Analysis
- user interaction
yes - max time kernel
14s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kryptonsource.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
kryptonsource.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target kryptonsource.exe
- Size 1.3MB
- Sample260608-q6be8ae19x
- SHA256 615976598f800c70827c5a47e68c2b0d2b17d048b9721ba071c8af825d2476bd
- MD5 62d054cb0fee44be204c820a0dd9d8fa
- SHA1 9cf32ce420d227f824c7c8939f6845f4e9687e80
- SHA512 e0a30277acd4ffecebc0907a600c09a40e2bae039a8da08ea69c65268e270d9d1682872295f3bae6dc79135ca6b201d25858ca458e56033ca6c7dbcf527e9165
- SSDEEP 24576:oTMiESqg4UOUBYJxovX5UIFVH3MPX4ncy7dDG64V9pkU7SpkmvXAt:oTD/V4ZUBGxGmIDXaX4ceFo/7SpkmvXC
- TLSH T16C5533D0E2B0D056C5FFA330380D2BE15B72F5ED85591C2F5A05981C3F99AA1B12BDAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\7-Zip\Lang\af.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\bg.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\et.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\fur.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\hy.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\lij.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\th.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\7zFM.exe kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\da.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\en.ttt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\hu.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\mk.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\pt-br.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\tt.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Uninstall.exe kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\el.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\fa.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\gl.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\lij.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\sl.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\tg.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\th.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\an.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ka.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ne.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\si.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\sk.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\br.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\en.ttt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\ext.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ja.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\mn.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\7z.sfx kryptonsource.exe File created C:\Program Files (x86)\7-Zip\7-zip.chm kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\br.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\co.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\kk.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\kk.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\nb.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\nl.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ps.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ast.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\be.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\es.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\fi.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ku.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ta.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\uz.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\fi.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\fy.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\hr.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\id.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\io.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\lt.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\ru.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\uz.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\es.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ext.txt kryptonsource.exe File created C:\Program Files (x86)\7-Zip\Lang\ja.txt kryptonsource.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\mr.txt kryptonsource.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kryptonsource.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll" kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" kryptonsource.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" kryptonsource.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip kryptonsource.exe