3a5da3572f2862af3e282bdaf1b2a16a031104db2488267fe8472710e2c2d9e9

Analysis

user interaction
yes
max time kernel
137s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New folder (3)/dsadsa67 - Copy (3).exe
Size 130KB
Sample261024-xwtmda1v2k
SHA256 3a5da3572f2862af3e282bdaf1b2a16a031104db2488267fe8472710e2c2d9e9
MD5 00b986d65686456999e2a2713cd51631
SHA1 2aa6b3f701f62046901b364772f8fff04fc30220
SHA512 ba440d1a6680b0137fb251a6e8b69b4df96f761f09a1867a9eb378e30e61b09474b5c355b26c0e24ed7297acc6a4c32da9e317081599af10e97595c9c3ed60ab
SSDEEP 3072:hLvGqHnesdKOvJAMGVWAGSgEGHrwC0jsMqBqSGK+tqenvL:FHnes1+MGVBBhnjD
TLSH
T14AD38D5FA3E530F9E177963884A10A45E776B43207609FEF07E4025A2F276D18D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	dsadsa67 - Copy (3).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\New folder (3)\\dsadsa67 - Copy (3).exe\""	dsadsa67 - Copy (3).exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\winnotify.sys	dsadsa67 - Copy (3).exe
File opened for modification	C:\Windows\System32\drivers\winnotify.sys	dsadsa67 - Copy (3).exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3336	sc.exe
308	sc.exe
3864	sc.exe
3048	sc.exe
2768	sc.exe
2188	sc.exe
1928	sc.exe
3256	sc.exe
4328	sc.exe
212	sc.exe
4824	sc.exe
1804	sc.exe
2420	sc.exe
2372	sc.exe
4628	sc.exe
4004	sc.exe
1032	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe
3160	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dsadsa67 - Copy (3).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dsadsa67 - Copy (3).exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	dsadsa67 - Copy (3).exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1032	4508	dsadsa67 - Copy (3).exe	91
PID 4508 wrote to memory of 2768	4508	dsadsa67 - Copy (3).exe	93
PID 4508 wrote to memory of 2420	4508	dsadsa67 - Copy (3).exe	95
PID 4508 wrote to memory of 4328	4508	dsadsa67 - Copy (3).exe	97
PID 4508 wrote to memory of 4048	4508	dsadsa67 - Copy (3).exe	99
PID 4048 wrote to memory of 3048	4048	cmd.exe	101
PID 4048 wrote to memory of 3864	4048	cmd.exe	102
PID 4048 wrote to memory of 212	4048	cmd.exe	103
PID 4508 wrote to memory of 308	4508	dsadsa67 - Copy (3).exe	104
PID 4508 wrote to memory of 2188	4508	dsadsa67 - Copy (3).exe	108
PID 4508 wrote to memory of 4824	4508	dsadsa67 - Copy (3).exe	110
PID 4508 wrote to memory of 3336	4508	dsadsa67 - Copy (3).exe	112
PID 4508 wrote to memory of 2372	4508	dsadsa67 - Copy (3).exe	114
PID 4508 wrote to memory of 1804	4508	dsadsa67 - Copy (3).exe	116
PID 4508 wrote to memory of 3160	4508	dsadsa67 - Copy (3).exe	118
PID 3160 wrote to memory of 4628	3160	cmd.exe	120
PID 3160 wrote to memory of 4004	3160	cmd.exe	121
PID 3160 wrote to memory of 1928	3160	cmd.exe	122
PID 4508 wrote to memory of 3256	4508	dsadsa67 - Copy (3).exe	123

C:\Users\Admin\AppData\Local\Temp\New folder (3)\dsadsa67 - Copy (3).exe
"C:\Users\Admin\AppData\Local\Temp\New folder (3)\dsadsa67 - Copy (3).exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:1032
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create winnotify type= kernel start= system binPath= "\SystemRoot\System32\drivers\winnotify.sys"
  2⤵
  - Launches sc.exe
  PID:2768
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:2420
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start winnotify
  2⤵
  - Launches sc.exe
  PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\hp_d37fd263731d442c80e8662b0c282d02\load_driver.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:3048
- - C:\Windows\system32\sc.exe
    sc.exe start winnotify
    3⤵
    - Launches sc.exe
    PID:3864
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:212
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:308
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:2188
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config winnotify binPath= "\SystemRoot\System32\drivers\winnotify.sys" start= system
  2⤵
  - Launches sc.exe
  PID:4824
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:3336
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start winnotify
  2⤵
  - Launches sc.exe
  PID:2372
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" qc winnotify
  2⤵
  - Launches sc.exe
  PID:1804
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\hp_64932a7676824bf2a40370db765b0139\load_driver.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:4628
- - C:\Windows\system32\sc.exe
    sc.exe start winnotify
    3⤵
    - Launches sc.exe
    PID:4004
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:1928
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

load_driver.bat

Path C:\Users\Admin\AppData\Local\Temp\hp_64932a7676824bf2a40370db765b0139\load_driver.bat
Size 260B
SHA256 862d762620be9ee39c9971f66876e9f930f46f6e6aa8ff6ca0d420e359562e8d
MD5 acb26419e31236ebbbb47307d272ebf5
SHA1 0c3af009fe031c81e058ab1d43c409b9f2ea7661
SHA512 2243fbd9ba3fce632c99f52ec5097e7d69691f4bcb4acc0b9db7c9f2b98a37ec32acb50f5d47aec9668ddd3cf28dc87a60daf8cc1777c32a986fafdebbfc72d3
TLSH
T1FFD02B99F04F8E18D538C101CA0361B0D06349212914DE4043F2514CA4C934FE8E2603
MD5 SHA1 SHA512 TLSH

Submit Download

msft.sys

Path C:\Users\Admin\AppData\Local\Temp\hp_64932a7676824bf2a40370db765b0139\msft.sys
Size 26KB
SHA256 4dc3a03a046c210a7c6cd37db8d6bd34bf3760a612232cc82acf941a9e508e0f
MD5 e052ac7d39d07f6657cf049aae0c5b60
SHA1 9582337fdd6165dca71c6ae1c8c0222c6a10de77
SHA512 0e64a4cd6ac4301d7a9b49728f9acf5cb359801f28e13f12031383230b432147150579c4146013a5d121ca40736d3135cf45f51e4263990fa57f8fadf8adadd4
SSDEEP 768:aFJovHBgeCeXTjGxm1yW323mwGOrF9zDtGH:xvGk0mX32WyLzhW
TLSH
T123C26DD1967864C3DAAF997483D0ED63BC39728223215ADF02E5CA141F937D4FB38629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_driver.bat

Path C:\Users\Admin\AppData\Local\Temp\hp_d37fd263731d442c80e8662b0c282d02\load_driver.bat
Size 260B
SHA256 55a31bcb2d85dfc576e5c332482ccc6c29c79e2196dd198def85ee6e658c7977
MD5 ad54d0d2f90cc508b3e462293e1e7a59
SHA1 46dbf4b2bae1ff6c0494c49810289b338b093036
SHA512 12f115189b76ce229a8f177c5057d707daf7f5d5ecb04aa11de3d880b9919a031dfb90d9a3116abc3da8d780507323c44175ffa2d5743b26a71386ba4fa54e6b
TLSH
T18CD095EDE05FCE15A638D006C51761F0F063482226509A4047F3510C316434FD9F2903
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4508-12-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-14-0x00007FF87BD45000-0x00007FF87BD46000-memory.dmp

Download

memory/4508-5-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-6-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-7-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-8-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-9-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-10-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-11-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-0-0x00007FF87BD45000-0x00007FF87BD46000-memory.dmp

Download

memory/4508-13-0x0000027FEF6A0000-0x0000027FEF702000-memory.dmp

Download

memory/4508-4-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-15-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-16-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-17-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-18-0x0000027FEE290000-0x0000027FEE29A000-memory.dmp

Download

memory/4508-19-0x0000027FEE2A0000-0x0000027FEE2A8000-memory.dmp

Download

memory/4508-22-0x0000027FEE430000-0x0000027FEE44C000-memory.dmp

Download

memory/4508-26-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-3-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-20-0x0000027FEF750000-0x0000027FEF77C000-memory.dmp

Download

memory/4508-27-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-2-0x00007FF87BA90000-0x00007FF87C431000-memory.dmp

Download

memory/4508-1-0x0000027FEE240000-0x0000027FEE24C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads