cf18116c2a685f60fced9601964c58c01c77cf
SHA512 1485bb2caed7435b8288db4a543704e854644e693e0359c7f36f5028c54db869bc5c1702421f55f3b9c42d4b3bd101c17d5281bb2f5f6bd4d4f6917898b568e4
SSDEEP 48:z/sWGG71w0UymvevbIJOepqY0y1Wg7rwekEny3fRvbuLL8Ui:z7z1Huyl3Y06Xwe/yvluLIUi
TLSH
T18CA1609BFC14A12122D5E767EED4A141FA45C0A770109EA4708F10BAE71EAD0EADE7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery dropper execution

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
4584	bitsadmin.exe
3192	bitsadmin.exe

Executes dropped EXE 3 IoCs

pid	Process
2060	aria2c.exe
6004	aria2c.exe
2224	aria2c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3104	cmd.exe
1940	cmd.exe
3676	cmd.exe
4852	cmd.exe
3748	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aria2c.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5208	timeout.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3748	4852	cmd.exe	83
PID 3748 wrote to memory of 4584	3748	cmd.exe	84
PID 3748 wrote to memory of 4760	3748	cmd.exe	85
PID 4852 wrote to memory of 3192	4852	cmd.exe	91
PID 4852 wrote to memory of 2088	4852	cmd.exe	93
PID 4852 wrote to memory of 3104	4852	cmd.exe	94
PID 4852 wrote to memory of 5208	4852	cmd.exe	95
PID 4852 wrote to memory of 2060	4852	cmd.exe	98
PID 4852 wrote to memory of 1940	4852	cmd.exe	99
PID 4852 wrote to memory of 3676	4852	cmd.exe	100
PID 4852 wrote to memory of 3900	4852	cmd.exe	101
PID 4852 wrote to memory of 6004	4852	cmd.exe	102
PID 4852 wrote to memory of 2224	4852	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WindowsTechnicalPreview-x86-EN-US.iso.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin.exe /CREATE /DOWNLOAD "Download Tools" | findstr "Created job"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin.exe /CREATE /DOWNLOAD "Download Tools"
    3⤵
    - Download via BitsAdmin
    PID:4584
- - C:\Windows\system32\findstr.exe
    findstr "Created job"
    3⤵
    PID:4760
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer {407A4ED2-FC5D-49BB-9E4A-B19FEE37F1EF} /download /priority foreground https://files.rg-adguard.net/tools "C:\Users\Admin\AppData\Local\Temp\tools.cab"
  2⤵
  - Download via BitsAdmin
  PID:3192
- C:\Windows\system32\expand.exe
  expand "tools.cab" -f:* .\
  2⤵
  - Drops file in Windows directory
  PID:2088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3104
- C:\Windows\system32\timeout.exe
  timeout /t 10 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:5208
- C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe" --async-dns=false -x1 -s1 -d"C:\Users\Admin\AppData\Local\Temp\5330" -o"list.txt" "https://files.rg-adguard.net/file/3e15724b-9272-cbcc-fec6-8cda5ce07e37/list" --disable-ipv6
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\5330\list.txt"
  2⤵
  - Executes a command shell one-liner
  PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\5330\list.txt"
  2⤵
  - Executes a command shell one-liner
  PID:3676
- C:\Windows\system32\choice.exe
  CHOICE /c fs /n /m "Save all or just the requested file?"
  2⤵
  PID:3900
- C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe" --async-dns=false -x1 -s1 -d"C:\Users\Admin\AppData\Local\Temp\5330" -o"dl.txt" "https://files.rg-adguard.net/dl/free/3e15724b-9272-cbcc-fec6-8cda5ce07e37" --disable-ipv6
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:6004
- C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe" --async-dns=false -x1 -s1 -j1 -c -R -d"C:\Users\Admin\AppData\Local\Temp" -i"C:\Users\Admin\AppData\Local\Temp\5330\dl.txt" --disable-ipv6
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dl.txt

Path C:\Users\Admin\AppData\Local\Temp\5330\dl.txt
Size 699B
SHA256 4818339ea34f6124651a455fee77a27600d32f21cac019dfd587daca21f67ce4
MD5 338bd833c2e50ba22fe8f93bb9eafee5
SHA1 13bd563f59d798f9fdc56b489050796f23ae2dbd
SHA512 5a4dd300bf416a979ada04b3cad7e882cd7c49ad73732ecad5d58bbadffc6b1a5059f96f9b312a3d9fe62014fd63410f617455176d1a1a95d167ca54f8ab60fe
TLSH
T1BA01882E0053A41FE447B0DDD5CF09A47EB06554254818DDDDEFC74CE2B454C05EDE10
MD5 SHA1 SHA512 TLSH

Submit Download

list.txt

Path C:\Users\Admin\AppData\Local\Temp\5330\list.txt
Size 83B
SHA256 43a4f370c36d1d1baf44987746177add89f0e85f09847f9bda85708f623a6660
MD5 8918e4375df259f84a85a737397c6b14
SHA1 16fc041261e0b3aab2ad1a296281869f025be29c
SHA512 f5937b2aa8c827e575085aef78a32e726c28477e0ca08847ac79f2a585d2659e31c4f338e15abc2ca1a1719f909f6de76f31873cd8968838a8dce25d9be26d8e
TLSH
T165A012AD212200A360810014828F46C110912B4102360644C137C202D4A2D290048A44
MD5 SHA1 SHA512 TLSH

Submit Download

7z.cmd

Path C:\Users\Admin\AppData\Local\Temp\bin\7z.cmd
Size 1KB
SHA256 4b06f12e0edb8ae3a5835761055d700fcebd985f2db231036b32b9f6a2937e74
MD5 f108e1011705c8d7d0a069b3628429ea
SHA1 4cbe60eee028e6add6f0e88a2f6f1c53c5357b9d
SHA512 091bde353a222059481a476b87bfab92a3e6186186e82a755d7a372bea22689f6e8f32b5eb040ac9350f9e5e9d58d79610e9f597415597da5be4740599c2a9e7
TLSH
T139310201B804219607FA7B77FA305044B5DC81D701A41BE5F94E90FAA90E310ABBA3F8
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\7z.dll
Size 1.8MB
SHA256 bbd705e3b58ca7677c1e9e67473f166a6712da034dcb567d571fbb67507a443f
MD5 cc5120e106ee9bd1842db09e145f9727
SHA1 6b505a53b6ba8415e4ca8257f0937ab2372fc3c5
SHA512 6d3e62a17a2e3001eccec23899198b5d77a1a2ad0d7ef25fb4151faecf63a0b50d7d1fd94139b48baf30d81fbc57ef5fe8f7605be44b07d223969afc7ad6efcb
SSDEEP 24576:HqLqRmdUXLP/at+X0n0FXVspRMRiaA2zDbeL9yJ4:HquROU+wX+YMuYx9y
TLSH
T1F6954B6AF6748270D0B7C075C5E2AB9AEE7134868730A6C712859B3D2F17BF6C539321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\7z.exe
Size 562KB
SHA256 4a41aa37786c7eae7451e81c2c97458d5d1ae5a3a8154637a0d5f77adc05e619
MD5 d11c6cb9b06d009efcf470a668b9f9ca
SHA1 56475b921e5576e1dd93ade2035aacea012b1a6f
SHA512 ae93719e6b5c5d8b83d408d606e31b1e8cdc9eaac7cf18c7fdfc959326b515a10845ecacf6d154d2cc73b64b533c6b03ec11b8c992dca3b668d1d98ae3fa92a3
SSDEEP 12288:d3+ncNWPWcUwYJokbsyIpMAf8Wvlr0wz28:OFPhUhKbJ68
TLSH
T1B3C4E725F6748331D073C0B9C5D2A69AED7230865B308ACB5286C77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria2c.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
Size 5.4MB
SHA256 be2099c214f63a3cb4954b09a0becd6e2e34660b886d4c898d260febfe9d70c2
MD5 8c71b86bf407c05baf11e8d296b9c8b8
SHA1 6624ab8ca883c48f02c58250d4eee9e90098f4e4
SHA512 bb3fee727e40f8213f0a7d9808048e341295a684ecba6f4df52f1b07b528d7206ca41926b2433f4b63451565ad2854570fee976bc7051b629acd24fca6d0f507
SSDEEP 98304:jgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:kRZDFTyGaHIJoWofqc
TLSH
T1F0463917E2A310ECC26BC170476BA273B932F81915307E7F79A8DB751F21E605A6DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvp.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\dvp.exe
Size 2.4MB
SHA256 d5331bdf6efc35ee6027cd44f457422a5253cd467bb5af6f765d1a5e60657ff0
MD5 0eab138fb066b3e580a2b4ac6364ab04
SHA1 01709940b05b309e1e692659a8379486cdc02632
SHA512 048dafb139decc8a01e3e7db85e8181cce3ae4bc376a6f34b8c095a53d3b762df561865f1b0a9384707107c1a20814a1e91d1d68ea7408b610af40f907825181
SSDEEP 49152:pRJq3Yecs1q3LnZMnyD74Mi5uDOMsRN7C91a3TGZkwd:U4beWCDG7
TLSH
T1E2C5BE06E3E512B4D837D638CA669332DB7079564330E68B268CD6252F73EA15B7F306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smv.cmd

Path C:\Users\Admin\AppData\Local\Temp\bin\smv.cmd
Size 2KB
SHA256 ec3a6be7f769607ebf70911370f42e6fafcff5fd71ccb60daf33918fb5f7a835
MD5 dda1e3c0bc86bfab9484f150495d1070
SHA1 f07e0b02fcae9841a6bff38d7b34fc392f960b88
SHA512 10104b50780b332d4cf8f109ce0893692ea6084741f9a65fb94119430c731e044a2958a0557b248616937c1b21eb500a2e395aa41faf5f2274e587c19d07044a
TLSH
T15F51DB55B58C50D506EC3B7BE53461C6698EC0D3453806E77CCE81ECAE6F3604A3A7E8
MD5 SHA1 SHA512 TLSH

Submit Download

smv.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\smv.exe
Size 1.3MB
SHA256 93fba2d50921565bcf283075bb3b8195f2b9b10719ec5123fbf06ea596a782b4
MD5 f3c45ae821b803e521b9e14b4b87eb1a
SHA1 67bc5c8bd3c353f74866cf320966cf7f043c869d
SHA512 5f2ef359cdf2d2595320b82b2206099879149b9203706d22c4dc6b4f3628285962873bacf61f501d4fef803f36a2aa77c3dd4dd9030eef28701bc112bfee558b
SSDEEP 24576:PGtlq0QCd7XIQhl6ZA7063qVS8bq7XpTCwfdhbVrHbq5q834JT9A2jPtxS2NaqxM:PGtlqld0otRVS8bq7hq4JT7jPtxdwsW
TLSH
T1B655BF82F6A4D1E9F137D874CD36472BE7F1780A02249A5B42D88B597F0B7609A3E317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-34-0x00007FF71C600000-0x00007FF71CB6D000-memory.dmp

Download

memory/2224-44-0x00007FF71C600000-0x00007FF71CB6D000-memory.dmp

Download

memory/2224-53-0x00007FF71C600000-0x00007FF71CB6D000-memory.dmp

Download

memory/6004-38-0x00007FF71C600000-0x00007FF71CB6D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads