Analysis
- user interaction
yes - max time kernel
83s - max time network
86s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Umi-OCR_Paddle_v2.1.5.7z.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Umi-OCR_Paddle_v2.1.5.7z.exe
- Size 128.1MB
- Sample260426-axtmfabv71
- SHA256 abe00248d6e68dda75029739751ad7258f0ecc14d720b19240a844f5341859b2
- MD5 e4ac5bfc3f65907b404fa76ffbe3cc0f
- SHA1 103b7e9d0df1893f67281f10d106bf8feaa21821
- SHA512 fc54f06bc6dd0f7506febe42984501218b09ec899a295f96294c67e71388021890a82b47cf9951c668da61760ccd84fc77f868bfa97549cd72bb72a97f223850
- SSDEEP 3145728:yM9dVzBd9yirPZwyZxDT1Gd0nEPl+iDparUxwapJ30Nd6gjxbwq:zjNA0nIparOlpJE2gjxF
- TLSH T1A75833243A5CBC7FFF4BD1B28E6386D5C6411204DFD728D35E086EDA1DE72A226A421D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Umi-OCR_Paddle_v2.1.5.7z.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4868 taskmgr.exe Token: SeSystemProfilePrivilege 4868 taskmgr.exe Token: SeCreateGlobalPrivilege 4868 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4676 Umi-OCR_Paddle_v2.1.5.7z.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe 4868 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5.7z.exe"C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5.7z.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4676
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5\UmiOCR-data\plugins\win7_x64_PaddleOCR-json\models\japan_PP-OCRv3_rec_infer\inference.pdiparams.info
- Size 21KB
- SHA256 cf79f0b9689b4d6b8094d8bfe2481dc4b4d1699adb622568384695b5f56dc600
- MD5 5f5d26c4e5e45efebb4f0222bf89c6bc
- SHA1 c356c56c2820d60908d74b7d691be4b61aa54d8a
- SHA512 babb6bdf7348e2723fd397a4f99e7b25db817f208c30311cb37f3935895a186e80349097ddf15eed6ecb8df2daa495609ec5f639506bbf6fdedb7b6d2af7e166
- SSDEEP 192:jGDF6VnHSP++mLMjg45pWFyantmvn7aGmdSYQKoC6bVhv3RypKtysyZcmmcsJlmu:2F6xyP++mLMjg45/AdSlKVSwKtysiMAu
- TLSH T142A27A7991BA1BD043B3061AB59FB6EF6A7FC7300BF58845BDA081103B59FB6240CB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5\UmiOCR-data\site-packages\PIL\_webp.pyi
- Size 66B
- SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
- MD5 e82ce1a659755bafda7bc3e0e2d1b814
- SHA1 7f0b9ccdf21682246966759e4006b013c26503dc
- SHA512 a63ea8c91c8843f16bd7163ce1c570e8708ec5bbda66381cacdd53a53d8e9bf2e4cb475aa957c3c603ee9d9ce7427b137e5d5a188d1953a6ed0b496d23a3a034
- TLSH T165A00243583B74EC8BBD4D755D3F05B1552514845B115921A4C0A219B3CF478643536E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5\UmiOCR-data\site-packages\PySide2\qml\QtQuick\Controls.2\designer\SwipeDelegateSpecifics.qml
- Size 2KB
- SHA256 8207c603c9de51d9954302dd9df559a1df70e0a9658af62637229b5a2437eec3
- MD5 df7e32b0e18bd35fa8453cb1263886b9
- SHA1 f4336c9380a7fbee4dfbc17c545b409364f7f8b3
- SHA512 21d4e9b1d71c5ea9c7c66e5bacead5d4857ac109f7452d81c6d793f8843dd1d6f9194011e41259cdb9e3faecc04675a1433a2dfcbf0b758ff97cbd068fd95732
- TLSH T12441BB4A66405F3703B20750BE8B83CFF2AB827A775654203C29B29A1B7D87117A27D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5\UmiOCR-data\site-packages\PySide2\qml\QtQuick\Controls.2\designer\TabButtonSpecifics.qml
- Size 2KB
- SHA256 07911dff4b3128de29fb83223a78878f9e972f35a596429861c7ea7956923b2d
- MD5 95806d0bfadf617cdb91b9baacab5429
- SHA1 2102999ec25be88f138ea7c8fbf2a1bf4454c766
- SHA512 00d3b1dd1d764859249a5997ec4b2ec68fdf7c245a3ad4276a81370b2f43090f41d32de48d94307703436e661ebaf64ff96332f109b0e611b74521f28c8f8004
- TLSH T1E941CB4B66405F3703B20750BE8F83CBF2AB927A779654203C29B29A1B7D83117A27D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Umi-OCR_Paddle_v2.1.5\UmiOCR-data\site-packages\fontTools\pens\__init__.py
- Size 76B
- SHA256 4282ba1e53a8aad56a5f980ecafd1b2624d7b1505b051ade5227dd71c58da769
- MD5 beee6a1853e80cf81d1e2f38b70a8117
- SHA1 eb9e6d8da04fb93ca42749502bbdecc6e045fafd
- SHA512 aadec56c8a7e2e4ddc1e55ac5d85614e1ce684ffd043442ce2baf159c4d4e2613aff2838e438af506efe5d84ed99b683affb806334245b15096e649c26681873
- TLSH T149A0220023EE2B3320A2AA00020C02308F8CA0FEB02A00BC323C0808383200033B0CBB
- MD5 SHA1 SHA512 TLSH