a6b304da706f65520019273d5f35dc9ede582febfe9e9a1d87c482eb46433256

Analysis

max time kernel
101s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe
Size

1.6MB
MD5

fc7ba2336d7a69b388a1b103f2db8eee
SHA1

260c49e336bf3aaaba4cd49c0223a200730d3817
SHA256

2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e
SHA512

4fd2f24b99ab253579620a31565b231d3f5d2598381f5d988504468eed5d7ec560227509c571e8feb0b838e739777015b296ae045610f5767503302569f78670
SSDEEP

24576:DLILY8Xu/3y8UsG2BgYLicwnkyCHdebUKyZURQ1TgjTm:EYrC8UsGuTw3CHdeQKyZURQ1EjTm

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mls = "\"C:\\Users\\Admin\\AppData\\Roaming\\RAC\\mls.exe\" -s"	2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
728	WINWORD.EXE
728	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
728	WINWORD.EXE
728	WINWORD.EXE
728	WINWORD.EXE
728	WINWORD.EXE
728	WINWORD.EXE
728	WINWORD.EXE
728	WINWORD.EXE
728	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 728	1436	2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe	89
PID 1436 wrote to memory of 728	1436	2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe	89

C:\Users\Admin\AppData\Local\Temp\2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe
"C:\Users\Admin\AppData\Local\Temp\2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\RAC\mls.exe" -s
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1405114787.tmp

Filesize
1.6MB

MD5
fc7ba2336d7a69b388a1b103f2db8eee

SHA1
260c49e336bf3aaaba4cd49c0223a200730d3817

SHA256
2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e

SHA512
4fd2f24b99ab253579620a31565b231d3f5d2598381f5d988504468eed5d7ec560227509c571e8feb0b838e739777015b296ae045610f5767503302569f78670

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.docx

Filesize
12KB

MD5
c25a9d1c06d63bd88b9ca7dd1a4514ea

SHA1
7cfc2541cb8eaa8ea8ec9a999b5b75b674fe0257

SHA256
33eeff125594a40f3754f20e0f2475fc537905e12c4c7e93fb660ab151d3b23a

SHA512
6a598933b18e29f8ddf465ae6b615663e05505f4b8f20a8ae27aca40dc3626646891fbe59449b3c58c5773e4dc0ac957c464c72738897f6b2b5cab0b31d0c3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDF10F.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
8dddd0020e42cddf0c12e034ec955534

SHA1
1ba475a4810ea7c3e504d4eff9d42eb130eda293

SHA256
a2cd5d88ce49d6d90bcb460d5b958dca479dd965d38ba60f119f036ceda91663

SHA512
bdcd3aed3c4a881b832770944849b1a5cca5d40c8dd7239b56152ea588c1b01dabea3ce57c34d5f6a2c4c8333f5c5be5c8ac0c8cae552359ed1a211c7b7af687

Download Submit
memory/728-21-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-20-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-24-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-25-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-29-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-30-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-31-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-33-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-34-0x00007FF7E8C70000-0x00007FF7E8C80000-memory.dmp

Filesize
64KB

Download
memory/728-32-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-28-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-27-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-26-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-22-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-19-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-23-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-35-0x00007FF7E8C70000-0x00007FF7E8C80000-memory.dmp

Filesize
64KB

Download
memory/728-48-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-49-0x00007FF82B4ED000-0x00007FF82B4EE000-memory.dmp

Filesize
4KB

Download
memory/728-50-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-51-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-53-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-52-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-54-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-55-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download
memory/728-17-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-18-0x00007FF82B4ED000-0x00007FF82B4EE000-memory.dmp

Filesize
4KB

Download
memory/728-205-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-204-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-203-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-202-0x00007FF7EB4D0000-0x00007FF7EB4E0000-memory.dmp

Filesize
64KB

Download
memory/728-206-0x00007FF82B450000-0x00007FF82B645000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads