Overview

overview

5

Static

static

1

winmfscanu...02.exe

windows10-2004-x64

5

winmfscanu...02.exe

windows11-21h2-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/04/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winmfscanutilityv202.exe
  • Size 52.2MB
  • Sample260429-e5e68sgt2w
  • SHA256 82aa0f1d53e154fdc7a09985a098a9f8e48f9527dc4ef8ac4cc04b18004425ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202.exe
    "C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\SETUP.exe
      "C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\SETUP.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\ScanUtilityLauncher\SETUP.EXE
        C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\ScanUtilityLauncher\SETUP.EXE -NOUI -NOEULA -LANG:0009
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        uinstrsc.dll
        • Path C:\Program Files (x86)\Canon\MF Scan Utility 2\uinstrsc.dll
        • Size 24KB
        • SHA256 e26169816dbd969bb02d458b0992981dd67e2f1618d427bcd63a5760b872bc6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uinstrsc.dll
        • Path C:\Program Files (x86)\Canon\Scan Utility\uinstrsc.dll
        • Size 24KB
        • SHA256 e7026a04ab967f380f8ad1f89151b38010a844799343634017f2e7baf81297cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CNCLID28.dll
        • Path C:\ProgramData\SetupTemp\CNCLID28.dll
        • Size 112KB
        • SHA256 62b458de8542be03b0a2c6c94453bced68093e9af7cb4d22fd16a6184ae00454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DATA2.cab
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\DATA2.cab
        • Size 44.7MB
        • SHA256 97c2bd6cc0b8aefdb6daad592da07775154dfc616e41b9d084de0866dd4358e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Data1.cab
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\Data1.cab
        • Size 1.2MB
        • SHA256 1e39c377e774bd5d3c1f6425b591288e830b291e2859e8b7089f29a2a4830478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        License_en-US.txt
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\Res\EULA\License_en-US.txt
        • Size 28KB
        • SHA256 8c63ba9d85a7475d4272db6526e9dafe794030e3c7b4f436b24f32fca6a13360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETUP.exe
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\SETUP.exe
        • Size 3.3MB
        • SHA256 ab23ac22bb5f825d3fcbe25a039498bf3fa02c2bfb723fdda49d86f978e07317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DATA2.cab
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\ScanUtilityLauncher\DATA2.cab
        • Size 267KB
        • SHA256 11e57692a382be3cad82c8d909ef2036d3aa76a6298052f1be95dfda79c61300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Data1.cab
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\ScanUtilityLauncher\Data1.cab
        • Size 1.2MB
        • SHA256 f06a534b898335afabe566fae773b4bae9ae5db58204802a934117e26e3f55f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETUP.exe
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\ScanUtilityLauncher\SETUP.exe
        • Size 3.3MB
        • SHA256 b477a83a766586a099a4f8fb5441bcd41711117873cab0a9ae75c950b961a1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup.ini
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\ScanUtilityLauncher\Setup.ini
        • Size 15KB
        • SHA256 2ca9506eee44878c28cff99fecf9b71144769a119a911cb7eece8c34023fa670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup.ini
        • Path C:\Users\Admin\AppData\Local\Temp\winmfscanutilityv202\Setup.ini
        • Size 25KB
        • SHA256 a1dcfffd92cab9195aa637ff892351da6088b7303d1ef4381823cf596594e323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download