Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 07:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe
- Size 2.4MB
- Sample260417-jbc71acs3x
- SHA256 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6
- MD5 0b9290421a6fb8e2dd12ac847b8db57f
- SHA1 43413a3b999f37775be4fb64b759aff6257f1a59
- SHA512 7ca8974692117bc66dfded9cd8ef8ab4ea6bee39a4d13b1121930a6e50bfd81bb53f1f6cb76a29667e335121ed50e361d92a7c6e119ad18dfb1d731e13ef4068
- SSDEEP 49152:LeVkatoJkGiRinM7iie3OKQwgOfxaDCa9ZasvC4/O0j:LemwqiRiM7iHbPIDf5
- TLSH T1EDB5AF217A01C037E56612B0997EBB6B407DBA71272181DBF3D45D2D39B0AC39A36F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "11000" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "1" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "1" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "1" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "1" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "1" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "0" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe = "1" 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3348 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe 3348 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe 3348 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe 3348 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe 3348 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe 3348 398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe"C:\Users\Admin\AppData\Local\Temp\398a894ffe8f92c9b53b84f3bc98449edd1d965363d62b991eee36f14a661bb6.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3348