fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/06/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MOU USI-INDSR, TAIWAN/Memorandum of Understanding between USI India and INDSR Taiwan.exe
Size 1.5MB
Sample260612-th96eshx4x
SHA256 fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025
MD5 c04c947efdfdd9ce24617903b6746a83
SHA1 43d646eda4166261eb1433c7599bf5cc9129a4f1
SHA512 5d2f4d4caaff0d04c64ccfe094be9ed683d8e408668d0dba3c9c59c5557258657d889078d4cc1fd106d53a3779fd59b8b7c18160a6a73803f20836d678454542
SSDEEP 49152:tXnulPRNaHAPM1ICw3qHZDlrqdWRyZNtoXwU7sk+TBV99yhW4iHp8p0:5uHNagPGICw3qHZhrW1ZPoXakyV99yhu
TLSH
T13A758E3276A1947AC23B3630855A93F9F3B69D308E35024B36905E3E2F355D2592E72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3356	pcl2bmp.exe
4676	pcl2bmp.exe

Loads dropped DLL 2 IoCs

pid	Process
3356	pcl2bmp.exe
4676	pcl2bmp.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	444	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Memorandum of Understanding between USI India and INDSR Taiwan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcl2bmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcl2bmp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1496	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
444	Memorandum of Understanding between USI India and INDSR Taiwan.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 1496	3356	pcl2bmp.exe	86

C:\Users\Admin\AppData\Local\Temp\MOU USI-INDSR, TAIWAN\Memorandum of Understanding between USI India and INDSR Taiwan.exe
"C:\Users\Admin\AppData\Local\Temp\MOU USI-INDSR, TAIWAN\Memorandum of Understanding between USI India and INDSR Taiwan.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 724
  2⤵
  - Program crash
  PID:2524

C:\Users\Public\Documents\pcl2bmp.exe
C:\Users\Public\Documents\pcl2bmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 15 /tn "MyUserStartupTask" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\VaultCache\pcl2bmp.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 444 -ip 444
1⤵
PID:2032

C:\Users\Admin\AppData\Local\Microsoft\VaultCache\pcl2bmp.exe
"C:\Users\Admin\AppData\Local\Microsoft\VaultCache\pcl2bmp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctxmui.dll

Path C:\Users\Public\Documents\ctxmui.dll
Size 2.3MB
SHA256 f2bed071676feb831ed460489643fd57f6c6c1e0d024a1ea447820276fb13828
MD5 ad1d161282dffec602c59b18434ee492
SHA1 9899e7195e1143f746f1e86e92029d813e1baaf8
SHA512 569227a0af2ffc60c034985d1f1976da15f31404d8023f314de748047e10790701ae053f76cbe54fc619a14534abd8f99df4262552dec6590768f91e45155bdf
SSDEEP 49152:eXe14sO2btdRmynOgGxntpQ9cm6Ki2nMq7y8cTJ0O8K0:eX042ZdRJi2
TLSH
T1A2B55A20EA41A019FCEB05F78AFE10BC656CAEB047D854D381D56AEEC32A6E17D31357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcl2bmp.exe

Path C:\Users\Public\Documents\pcl2bmp.exe
Size 101KB
SHA256 b1ab5d82f392ca786a54f4e999d6e96c12bb6ca6c43a940252a5342debe0341e
MD5 044261f2e386974a2b3fa331ea87db36
SHA1 41d068cf04a8d8b6c8865f2dcd906db5b02da065
SHA512 a24e58d5763400c5c407744b63ece78b35db4bf013c8da1c3a8105917768f2f2856e3a862bacca9536b75f247c508be808f7af2e9a126d7a2e7d889d6d944efd
SSDEEP 768:sbyzZpXXSciXwoBhLF2XNmxDc1/lOHp4uwF7m7Rh7Iof5NuhCFEtL7I8f5Lt80A2:wGEX7LKYc+vwF7mr7Jf5NGrt1j7SS8M
TLSH
T103A37D737C9145B3E89A5A7998FD7F256A38D6300F0446D3928841A70E742F2AF392DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads