ebcf5480a1f959a0a12b7418a01e7343baec5a04235054d67c75f2e3a0db0bcc

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
298s
max time network
213s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MetaDataStringEditor.exe
Size 422KB
Sample260511-cl189aas2y
SHA256 ebcf5480a1f959a0a12b7418a01e7343baec5a04235054d67c75f2e3a0db0bcc
MD5 8889c24f42235bba1d880613655ae5f5
SHA1 21d28e4783e95913537326e1304339407c3c80ae
SHA512 1b9ee27fff45e9ee3808d4c4800bf442bf5ed180ddb3287bf83e7ac41b5afa54d43f3b65f60c5267d086733b28b5bc4bfc73276b20e03dc4d710d365524e1e1b
SSDEEP 6144:A8RxcwiOG1JD/fXVFxvxkepF8RxcwiOG1JD/fXVFxvxkep:AsPiOs/dfvmePsPiOs/dfvme
TLSH
T1AC945B82A74C16D8EBB947B82D5108DEC7273E3EC0D7A88E56B6F85510A75A32037C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MetaDataStringEditor.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	MetaDataStringEditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	MetaDataStringEditor.exe
Key created	\Registry\User\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\NotificationData	MetaDataStringEditor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	MetaDataStringEditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	MetaDataStringEditor.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	MetaDataStringEditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	MetaDataStringEditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	MetaDataStringEditor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4240	MetaDataStringEditor.exe

C:\Users\Admin\AppData\Local\Temp\MetaDataStringEditor.exe
"C:\Users\Admin\AppData\Local\Temp\MetaDataStringEditor.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4240-0-0x00000000001E0000-0x0000000000250000-memory.dmp

Download

memory/4240-1-0x00000000051F0000-0x0000000005796000-memory.dmp

Download

memory/4240-2-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Download

memory/4240-3-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Download

memory/4240-4-0x0000000004CF0000-0x0000000004CFA000-memory.dmp

Download

memory/4240-5-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Download

memory/4240-6-0x00000000009C0000-0x00000000009E2000-memory.dmp

Download

memory/4240-7-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads