fc04ff34c6ffa4f27dcf462bf161895e40a5b46b006a691a1d8c8ce5c70283a7

Analysis

max time kernel
30s
max time network
19s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/10/2026, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
installer.exe
Size 7.8MB
Sample261024-dz9m8aeb64
SHA256 fc04ff34c6ffa4f27dcf462bf161895e40a5b46b006a691a1d8c8ce5c70283a7
MD5 1ddba281a30ccbf92cd17d07d8133dc8
SHA1 f0e4bc386a2b05b2bb9ed03b8e8904dda6418cbf
SHA512 8dfd4a22ec5bfbc4b22f8600c0d49f79b21b45fd40cf05242d9647efe542a0caf1cce48da10bac59a8b363808aef67854f766ffc9a159cb352326864f38199df
SSDEEP 196608:Y1uQM6fbOS7v76HtDu4Jok2E8/h1siMfe:YKwzpsY
TLSH
T130869E12D5FE5F39C3EE833A56B74209DF779A4D4303D26B0848BAB59C533362D4262A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4972	7zr.exe
832	AutoIt3_x64.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	api.ipify.org
13	api.ipify.org

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3_x64.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
832	AutoIt3_x64.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4972	7zr.exe
Token: 35	4972	7zr.exe
Token: SeSecurityPrivilege	4972	7zr.exe
Token: SeSecurityPrivilege	4972	7zr.exe
Token: SeDebugPrivilege	832	AutoIt3_x64.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4972	4500	installer.exe	84
PID 4500 wrote to memory of 832	4500	installer.exe	86
PID 832 wrote to memory of 4464	832	AutoIt3_x64.exe	87
PID 4464 wrote to memory of 2332	4464	calc.exe	88

C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\7zS49179858\7zr.exe
  .\7zr.exe x -aoa -p"DrZ5py$HsJ@tSZkRU$j4&Sv" setup.7z
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Users\Admin\AppData\Local\Temp\7zS49179858\AutoIt3_x64.exe
  .\AutoIt3_x64.exe setup.dll
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS49179858\7zr.exe
Size 911KB
SHA256 9252d92abebb9347a80958d330aa4b47a94a50aa4ceebcbb76839ee4d7a9cecd
MD5 ac76f0d508f03b83def1fd001bd81630
SHA1 c765effa04a409a46a2c8a0e8f30c7acf993e871
SHA512 f1a905debd297f0c7ca34f23e7e034e2565bcdd99d03ad5d286658ff806cecbe0eb8e8d360cbd582cb748815f83a92e146ecfd609116281ab6f0db546b19c71c
SSDEEP 12288:uZcsd0c7n+9FONoc0r6PxspOJsKe9Yhkst6UUElE/TzhWY2yhleWL:odtniYec86kExtPUEe/TzIy
TLSH
T1F1152B66F6788271D073C0B9C5D29A9AEE723085173086C71286D77C3F57BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS49179858\AutoIt3_x64.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.7z

Path C:\Users\Admin\AppData\Local\Temp\7zS49179858\setup.7z
Size 598KB
SHA256 a8eb23175b8945023ce7edd09a3b8429565fc746557e2db00aea9b71e3200ded
MD5 e2ce430cb6ec25a743c408c5faf18fb0
SHA1 fb4d850d2b9e1bc873db3635f5e9a658da0346cc
SHA512 92e73dda690057ca825a03a33fb6d83daeb3770cb18e856844f40fd90525ff008f7f7d07ed714ca830fe78b6725b7eeca156db47df34bf765732235f55df3b9e
SSDEEP 12288:uFny+/K6XzbtLm9J0iJ8j+MJwgHxFoCp8mVv7hBhRkcKAmyxbLiG2O2r1A9:uw+/KcntLuVCjTSgJ/7scKAxOGgxq
TLSH
T1C3D4230E6EA050EFA6C9F546720F753E769ECF475AC135CB4284AFF8463BF482944162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS49179858\setup.dll
Size 186KB
SHA256 e1eaf7e1505894da183edcbdd39e1ca7957be7e050e399cb3b8a19cb6ee2caef
MD5 295612076d51b5b227b2998ff407e59b
SHA1 ee522f17ce73511fa02b0248bc2916ce022277a8
SHA512 c2558b3f4570acddbb7dac29ea226863dc146ea54b0b369f4cb164cf82feb71cc9d2fd8a2c5d0173647a539c8e8d2665409782fcbdddc10f6247d938184d0c89
SSDEEP 3072:75HLhoyITSklPICwZWRbymAIXriRExXa41Z4zmsAYoBDWkiJZXIP1jDvoZK:pKak1G2bjhbi+ha4fiS/nijXIdj8ZK
TLSH
T1681413BFD84502EAB45989CC119B094205D7D6EA39D724ED488B6CDE3B403E1C878FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oskcczdj.4mw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oskcczdj.4mw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/832-18-0x0000021E99A80000-0x0000021E99A8E000-memory.dmp

Download

memory/832-20-0x0000021E99A80000-0x0000021E99A8E000-memory.dmp

Download

memory/832-21-0x0000021E9C2D0000-0x0000021E9C2E0000-memory.dmp

Download

memory/832-22-0x0000021E9C170000-0x0000021E9C176000-memory.dmp

Download

memory/832-23-0x0000021E9C2D0000-0x0000021E9C2E0000-memory.dmp

Download

memory/832-31-0x0000021EB4830000-0x0000021EB4852000-memory.dmp

Download

memory/832-32-0x0000021E9C2D0000-0x0000021E9C2E0000-memory.dmp

Download