27cfacc17b8f76524dcb11c71c1398f3b18f807cc46d681f971cd7d9c3950da5

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VITAL.MANUAL.INJECTOR.exe
Size 286KB
Sample260619-vtsk7ahz4r
SHA256 27cfacc17b8f76524dcb11c71c1398f3b18f807cc46d681f971cd7d9c3950da5
MD5 8403ceb9d316853b2e5328289e36311c
SHA1 bb9f8be53619e339a8218abd738b83eb44e729bd
SHA512 3523e5fa006156816b5492feaf000a40df398e1d46309e177d2c4679816889dc24c142852ee97913290ff6ad473d9078a5b467cb3f0289945a8baf3a0a8ae599
SSDEEP 6144:DhIR+E1k+p/EUy40Wkx7S1QV5ISyGzcc8ut:V57UtQx7pXzcm
TLSH
T1E054B034BBDCD633C3CD1374D49702655AF1D6C9B2C3E3AAA4497DA43A823E46D1922B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1296-1-0x0000000000FA0000-0x000000000101C000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VITAL.MANUAL.INJECTOR.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Colors	VITAL.MANUAL.INJECTOR.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\NotificationData	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5000310000000000d25ce84a14004c6f63616c003c0009000400efbed25c4a48d35c2e8a2e00000092000000000002000000000000000000000000000000d43e60004c006f00630061006c00000014000000	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff	VITAL.MANUAL.INJECTOR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4e00310000000000d35c2e8a100054656d7000003a0009000400efbed25c4a48d35c2e8a2e0000009300000000000200000000000000000000000000000009e48300540065006d007000000014000000	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000d25ca552100041646d696e003c0009000400efbed25c4a48d35c2e8a2e000000730000000000020000000000000000000000000000003a59ad00410064006d0069006e00000014000000	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000d25c4a4812004170704461746100400009000400efbed25c4a48d35c2e8a2e0000007e000000000002000000000000000000000000000000769c5c004100700070004400610074006100000016000000	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000d25c4a481100557365727300640009000400efbe8158a93ad35c2e8a2e000000880600000000010000000000000000003a0000000000f051710055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	VITAL.MANUAL.INJECTOR.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	VITAL.MANUAL.INJECTOR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2"	VITAL.MANUAL.INJECTOR.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	VITAL.MANUAL.INJECTOR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1296	VITAL.MANUAL.INJECTOR.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1296	VITAL.MANUAL.INJECTOR.exe

C:\Users\Admin\AppData\Local\Temp\VITAL.MANUAL.INJECTOR.exe
"C:\Users\Admin\AppData\Local\Temp\VITAL.MANUAL.INJECTOR.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-0-0x00000000743C2000-0x00000000743C3000-memory.dmp

Download

memory/1296-1-0x0000000000FA0000-0x000000000101C000-memory.dmp

Download

memory/1296-2-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

memory/1296-3-0x000000000A5E0000-0x000000000AB9A000-memory.dmp

Download

memory/1296-4-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

memory/1296-5-0x0000000005E50000-0x0000000005EE2000-memory.dmp

Download

memory/1296-6-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

memory/1296-7-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

memory/1296-8-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

memory/1296-9-0x00000000743C2000-0x00000000743C3000-memory.dmp

Download

memory/1296-10-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

memory/1296-11-0x00000000743B0000-0x0000000074B6C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads