3233dd2ecf5eef5fa6b40906db81c80e6fa90d891a7a55ca683d3c6e0b45e804

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fritzing.0.8.7b.pc/Fritzing.exe
Size 6.6MB
Sample260504-pgxfqaaz2s
SHA256 3233dd2ecf5eef5fa6b40906db81c80e6fa90d891a7a55ca683d3c6e0b45e804
MD5 3d98dba85664a9850258184c0df66c1b
SHA1 c0c5916a2634a83e58baafb97fcee1816985c32d
SHA512 d2581f57b1d903d1a3a91042174ca1ac8c8c6635349920b33f9ad880006e13a00732af96e88cd5529fe3e89a09864aac6967f51d4f9813eafe8ca3a255bd888c
SSDEEP 98304:NCNJQ8rnLjTALQPTPbDnMpWuYnkVRfbeqJtujBENOrZSuLGjIdzF:NCNJZPTALGTP2Wu9NbjtWxrvij
TLSH
T1B5668F62F20C4526E1B921B2BD98539B801CD8790B61F1E3A6DC5D6B14389D3AD36F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fritzing.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzp	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzp\ = "Fritzing"	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Fritzing\shell\open	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Fritzing	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Fritzing\ = "Fritzing Application"	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fz	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzz	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzz\ = "Fritzing"	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzpz\ = "Fritzing"	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzbz	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fz\ = "Fritzing"	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzb	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzb\ = "Fritzing"	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzpz	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fzbz\ = "Fritzing"	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Fritzing\shell\open\command	Fritzing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Fritzing\shell	Fritzing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Fritzing\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fritzing.0.8.7b.pc\\Fritzing.exe\" \"%1\""	Fritzing.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe
2576	Fritzing.exe

C:\Users\Admin\AppData\Local\Temp\fritzing.0.8.7b.pc\Fritzing.exe
"C:\Users\Admin\AppData\Local\Temp\fritzing.0.8.7b.pc\Fritzing.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

___lockfile___.txt

Path C:\Users\Admin\AppData\Roaming\Fritzing\backup\36f1c22bb4d10fffe2eaddcc23887215\___lockfile___.txt
Size 1B
SHA256 ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
MD5 0cc175b9c0f1b6a831c399e269772661
SHA1 86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
SHA512 1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75
MD5 SHA1 SHA512

Submit Download

my_parts.fzb

Path C:\Users\Admin\AppData\Roaming\Fritzing\bins\my_parts.fzb
Size 160B
SHA256 fd1633ebae6a3fbd82bed8cd496dbb80481cf74765e97611bac184644c51599d
MD5 b2680e8069437bccbf425e9c2ae199a7
SHA1 c55708849a9150fa68249cc8b6d6d156622b9ac6
SHA512 e92df71f78777abeec35794fdee793a839895b6290a80fe700b9529e26dae38da1b63fd457d61ec039ab94f1a3936b80b1051fe377ca2e9a59bfb96a04642123
TLSH
T11AC08C99437228F386DD46408766F00A3BE0024AC98C090838EE09848F5628D82CB32E
MD5 SHA1 SHA512 TLSH

Submit Download

search.fzb

Path C:\Users\Admin\AppData\Roaming\Fritzing\bins\search.fzb
Size 160B
SHA256 f7824408f6383817be2a7f2cb8de341c9a75f3106f02cc517b15607e5d350251
MD5 e6bbb7429d3f2a0c50e0105b0bb1d3b2
SHA1 bed650acd981846777cd68cd52f6a9a960aea61e
SHA512 203d6f19fed2a08a88e30e00b1ec4a017895b78f90ccf6126c21e87b4edddac520394d52b8e93af2b87c8222d08fa87bec1c3f844662e59cb25af5c884e3d919
TLSH
T1B5C08C8903B228E386EE46409BA5F0423BE2024DC988010834EE4AA68B1664E82C733E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2576-33-0x0000000005220000-0x0000000005227000-memory.dmp

Download

memory/2576-32-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

memory/2576-45-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

memory/2576-52-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

memory/2576-59-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

memory/2576-73-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

memory/2576-115-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

memory/2576-122-0x0000000001930000-0x0000000001A42000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads