3a5da3572f2862af3e282bdaf1b2a16a031104db2488267fe8472710e2c2d9e9

Analysis

user interaction
yes
max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New folder (3)/dsadsa67 - Copy (5).exe
Size 130KB
Sample261024-xwtmda1v2k
SHA256 3a5da3572f2862af3e282bdaf1b2a16a031104db2488267fe8472710e2c2d9e9
MD5 00b986d65686456999e2a2713cd51631
SHA1 2aa6b3f701f62046901b364772f8fff04fc30220
SHA512 ba440d1a6680b0137fb251a6e8b69b4df96f761f09a1867a9eb378e30e61b09474b5c355b26c0e24ed7297acc6a4c32da9e317081599af10e97595c9c3ed60ab
SSDEEP 3072:hLvGqHnesdKOvJAMGVWAGSgEGHrwC0jsMqBqSGK+tqenvL:FHnes1+MGVBBhnjD
TLSH
T14AD38D5FA3E530F9E177963884A10A45E776B43207609FEF07E4025A2F276D18D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	dsadsa67 - Copy (5).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\New folder (3)\\dsadsa67 - Copy (5).exe\""	dsadsa67 - Copy (5).exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\winnotify.sys	dsadsa67 - Copy (5).exe
File opened for modification	C:\Windows\System32\drivers\winnotify.sys	dsadsa67 - Copy (5).exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5060	sc.exe
5824	sc.exe
4732	sc.exe
5932	sc.exe
3548	sc.exe
2104	sc.exe
5352	sc.exe
5224	sc.exe
2924	sc.exe
5276	sc.exe
6040	sc.exe
644	sc.exe
3240	sc.exe
3300	sc.exe
1764	sc.exe
5896	sc.exe
4856	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1124	cmd.exe
888	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dsadsa67 - Copy (5).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dsadsa67 - Copy (5).exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	dsadsa67 - Copy (5).exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 5060	4756	dsadsa67 - Copy (5).exe	92
PID 4756 wrote to memory of 3240	4756	dsadsa67 - Copy (5).exe	94
PID 4756 wrote to memory of 3300	4756	dsadsa67 - Copy (5).exe	96
PID 4756 wrote to memory of 3548	4756	dsadsa67 - Copy (5).exe	98
PID 4756 wrote to memory of 1124	4756	dsadsa67 - Copy (5).exe	100
PID 1124 wrote to memory of 5352	1124	cmd.exe	102
PID 1124 wrote to memory of 2104	1124	cmd.exe	103
PID 1124 wrote to memory of 5224	1124	cmd.exe	104
PID 4756 wrote to memory of 5824	4756	dsadsa67 - Copy (5).exe	105
PID 4756 wrote to memory of 2924	4756	dsadsa67 - Copy (5).exe	110
PID 4756 wrote to memory of 1764	4756	dsadsa67 - Copy (5).exe	112
PID 4756 wrote to memory of 4732	4756	dsadsa67 - Copy (5).exe	114
PID 4756 wrote to memory of 5932	4756	dsadsa67 - Copy (5).exe	116
PID 4756 wrote to memory of 5276	4756	dsadsa67 - Copy (5).exe	118
PID 4756 wrote to memory of 888	4756	dsadsa67 - Copy (5).exe	120
PID 888 wrote to memory of 5896	888	cmd.exe	122
PID 888 wrote to memory of 6040	888	cmd.exe	123
PID 888 wrote to memory of 4856	888	cmd.exe	124
PID 4756 wrote to memory of 644	4756	dsadsa67 - Copy (5).exe	125

C:\Users\Admin\AppData\Local\Temp\New folder (3)\dsadsa67 - Copy (5).exe
"C:\Users\Admin\AppData\Local\Temp\New folder (3)\dsadsa67 - Copy (5).exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create winnotify type= kernel start= system binPath= "\SystemRoot\System32\drivers\winnotify.sys"
  2⤵
  - Launches sc.exe
  PID:3240
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:3300
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start winnotify
  2⤵
  - Launches sc.exe
  PID:3548
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\hp_467a1578ac2d46f68355df54496c3130\load_driver.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:5352
- - C:\Windows\system32\sc.exe
    sc.exe start winnotify
    3⤵
    - Launches sc.exe
    PID:2104
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:5224
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:5824
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:2924
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config winnotify binPath= "\SystemRoot\System32\drivers\winnotify.sys" start= system
  2⤵
  - Launches sc.exe
  PID:1764
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:4732
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start winnotify
  2⤵
  - Launches sc.exe
  PID:5932
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" qc winnotify
  2⤵
  - Launches sc.exe
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\hp_74408e5e58594d5da4e44fd2586016b1\load_driver.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:5896
- - C:\Windows\system32\sc.exe
    sc.exe start winnotify
    3⤵
    - Launches sc.exe
    PID:6040
- - C:\Windows\system32\sc.exe
    sc.exe query winnotify
    3⤵
    - Launches sc.exe
    PID:4856
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query winnotify
  2⤵
  - Launches sc.exe
  PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

load_driver.bat

Path C:\Users\Admin\AppData\Local\Temp\hp_467a1578ac2d46f68355df54496c3130\load_driver.bat
Size 260B
SHA256 cc2a59e20e459b44c2f08be25b235f51b50c79393cdfb67fd361a1982908d5c3
MD5 6dbd7006f91cb3b368dcd9ee035b0ee2
SHA1 b7bd73f64f3d9ac4679e30a8f29859d5aeceddc1
SHA512 6043e5ea3f270e92124e0fff4bf943039f7298e7106d15229b108ad06fce18e330edb75c47d039fb4679613009da3607304beb3c8adeec3ef894dc730bec9be2
TLSH
T1C8D02B98F04FCA146634C402855762B1D1A34C112514994403F2510C644538FE9E3A03
MD5 SHA1 SHA512 TLSH

Submit Download

load_driver.bat

Path C:\Users\Admin\AppData\Local\Temp\hp_74408e5e58594d5da4e44fd2586016b1\load_driver.bat
Size 260B
SHA256 b99e0af5e61aa82b0b0c9ade395951f599401ee89ebdf87cba9b809a2a0e8320
MD5 f97da92ae94299f469216b8b19155c0f
SHA1 158a119db8b2d485f9d9c151660d1954fc9164b4
SHA512 c37cdda51aba59ed4f48555acebe10f5e61edab8e91eedf25a8b9436e4309ae70b288971cc396dd20e5073840254a686ee80a0fff1982f879bc8e0a8723656bf
TLSH
T15AD02B88E04F8A245F3494028E5772B4E1A7482115105A440BE2410C348564FD9E2507
MD5 SHA1 SHA512 TLSH

Submit Download

msft.sys

Path C:\Users\Admin\AppData\Local\Temp\hp_74408e5e58594d5da4e44fd2586016b1\msft.sys
Size 26KB
SHA256 4dc3a03a046c210a7c6cd37db8d6bd34bf3760a612232cc82acf941a9e508e0f
MD5 e052ac7d39d07f6657cf049aae0c5b60
SHA1 9582337fdd6165dca71c6ae1c8c0222c6a10de77
SHA512 0e64a4cd6ac4301d7a9b49728f9acf5cb359801f28e13f12031383230b432147150579c4146013a5d121ca40736d3135cf45f51e4263990fa57f8fadf8adadd4
SSDEEP 768:aFJovHBgeCeXTjGxm1yW323mwGOrF9zDtGH:xvGk0mX32WyLzhW
TLSH
T123C26DD1967864C3DAAF997483D0ED63BC39728223215ADF02E5CA141F937D4FB38629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4756-8-0x000001E5CD940000-0x000001E5CD94A000-memory.dmp

Download

memory/4756-4-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

memory/4756-5-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

memory/4756-6-0x000001E5CDF70000-0x000001E5CDFD2000-memory.dmp

Download

memory/4756-7-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

memory/4756-0-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

memory/4756-9-0x000001E5CD720000-0x000001E5CD728000-memory.dmp

Download

memory/4756-10-0x000001E5CE020000-0x000001E5CE04C000-memory.dmp

Download

memory/4756-12-0x000001E5B4C90000-0x000001E5B4CAC000-memory.dmp

Download

memory/4756-15-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

memory/4756-3-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

memory/4756-2-0x000001E5B4C40000-0x000001E5B4C4C000-memory.dmp

Download

memory/4756-1-0x00007FFD27D90000-0x00007FFD28059000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads