Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 07:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe
- Size 2.2MB
- Sample260415-jha18abz21
- SHA256 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102
- MD5 36be2cbb59cd1c3f745d5f80f9aee21c
- SHA1 d0f8b7885e65a2d0714f91f7275d100bca25a886
- SHA512 9de8339e7e343129fa1ff1d8ac30359f252c7f202d05305fcbf87d0a61d1d4c6933ffe8a112cf49389f0e29b6b4040e709bb17af03ed97b3e5f578e3c45c4921
- SSDEEP 49152:LyzNg7jH8hXgcewfXzWNIj/TzCqhBNsEIU3B7uRNroI44p:LyzNrlewfXrBNNI
- TLSH T1AFB59E82BAC1C472F2631230442AA77856B9BE60F73189DB63D47E0D9D715C2ED3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dism.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\Desktop\MuiCached 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4456 wrote to memory of 5780 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 84 PID 4456 wrote to memory of 5780 4456 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe"C:\Users\Admin\AppData\Local\Temp\3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\dism.exeC:\Windows\System32\dism.exe2⤵
- System Location Discovery: System Language Discovery
PID:5780
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
- Size 2KB
- SHA256 3de315041ce37608dfca4a4421978d49162ee80707a475143fbe985761db5208
- MD5 ee6de2e0f7f7e69ca66b1488c1e2aec6
- SHA1 4446cd94f377d336b88861dce7f1ad2c48514102
- SHA512 03b483b6af2acd665a7e6450aa958d7fc286e738207afa0d11b6e594469af275aeca06aa527f713f6d682adda2662b337ebbac6409d230bd2d6c2ffb71116fcf
- TLSH T170514EC17C7C80F3E6184955E2512FBF22F43D77CA81AC0667954984783CE00AEAF939
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 744B
- SHA256 254a1c9af0210c88349a186a0a3e75acbccbf9ed5988d9e23dcac15e20344eaa
- MD5 ce72d6fa41730c1a1f959e2c50ebc736
- SHA1 064f9d74757f12e33eaa6aa9c4f654638968fa34
- SHA512 5f9916d586198a20991e3bbbce06ba51c58f335001fd22325a0051951a5cc91962aca576348bf94fdd426afa83c48bab0d896bf14ce29480a98cd6065716a7c7
- TLSH T12D01DAA918FD9072D57E2B30A9142FDB95E67C32D250CC82579489C8B93CE4C06EFB24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 2KB
- SHA256 182497df2b068805f2ec006f1a963ad35178b7ff7e31e6c3ecefd46cab1a1a93
- MD5 23e01c72c7b0f380c06a5670e4d4b77e
- SHA1 3204f9191a45f39ae56c241d0d2c1a630a4602b0
- SHA512 2e12faf76965251800e4efe2839d5356c5782b79b7704bba3d8c7acc283ef0404589d4f1872a532b6e18ef3e0d09404a0da72b1a390765eac7113de15816695d
- TLSH T1AB412B586ABC9177D53A2B2489643FEF91E13C35D228CCE257A108E0BC3CD5406BEB97
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 2KB
- SHA256 f2d0b7d73624f4f98dfe4a337d6ed38d83082a8f6050cc8ba8d25423a0e4360e
- MD5 697219dd10cab0f8229b8889e9132f25
- SHA1 7b56905e6c5fef14ec302ce63a677904d903106c
- SHA512 42a95126c7ac15fc8570b95bba2db3ea99ff6a1de7d25e916ab51b3fa38b76dd8a4aca91c5ea19e6a31c3e6a63c4a7dcda28e5f561a7e3f60f79f8d6ea274868
- TLSH T156515A586ABC9177D53A2B2489643FEF91E13C35D228CCE257A108E0BC3CD5006BEB97
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 3KB
- SHA256 e719be9010fd93a891105e3d47103de177895ed02c09704392b0ec0feea261e1
- MD5 3c9efe5db0bcf6a494639ff17fde9659
- SHA1 89a295f275e4b48dd016161806d41e749c98674f
- SHA512 1ed09523b131d02252edde0ab014251965d36726274ad3bf7353e3e35d4bb0e7c32bdbe5fe3fb555b1565b2fdd83a36e31323115a9185e70d687811f51c85447
- TLSH T14C6178586ABC9176D53A2B2489643FEF91E13835D228CCE257A108E0BC3CD5006BEB97
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 4KB
- SHA256 0031beb8a80f38858c12f5e7a30e982cbfe66114bfe54f473a58c2865025dc1c
- MD5 4fc1094bd92680bf61ffd347a933de21
- SHA1 9e972fa453be574e56ed55cbcf8b72836522e868
- SHA512 599b032aa250a248bd6992ba6a94b5edfeb3df5da8c1c441d8d4d39875f59312b5cac7f57b119f52f240acbdd62513d712e83ef5b78203ea69eb301bc99057d6
- SSDEEP 48:ogTwkAWuQhjwwJJuunn00NNFUFUrrYYR8ER8EOEOEwwwwwwwwwwwwwwwwwwwwwwc:o46Zjr
- TLSH T15F8197586BBC9176D53A2B2489643FEF91E13835D228CCE257A108E0BC3CD5006BEB97
- MD5 SHA1 SHA512 SSDEEP TLSH