77e3c34f10b69063135f3710826973843adc319a0c18f7ae9678be97d91b210f

Analysis

user interaction
yes
max time kernel
31s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KRV FREE TEMP.exe
Size 19.8MB
Sample261018-rmda5sfs2x
SHA256 77e3c34f10b69063135f3710826973843adc319a0c18f7ae9678be97d91b210f
MD5 35126f34fda0899e70d8f580b9a50570
SHA1 2045baa6da682f06b71e96a5503963869cc1de2d
SHA512 6922b41af927512d42231cb9227238c4dc9eccfbfe455fe27f9d86aca8c8bced4781552f7bdd049436067ff5bfdea1b66ae087b36bc87d62435f5018feb5ffef
SSDEEP 393216:pSgFEpvVzAZjl8ELQhuT41T025QfviHWnJJmdQVtUb1qpu+g:pSpvVzAtJSuT4Z/QniHWJcCib1qpj
TLSH
T1A02712D528D083FCC742C639D24A16FAE6C938968EBA891B7FC658023571C55C8F7E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3672	sc.exe
2368	sc.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3920	cmd.exe
4816	cmd.exe
4016	cmd.exe
3440	cmd.exe
4440	cmd.exe
4592	cmd.exe
744	cmd.exe
2748	cmd.exe
2996	cmd.exe
1844	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	KRV FREE TEMP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	KRV FREE TEMP.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1536	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	KRV FREE TEMP.exe
5096	KRV FREE TEMP.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5096	KRV FREE TEMP.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5096	KRV FREE TEMP.exe

C:\Users\Admin\AppData\Local\Temp\KRV FREE TEMP.exe
"C:\Users\Admin\AppData\Local\Temp\KRV FREE TEMP.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5096
- C:\Windows\System32\MVhgpvlEuT.exe
  C:\Windows\System32\MVhgpvlEuT.exe C:\Windows\System32\ngwAmuYgNu.sys
  2⤵
  PID:892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop winmgmt >nul
  2⤵
  - Executes a command shell one-liner
  PID:2748
- - C:\Windows\system32\sc.exe
    sc stop winmgmt
    3⤵
    - Launches sc.exe
    PID:3672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start winmgmt >nul
  2⤵
  - Executes a command shell one-liner
  PID:2996
- - C:\Windows\system32\sc.exe
    sc start winmgmt
    3⤵
    - Launches sc.exe
    PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop winmgmt /y >nul
  2⤵
  - Executes a command shell one-liner
  PID:1844
- - C:\Windows\system32\net.exe
    net stop winmgmt /y
    3⤵
    PID:3592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop winmgmt /y
      4⤵
      PID:4848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start winmgmt /y >nul
  2⤵
  - Executes a command shell one-liner
  PID:3920
- - C:\Windows\system32\net.exe
    net start winmgmt /y
    3⤵
    PID:1136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start winmgmt /y
      4⤵
      PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Windows\System32\MVhgpvlEuT.exe
  2⤵
  PID:3848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Windows\System32\ngwAmuYgNu.sys
  2⤵
  PID:552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /d /n C:
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /d /n C:
    3⤵
    PID:3348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /d /n D:
  2⤵
  - Executes a command shell one-liner
  PID:4816
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /d /n D:
    3⤵
    PID:4444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /d /n E:
  2⤵
  - Executes a command shell one-liner
  PID:4016
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /d /n E:
    3⤵
    PID:3792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /d /n F:
  2⤵
  - Executes a command shell one-liner
  PID:3440
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /d /n F:
    3⤵
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\fix.bat
  2⤵
  - Executes a command shell one-liner
  PID:4440
- - C:\Windows\system32\net.exe
    NET SESSION
    3⤵
    PID:3252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 SESSION
      4⤵
      PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\arp.bat
  2⤵
  - Executes a command shell one-liner
  PID:744
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Windows\System32\fix.bat
  2⤵
  PID:1888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Windows\System32\arp.bat
  2⤵
  PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MVhgpvlEuT.exe

Path C:\Windows\System32\MVhgpvlEuT.exe
Size 148KB
SHA256 2cb584856d1f4a98264a9a41327b46823442fdf89e5b07efb9e4424549bcf7f1
MD5 59489af794ba708db29138c4e42bb62d
SHA1 5679553a728c3476828fdbeb9433934bf051ea6f
SHA512 c63414381648467c33e285a8aea02ae8f88ec943ca105b0b509465e2e6b01b2cf570308864bfd45bcdd6d8b39083f4d13572bd94800e03c4ad9f6b83c3c375ef
SSDEEP 3072:oMpgyNPNmJRrysykwgmJTQSaMm5/6oF/Z:oMpJP4FkWlfhZ
TLSH
T179E32B5797A5106AE2B7DAB8CA720512EB727C550B74D2CF135048BE0F62BD0AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arp.bat

Path C:\Windows\System32\arp.bat
Size 6KB
SHA256 875b2586147109e1548bf8e042c1b9a0ebd5058fa9635f3442c97981ce32d9a5
MD5 a3ba0f1e64252f0cd587e88c3ac4342a
SHA1 3fbec62c2ab2339388604900257b149ce0db1dc9
SHA512 a37ed3eb799b117090df0c335bad56e2355b8d72c1fb969c97589ef6eaf373a40cfcf5b9571bfd51e4a758845153cfb31e0d51f27dfca293d4de2cb1695c22a0
SSDEEP 96:ahhlpZhhlrvLBUNmaH2O1XqtSGhoVkxraHgD09O1XqtSGhoVzXj:anlpZnlrvLBUNmaHV4raHgD0yvXj
TLSH
T158D1332019D313B496D79920FF17993372ADB2C7B288E3987E57180150E7C6F546A3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fix.bat

Path C:\Windows\System32\fix.bat
Size 515B
SHA256 7da402500d4c6b2b9a5a0db610bceafceb95b3920e7beb0895f0cbc6403831e8
MD5 24e69881b06312c9bba5beb86a0759e4
SHA1 4f5048942c691465285046d6ef2371be72ef2ba8
SHA512 10f7ae1916ec32d5a37fdbbe5e0c9f5cc139148fd6dfdb9ba8ba0210341ef12817c3f6c711dbd1fa3903417a0f6ecced276c90115006a06976d74d93ba86cf75
TLSH
T145F0C0261043830B276164F3C2317145702FA3427E0D7DD1FAA160911F2E754AE899C5
MD5 SHA1 SHA512 TLSH

Submit Download

ngwAmuYgNu.sys

Path C:\Windows\System32\ngwAmuYgNu.sys
Size 30KB
SHA256 b78a302f746148b52ddea49dc7c2445629de540dfb659969a238e7e4198d2d49
MD5 3b19fe195dfe7a59e06dad0ce757b5de
SHA1 f4bd6acee842b5523876cb32c6d577f37ef1ccec
SHA512 84cd8e5d4564b16eea2421264117cc139cd0861c4f55112bcef9e7853d8dfb8d5b6c558fd121c6e62e06b5969bd1d72d685e7c4b55b88a2a19b269eb51ada6e6
SSDEEP 768:CK34L40voYY0jcTJQROwhJfcmJ9AwRTB8EtFkGDQPQJmqcm1hdXi0:Ca4IbPmvAwRTBD+QYK1zi0
TLSH
T153E23A5DB240E1A0D92680B9D4694997F7B2386477E1DFCF42B88F499F23BD12B28742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5096-0-0x00007FFE82D10000-0x00007FFE82D12000-memory.dmp

Download

memory/5096-2-0x00007FF6DFEF3000-0x00007FF6E0AC7000-memory.dmp

Download

memory/5096-1-0x00007FF6DFCC0000-0x00007FF6E1E97000-memory.dmp

Download

memory/5096-6-0x00007FF6DFCC0000-0x00007FF6E1E97000-memory.dmp

Download

memory/5096-8-0x00007FF6DFEF3000-0x00007FF6E0AC7000-memory.dmp

Download

memory/5096-9-0x00007FF6DFCC0000-0x00007FF6E1E97000-memory.dmp

Download

memory/5096-10-0x00007FF6DFCC0000-0x00007FF6E1E97000-memory.dmp

Download