454ea8e09adb9fe3dd6a2573a3d8eb133ec1cc4667b6802b83eb458705f98a01

Resubmissions

05/06/2026, 09:36

260605-lldbvses6r

05/06/2026, 09:32

260605-lhmfcses4j3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FsocietyEncrypter.exe
Size 82KB
Sample260605-lhmfcses4j
SHA256 454ea8e09adb9fe3dd6a2573a3d8eb133ec1cc4667b6802b83eb458705f98a01
MD5 08a27ca9a8f9129b9d025d27140a64ef
SHA1 ee5c64befd8e4712da229055dcf744c91ff84c04
SHA512 49c583e730e5d7f0a36abf7ea9b6746f2bd7978fc22b60c898a8299935f09374f17a4983cd0d5d07e60ffcaf22ddd4c124d6860b60c0028e261e6332e3e340d6
SSDEEP 384:IdoLuS2uqS88rpu2Kla7NIAP29FB3BJZil6sJy7ddyvsvrW:a4uSI8rRpI7YG6gW
TLSH
T1DD83A31476E88A14D5FE4F385EB2D57007B9FE1A5930E30E1DC53E8F3A72B109816BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FsocietyEncrypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FsocietyEncrypter.exe
Key created	\Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\NotificationData	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FsocietyEncrypter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FsocietyEncrypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FsocietyEncrypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FsocietyEncrypter.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	FsocietyEncrypter.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe
2716	FsocietyEncrypter.exe

C:\Users\Admin\AppData\Local\Temp\FsocietyEncrypter.exe
"C:\Users\Admin\AppData\Local\Temp\FsocietyEncrypter.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-0-0x0000000000BA0000-0x0000000000BBA000-memory.dmp

Download

memory/2716-1-0x000000001D050000-0x000000001D060000-memory.dmp

Download

memory/2716-2-0x000000001D050000-0x000000001D060000-memory.dmp

Download

memory/2716-3-0x000000001D050000-0x000000001D060000-memory.dmp

Download

memory/2716-4-0x000000001D050000-0x000000001D060000-memory.dmp

Download

memory/2716-5-0x000000001D050000-0x000000001D060000-memory.dmp

Download

memory/2716-7-0x000000001D050000-0x000000001D060000-memory.dmp

Download

memory/2716-8-0x000000001D050000-0x000000001D060000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads