Analysis
- geolocation tags
asiadelhiinindia - max time kernel
149s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Wand-Setup.exe
Resource
win10v2004-20260513-en
21 signatures
150 seconds
General
- Target Wand-Setup.exe
- Size 169KB
- Sample260527-pc7e5acy7k
- SHA256 c4734db7ae9fc5fd8ac89c2ba1d46c1d092ec93472cab920bbb552782a4bc006
- MD5 cded54501727573b813e100b598db7df
- SHA1 c60a09a061e7af0dfea69267e7de5b74bab459b0
- SHA512 21e54a6a909dd42df134088d0d707cb8ffd5d8a84512079f81adcd11dcab25ab76dc80b03fe2bc63efb4ede259ef3bbee3bd4b3aab2765d8c2c3007b6b643b39
- SSDEEP 1536:lJJLxy9zyuQycljyaYeNl6amgLMbtYcR/8t/QiT0FN1E3ry9zyuQyNVEn7:5Lx45QyUyhaEtHZn20FbE3r45QyEn
- TLSH T1A104ADD4F7F905EEE6BB8DB24C310DB016B7BC8205D5DC4A2A84B0B986637541436BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1" Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35" Wand-Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35" Wand-Setup.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com Wand-Setup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2040 Wand-Setup.exe 2040 Wand-Setup.exe