Analysis
- max time kernel
149s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 07:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe
- Size 2.2MB
- Sample260415-jha18abz21
- SHA256 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102
- MD5 36be2cbb59cd1c3f745d5f80f9aee21c
- SHA1 d0f8b7885e65a2d0714f91f7275d100bca25a886
- SHA512 9de8339e7e343129fa1ff1d8ac30359f252c7f202d05305fcbf87d0a61d1d4c6933ffe8a112cf49389f0e29b6b4040e709bb17af03ed97b3e5f578e3c45c4921
- SSDEEP 49152:LyzNg7jH8hXgcewfXzWNIj/TzCqhBNsEIU3B7uRNroI44p:LyzNrlewfXrBNNI
- TLSH T1AFB59E82BAC1C472F2631230442AA77856B9BE60F73189DB63D47E0D9D715C2ED3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dism.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Desktop\MuiCached 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4392 wrote to memory of 3448 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 80 PID 4392 wrote to memory of 3448 4392 3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe"C:\Users\Admin\AppData\Local\Temp\3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\dism.exeC:\Windows\System32\dism.exe2⤵
- System Location Discovery: System Language Discovery
PID:3448
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 1012B
- SHA256 b55f93adede519b71f33ac5c08267b5e41b3170b3a62b30195984bfa4ee00a23
- MD5 dbbca608c267ad105ab4eb9b53f99a65
- SHA1 8fca11430f2a0082f740756eb54985f4187b4444
- SHA512 0b054a06923587173e9b03fdcfb49521e8d8852061bc8a929ddf41250121ff9656c0d970eecff3ee8c02d5bf8f1261f1ef71a5aa2792be3379eb83cc989359e7
- TLSH T1A2112B1921ECDC62879E0A2095242FCF85EB3429A2145C6FB7B048E93D3DC4CC9AF365
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 2KB
- SHA256 1c6faee6d54a5ed13b9481ab7261e94481187ee2b0ee611f541870734b7e54ed
- MD5 a36e5b704e324d45beca936d886734f2
- SHA1 b3fa0fc11d198ed0e703c8d853a3830385df2dbe
- SHA512 32ea65bfdbbd09f931974c0d5a08fbeb820fa9aee2906bdfdb4cd803dfa8ed8787a1f14b0a29510f9c32f631cffab2da2099f33a4ff21d0d38ac90df43d15c81
- TLSH T1EC515C1862BCDD66876E062445643ECF41DB3429A1285CBBB7B108F13C3DC5CC9AE797
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
- Size 22KB
- SHA256 4db672b0686a125707815dce8d99a7a054abb5dba9a2b219d87e34d1e6941af0
- MD5 cf99b4f9f82d23bbf3aec89ab5dbe180
- SHA1 7f81e98dcca864fc75aadf7a10c3b146737be252
- SHA512 416f43487ce29f45fab7a66a8bec1b909c3c06f618efa1e6e785540252ff93b380830619c3d219667014cfaf781476c15d71775565f9d99202fb42ae30436e03
- SSDEEP 48:oZI2uQudu50uPuXu9uSuo0033yyddwwzzopopZZMMPlrZPlrZjZjZ0000000000Q:o8ORH0
- TLSH T15CA2031863BCDD66876E062445643ECF41DA3429A1285CBBB7B108F13C3DC5CC9AE797
- MD5 SHA1 SHA512 SSDEEP TLSH