ce381262e394dd702ed24478eb6554841c47e1e0ae7ac87c7a1bf6b7006f77e9

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-vaxe2aa12t
SHA256 ce381262e394dd702ed24478eb6554841c47e1e0ae7ac87c7a1bf6b7006f77e9
MD5 e475428fdcd6f1f15aa0f8569af7a87e
SHA1 040f2e21932eb1c4d3ad5768a8f2670c77e5ab36
SHA512 6fbc414c7de1a48ec6c12afb02efeb99b5c8192c47100fc73af51351b10e1423fd9faf7abcb82bb3efe76e47d5f857c8afc5ee05e831f6173040c1805d3faf4f
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXa:q6chqTShW/hNbSiQfMJPLmrUlsa
TLSH
T1DE97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5128	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	EOpaba.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	EOpaba.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ZVsfO8\\EOpaba.exe\""	EOpaba.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5568	cmd.exe
1900	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	EOpaba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3092	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EOpaba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EOpaba.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1640	schtasks.exe
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
4968	install.2.0.02.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe
2320	EOpaba.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 5128	2320	EOpaba.exe	91
PID 2320 wrote to memory of 1900	2320	EOpaba.exe	93
PID 1900 wrote to memory of 1640	1900	cmd.exe	95
PID 1900 wrote to memory of 2828	1900	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4968

C:\Users\Public\ZVsfO8\EOpaba.exe
"C:\Users\Public\ZVsfO8\EOpaba.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZVsfO8\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZVsfO8\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1176

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZVsfO8" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3092

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1884

C:\Users\Public\ZVsfO8\EOpaba.exe
"C:\Users\Public\ZVsfO8\EOpaba.exe"
1⤵
PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 c7cabf8a593fd2e39ddd70f5efc9b900b6d18725b3ec1aaa99f6659e3d25a004
MD5 6398e883089b5ff7d598fa2e2f4385c1
SHA1 a4f9097703aefad709f3dbda1a40b833afd5dbda
SHA512 116e6e903d1604146cee65d288bad830716bf705f1d7dd0eaf172b28bbe20fc7fd5c16a8486d2ff02fe86a21c61c43b39ee8fdae42893021a1a24032ca675ce4
TLSH
T17C3196BB3FBD3C828F294D5425C9A6222CF5E1406CC6589E6255C498DF053B22F4F50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 10cc0461e16975f580142e5d8fbe79ebf4710c8c8a689dcbd73a5a841019bb37
MD5 dca34bf0bff0d6f1d580d41db7ce69c7
SHA1 10247f4c6308cde2152f2866f520f59dc32d1dd8
SHA512 23c8b67bdde44d93ac44cc2f8286ae41e6d37ea02100c7a63827b974271def20036c7e05700388550c675353fc8d439ec51e47b2f15b91673272f3e6703d4cd0
TLSH
T131311A939F3920829F0D1F7922C0C537BCF1A5304CB40886663ED2AB4E06B77AF86411
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a81eef5fca95b9eca2f1293b714dc751845c21b7d97ebb423bce843a877a4394
MD5 cf68c4f835262d2a130d88cfe0e05e59
SHA1 9bf121b36175ff3437f5ddaf25153d7a982112ea
SHA512 039bcf33bd16d9571e108438412928429cd96983eb3ea2b7f83697ecdbe31e88ff570881ab7c5b931e439f1663c17134f81e78dc5528605d1c0732d07e3259d9
TLSH
T102F05C1448BC613DF133DA3D8BC939D6066EEA02340645A40AA44708AA157462D919B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 709e2df447d2dd7bf6fa4cc6b3fcaa722e1894c999f482dd8de2840ad626dab3
MD5 642bb13b67cd65cf6107d42932d2012c
SHA1 fb8d62f251e40a4e802918a4280686166f4f49c1
SHA512 26f10c8f48f1766ba3e36650a52c3e4863abc78d9c39484bc576c816ff8fbf2201e9b6493dad4803b56c927d49becf2e7a46e2d7bf21da53fe18b479698abc34
TLSH
T1DAF05C2D55DD011FF47BD3B887C779719D26D227049752BB0AEA03451E51D423C0136E
MD5 SHA1 SHA512 TLSH

Submit Download

EOpaba.exe

Path C:\Users\Public\ZVsfO8\EOpaba.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ZVsfO8\UxEnhance64.dll
Size 3.1MB
SHA256 0ffa683ff289b29d342586a8a079a368da064a40ce45bbae55387defba395dc9
MD5 cbd7f05b327cb0542185a2b690d4d9d6
SHA1 33373371776dfec0be0a31159c15eb572ad69957
SHA512 d110f08c0e1aa8332ceed59ca0c7d126e5bfe5dc27bdbca75a78deb76ac0abde44567b9d57f39a9388922f0f2ae5bc206e70762d7f63f1b3e3a0c8e433e1023c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+U:P9m29xx3Tiqt06ox6+z2rNNrKoU
TLSH
T102E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ZVsfO8\UxEnhance64.dll
Size 1.1MB
SHA256 2558a54b38918c4ff72aaf9477370429bfe0f9245ccc8da0047a615af7e5a3d5
MD5 33191ec2c9bf62e5c7b9e356e4e9a93c
SHA1 e67bb5099f20e4b03e7d107e3d273196ae8c6bde
SHA512 1b6a371e049f8692a56f432085208ccb1ff91924fa701eac77925ceb9fc07ad9382c3d447db3b8a8d6e4e0adf1937edd9d9e9b906e25f199f32183fd6a43eeea
SSDEEP 24576:WTa0QKHReqZIMlcseQCIHfrPqxkglC6BKVu/ayHXBTswHCMJU5bmNY:P9KpI8cBa0kj6BK0x3TiMQcY
TLSH
T1F53523B8639378F3E47666F4FE7193D21C211E207F07904F1787204A5A5D1FA87AA3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ZVsfO8\adoresd.dat
Size 4.8MB
SHA256 69126f15c628a7d3267179975702741d2a10be7f3e0b8f497c5860c77e387fa8
MD5 d462cf3d256d98d701dedc38872d166c
SHA1 2f400720e1a9773e68ebdb4907a38c87549df2e8
SHA512 82b68f0b55ad33883f29966e9acd1b200d7eb384bed5a1e067a2b0a1f451725304765fc54d3c7b9e5db3f99344245a87ecde32b039893d9faaf37a3d3ef02d4a
SSDEEP 98304:PWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:PWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1933633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ZVsfO8\msadox.tb
Size 8KB
SHA256 9837f2ca73f3ef987161a1f2cda5b02f55e828088778402cac602aa425f325f7
MD5 8d9a158329de0de75f06c6a3086e77ae
SHA1 2e3194139d95906c1b6c731fa9827bc1cb8157b3
SHA512 0445f80ebe54da5cb025249a970cdc1eb0bea9bb43eca6efe50d79361b66cbc2cc3cd34ff53234b0e900719f628aa1bfa32ecd32e434fde2781796c7dd6ed7d1
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T13B029E06D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2320-546-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-556-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-530-0x00007FFEE8AB0000-0x00007FFEE8AB2000-memory.dmp

Download

memory/2320-536-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-538-0x00007FFEE8AC0000-0x00007FFEE8AC2000-memory.dmp

Download

memory/2320-543-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-539-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-566-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-544-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-545-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-550-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/2320-531-0x00007FFEC6230000-0x00007FFEC674E000-memory.dmp

Download

memory/2320-562-0x000001E9FB140000-0x000001E9FB1CA000-memory.dmp

Download

memory/2320-561-0x000001E9FB140000-0x000001E9FB1CA000-memory.dmp

Download

memory/2320-560-0x000001E9FB140000-0x000001E9FB1CA000-memory.dmp

Download

memory/2320-559-0x000001E9FB140000-0x000001E9FB1CA000-memory.dmp

Download

memory/2320-558-0x000001E9FAFD0000-0x000001E9FB01E000-memory.dmp

Download

memory/2320-564-0x000001E9FA360000-0x000001E9FAC37000-memory.dmp

Download

memory/4968-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4968-525-0x00007FFEDCE70000-0x00007FFEDCE82000-memory.dmp

Download

memory/4968-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4968-504-0x00007FFEDCE70000-0x00007FFEDCE82000-memory.dmp

Download

memory/4968-2-0x0000000001F50000-0x0000000001F5C000-memory.dmp

Download

memory/4968-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download