Overview

overview

8

Static

static

3

تلغيم...ا.exe

windows10-2004-x64

7

تلغيم...ا.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    889s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 22:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    تلغيمه غير اسمها.exe
  • Size 21.7MB
  • Sample261107-2prlnafy91
  • SHA256 6dd819fec3ed5b282b4df8f14c7c608a05c1c39d3fa7975597e48e47d102ce56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 39 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe
    "C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe
      "C:\Users\Admin\AppData\Local\Temp\تلغيمه غير اسمها.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1980
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5224
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3996
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4248
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2780
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:820
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:1712

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 603B
            • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\VCRUNTIME140.dll
            • Size 174KB
            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_asyncio.pyd
            • Size 76KB
            • SHA256 fb0768cc8b00cee43638bea2770cae08f2076298ec3db07634818448b6ad67c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_bz2.pyd
            • Size 84KB
            • SHA256 2ae45b2ff932dc8a864c862d8150eb3f5b55e60e3e74ec554c4f52c4f1ad81e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_ctypes.pyd
            • Size 140KB
            • SHA256 8bb22628ae859877b1cf55381c1a8cf54bb0aa70c56295053bc3303262e21c87
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_hashlib.pyd
            • Size 71KB
            • SHA256 3cfb95355576805d6362b878d2207e254125887fce12ff8199becab34beb0694
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_lzma.pyd
            • Size 167KB
            • SHA256 d9033e94387aa70777d23514263d342486899256ffc14478be6bb1e6a0b05683
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_overlapped.pyd
            • Size 56KB
            • SHA256 077d6a9ce8a3d379a06d78ac4be2efcf35006fff6cd5be4cd5f574d83e7a9c01
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_socket.pyd
            • Size 86KB
            • SHA256 ba52c110c0cbc429add306acccf86dd2f77c777a9db68df7cddfc4489e91bce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sqlite3.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_sqlite3.pyd
            • Size 129KB
            • SHA256 851e8bfa65328162ddad2dff9f7c213f8eceb2d90baf179aa472704ec3ca6295
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_ssl.pyd
            • Size 195KB
            • SHA256 a9c54ec4d115597880e0e44ff26b740328d0388a777dfb613d3aa2eb66b31e49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _uuid.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_uuid.pyd
            • Size 27KB
            • SHA256 a3380826957922fae7350f5ea64fface688bf55c79e086823a4b1d50455a9bfa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_wmi.pyd
            • Size 38KB
            • SHA256 0650bf237b3f556ba844ba372fef6de1b65d618a608014405360aef83f8a4e34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\_zstd.pyd
            • Size 494KB
            • SHA256 a977471edf7b6712a9e89ada98b79b1973c79740632f820b67365f242b5e05cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _http_parser.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\aiohttp\_http_parser.cp315-win_amd64.pyd
            • Size 302KB
            • SHA256 de8d12b3bdbded5f7cda7a1616d93bdf4ad151abfe5276e03ac2322601f2eb3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _http_writer.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\aiohttp\_http_writer.cp315-win_amd64.pyd
            • Size 43KB
            • SHA256 4797c4dfc14423d4dcdcbde19692d8ed1744a68207b3c5a98e3b1625186037a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mask.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\aiohttp\_websocket\mask.cp315-win_amd64.pyd
            • Size 34KB
            • SHA256 ad05013c58a9d1b73cb29ce9999ba01d47eafa2e2c66bb52516f7ce0344aadb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            reader_c.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\aiohttp\_websocket\reader_c.cp315-win_amd64.pyd
            • Size 151KB
            • SHA256 8bffce4d32d6920bd2a8a9619daddb97bd778efef9c8d50c9a7fe4620ec5c0bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\base_library.zip
            • Size 1.4MB
            • SHA256 1b83d18175295017f9c43ac80de10de8370de520e84d9d411709453c303f8e1a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            davey.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\davey\davey.cp315-win_amd64.pyd
            • Size 2.4MB
            • SHA256 dc156dcefcae26a4dbd7ba7c608215d0a8c2e7d74c27a25d80d73c127e393f8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\libcrypto-3.dll
            • Size 5.7MB
            • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\libssl-3.dll
            • Size 1.2MB
            • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multidict.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\multidict\_multidict.cp315-win_amd64.pyd
            • Size 127KB
            • SHA256 3ecd6c9ec6c331a9bcab9bad8b20d6e1453986bff7521fc1cb0923f3cc97bf1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _helpers_c.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\propcache\_helpers_c.cp315-win_amd64.pyd
            • Size 65KB
            • SHA256 2ac2fbf7fc98263fcd914bc27c38548fe5b2dd301bb7c6f9e1a3dc7a5f8b77d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\python3.dll
            • Size 74KB
            • SHA256 e394c32bb9e2f0d813f4ed5b858ba717e54e3e6547cd36a8d8aaee66b9ca347f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python315.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\python315.dll
            • Size 7.5MB
            • SHA256 9862572fd449f32a62c1eaec2c6750a9c9fa512f4c9c2ea0e66776cf9212b7c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\select.pyd
            • Size 32KB
            • SHA256 d39e00967809d2d2cf8aea78f6fd39923cfb4ad426ccd19bbfe7163020dafffe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\sqlite3.dll
            • Size 1.6MB
            • SHA256 73530e8f4555605d716352ee98fe0ce205a09e5eec57e7e6360d4c915efcacd8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\unicodedata.pyd
            • Size 735KB
            • SHA256 ba69f643918cc520331c6a13d489d642131be23dd649d05e0cd1068fae92e76d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _quoting_c.cp315-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000137c2\yarl\_quoting_c.cp315-win_amd64.pyd
            • Size 80KB
            • SHA256 c0570d089c699300d1c43fed7f6d346ade4d20a1028243578d1baa1a4bf7dc67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3996-288-0x000000000E6B0000-0x000000000EF2B000-memory.dmp
            Download

            memory/3996-290-0x000000000E6B0000-0x000000000EF2B000-memory.dmp
            Download

            memory/3996-291-0x000000000E6B0000-0x000000000EF2B000-memory.dmp
            Download

            memory/3996-319-0x000000000E6B0000-0x000000000EF2B000-memory.dmp
            Download

            memory/4248-126-0x000001B9839A0000-0x000001B9839C0000-memory.dmp
            Download

            memory/4248-123-0x000001B983600000-0x000001B983620000-memory.dmp
            Download

            memory/4248-124-0x000001B983A80000-0x000001B983B80000-memory.dmp
            Download

            memory/4248-137-0x000001B993E10000-0x000001B993E30000-memory.dmp
            Download

            memory/4248-119-0x000001B9D4EA0000-0x000001B9D4FA0000-memory.dmp
            Download