Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 07:43
Behavioral task
behavioral1
Sample
84473B78763E8B3AD68347174DFCF644.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
84473B78763E8B3AD68347174DFCF644.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 84473B78763E8B3AD68347174DFCF644.exe
- Size 148KB
- Sample260423-jkfpgset8z
- SHA256 749c01f5ddf2911059eb795923b81fc605cbba51f3c683313253bf51e97960b0
- MD5 84473b78763e8b3ad68347174dfcf644
- SHA1 49d617d589d3acacb4de9a80bc8ded85e48e8467
- SHA512 06adaf59d7778ad94768543209e701f865107b50008e41c6243aa0b2a1d42dc00714ac69e7bc26a7102b08703b9aee35cfd6aed55299539972a39732a1a1c054
- SSDEEP 3072:wbxwRoe0/2/Qa52RltsA11W8o2zdpfw5MorHuhaNyUpFUJR38yt/tsTF4J:wyRor+/QOePsM82zPfwKIOhaxqFSuJ
- TLSH T1C8E37C2071C0C0B3C8B6553158B4EE769A3DF9701F245DEB63980BB99F342D29B39A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\N: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\P: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\S: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\T: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\B: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\G: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\H: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\M: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\O: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\Q: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\R: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\U: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\E: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\J: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\K: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\V: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\W: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\X: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\Y: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\Z: 84473B78763E8B3AD68347174DFCF644.exe File opened (read-only) \??\L: 84473B78763E8B3AD68347174DFCF644.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84473B78763E8B3AD68347174DFCF644.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe 2692 84473B78763E8B3AD68347174DFCF644.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 84473B78763E8B3AD68347174DFCF644.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2692 84473B78763E8B3AD68347174DFCF644.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84473B78763E8B3AD68347174DFCF644.exe"C:\Users\Admin\AppData\Local\Temp\84473B78763E8B3AD68347174DFCF644.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692