0410158c9d63cb7cad43dc87acf62530df0b5c3440eb442beb11b7c830de01e6

Analysis

max time kernel
898s
max time network
473s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/10/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uup_download_windows.cmd
Size 4KB
Sample261020-23tm6sys8q
SHA256 0410158c9d63cb7cad43dc87acf62530df0b5c3440eb442beb11b7c830de01e6
MD5 71643b38ca9bf8ee544dbeb7f337d1b3
SHA1 0e9e3c9b1bb47fb7c05b48f269fa5dcd4c116149
SHA512 f52324382c735fd9c495e4339b4bb4f5932730055e35dd3be401159c32b2f1e1e204e35dad60636bcd11c7b770e0116e149984c4640f05db428437f4984afb9f
SSDEEP 48:czUetyOMg2UuGyjrk7PLhPsFibSUGQ0vtDdge7f4HzFzEt8PxOhXgR/FYUk:0Ue+5xXm+Qot7btIxOOk
TLSH
T11B91B803242D807F32A44645A22B71A2D318A3EF1E19B65D307A933969527D1AEF71B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5712	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
6	5712	powershell.exe
12	5336	aria2c.exe

Executes dropped EXE 3 IoCs

pid	Process
5336	aria2c.exe
5724	7zr.exe
5516	aria2c.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5712	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4252	cmd.exe
4400	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aria2c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aria2c.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aria2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aria2c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	powershell.exe
5712	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeRestorePrivilege	5724	7zr.exe
Token: 35	5724	7zr.exe
Token: SeSecurityPrivilege	5724	7zr.exe
Token: SeSecurityPrivilege	5724	7zr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 5040	4252	cmd.exe	84
PID 4252 wrote to memory of 5712	4252	cmd.exe	85
PID 4252 wrote to memory of 5336	4252	cmd.exe	86
PID 4252 wrote to memory of 5724	4252	cmd.exe	87
PID 4252 wrote to memory of 5516	4252	cmd.exe	90
PID 4252 wrote to memory of 4400	4252	cmd.exe	93
PID 4400 wrote to memory of 2136	4400	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\uup_download_windows.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\reg.exe
  REG QUERY HKU\S-1-5-19\Environment
  2⤵
  PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Unrestricted .\files\get_aria2.ps1
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5712
- C:\Users\Admin\AppData\Local\Temp\files\aria2c.exe
  "files\aria2c.exe" --no-conf --async-dns=false --console-log-level=warn --log-level=info --log="aria2_download.log" -x16 -s16 -j2 -c -R -d"files" -i"files\converter_windows"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5336
- C:\Users\Admin\AppData\Local\Temp\files\7zr.exe
  "files\7zr.exe" -x!ConvertConfig.ini -x!CustomAppsList.txt -y x "files\uup-converter-wimlib.7z"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- C:\Users\Admin\AppData\Local\Temp\files\aria2c.exe
  "files\aria2c.exe" --no-conf --async-dns=false --console-log-level=warn --log-level=info --log="aria2_download.log" -o"files\aria2_script.30912.txt" --allow-overwrite=true --auto-file-renaming=false "https://uupdump.net/get.php?id=bc94140e-c654-47ce-96ea-fbdffba7c6f1&pack=en-us&edition=serverdatacenter%3Bserverdatacentercore%3Bserverturbine%3Bserverturbinecore%3Bserverstandard%3Bserverstandardcore&aria2=2"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr #UUPDUMP_ERROR: "files\aria2_script.30912.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\findstr.exe
    findstr #UUPDUMP_ERROR: "files\aria2_script.30912.txt"
    3⤵
    PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_3nfqvnqu.zxv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nfqvnqu.zxv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aria2_download.log

Path C:\Users\Admin\AppData\Local\Temp\aria2_download.log
Size 9KB
SHA256 a421c184d6dfb00f40b7ff6d4777845196a7d1d7d57cd8fe435d68fde779c843
MD5 1a6dc13ffcd5a16e5151efb4901be726
SHA1 e491762f41e915fe99cb280c20168734de05a82a
SHA512 cc903aa3eb9c11d4ce569b33c596d5f4e80340b107d79107c8202d48a499aecfc491affc201ce2149dcb03c37240ba055b149b5e024eb229273a8a645e8d1359
SSDEEP 192:n14yB4y5JJ8nI7ntP3YG2wG2wG2wG2E25ylfUWoAHAUY3L2u1sypkyT:n1lwG2wG2wG2wG2E273L2u1d
TLSH
T142122F09697D9093A2222D90900C1FC371936A7FF36D4A4837508BE5C98EEA3E5BD2F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\files\7zr.exe
Size 571KB
SHA256 72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
MD5 58fc6de6c4e5d2fda63565d54feb9e75
SHA1 0586248c327d21efb8787e8ea9f553ddc03493ec
SHA512 e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
SSDEEP 12288:FSjMK6lrdOCdlki5Zc0EyR35ksye/X16PJz5tghj+:FSjieCd+i5s+Jks1foxz5Whj+
TLSH
T1AAC49F163AE5C07EC56215318B5D6BB1D1FA93680B224CC763804E6D2F349EAD73BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria2_script.30912.txt

Path C:\Users\Admin\AppData\Local\Temp\files\aria2_script.30912.txt
Size 29B
SHA256 a25e0b38974e60322bffb88dcdbae481e9002f14c460fdf9971f314d86de9308
MD5 055dc46c11c78f9a7c0fdbaf16025234
SHA1 cc44dad04dce18cd96a12dd5335122cd057f5fec
SHA512 e3ad7b97e867992d4ec6c32c8328c61ba516608713784e09acaf2f2dd96e88c6ed4432252290d2ef2211d7bba1eb5971a6252a897a7931c9a26b7be9f165be8a
MD5 SHA1 SHA512

Submit Download

aria2c.exe

Path C:\Users\Admin\AppData\Local\Temp\files\aria2c.exe
Size 5.7MB
SHA256 b9cd71b275af11b63c33457b0f43f2f2675937070c563e195f223efd7fa4c74b
MD5 6c5ea5a82d756bca4a9610c8d2260d2f
SHA1 30be358b2408692b2dcd5c56caf6ab38e67828e9
SHA512 685402fa95e9a8f2ac87ae364baaf7a445fc0124a9bc64c4b9007f2f55f91de9f3f85604378b825b0ed5ec233fa8e26f99be702d4089a803e129cd120f209964
SSDEEP 98304:fI6CKLHXrocDIjUuJcT4yKoHosMD9Vs79DxQVa0Y/6lM1rI/VlBEw9LcjA:f7CIH7ocGfyKouVsFxEM6lMI2mcjA
TLSH
T1E4567C59EA8310F1FA2351F0818FE77F97246B168061EEBBFF4DD949FA336112909216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uup-converter-wimlib.7z

Path C:\Users\Admin\AppData\Local\Temp\files\uup-converter-wimlib.7z
Size 1.6MB
SHA256 1597f39d614529843dcadf630ed6dd4543c955ea703b6b0d1fdbe65aa078a5f1
MD5 e7c64a8ce61e8390a13bb3f8cdbec2bf
SHA1 91e923598c904cf061e3928d010f18903fdd01ff
SHA512 fc4f77a4a4631c7744bef90121da9fa3e136af4f4b7b8ef355d6563fd7018553e651f1d86ac9fbbe76c92df60057ff7357bd90b37ee9aa8a117827d7cd59f5af
SSDEEP 24576:+cpGQgfLA68JYab59bFdpoIinU2DAPjii+4bFklZs/MUYD3zBqd8OqFW5t6NBQ/7:X8/fEj3qI8REmybFkly/MUczBqt5t57
TLSH
T184753386A4220E0F351DBFBD676B2435C8E74C3DDA5813DD2462543A4922BF26B5ECBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5336-31-0x00000000003A0000-0x0000000000963000-memory.dmp

Download

memory/5516-103-0x00000000003A0000-0x0000000000963000-memory.dmp

Download

memory/5712-1-0x0000027EEED20000-0x0000027EEED30000-memory.dmp

Download

memory/5712-0-0x0000027EEED20000-0x0000027EEED30000-memory.dmp

Download

memory/5712-9-0x0000027EF1140000-0x0000027EF1162000-memory.dmp

Download

memory/5712-10-0x0000027EEED20000-0x0000027EEED30000-memory.dmp

Download