ddd39508d7c90b08e1a349046955c0087b6dbd129dd9ae71fb970e835d20afe5

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FFXIII2ConsoleContentPatch.exe
Size 22KB
Sample260620-2yctvsas4j
SHA256 ddd39508d7c90b08e1a349046955c0087b6dbd129dd9ae71fb970e835d20afe5
MD5 859dbb4e1a29189a1e8d9ec3a3993314
SHA1 7aac806310ed794ee349e09f6edececdac01c48f
SHA512 ebafdacd369ba84f5b6913dc091bdb016373cda57102395b6ad532817b17d7f1ea792f75d0989d1394b47adffd43e041b905253125c3ff1aafdba6f18d904404
SSDEEP 384:iWhLMNqQy/F/64YFZ2n9ZycQc9faTgTOmf4fzfGf6fVuQuCuzuDuf9W919w9M9Fj:i+P/0j2n9ZBQctEgT3f4fzfGf6fVuQus
TLSH
T1FFA2701DBAD0062AE2FED73589B256518D363D63F932DF0D28DA024D01A7E426C50FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFXIII2ConsoleContentPatch.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000\Control Panel\Colors	FFXIII2ConsoleContentPatch.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings	FFXIII2ConsoleContentPatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FFXIII2ConsoleContentPatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FFXIII2ConsoleContentPatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FFXIII2ConsoleContentPatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FFXIII2ConsoleContentPatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	FFXIII2ConsoleContentPatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	FFXIII2ConsoleContentPatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FFXIII2ConsoleContentPatch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\NotificationData	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FFXIII2ConsoleContentPatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	FFXIII2ConsoleContentPatch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5680	FFXIII2ConsoleContentPatch.exe

C:\Users\Admin\AppData\Local\Temp\FFXIII2ConsoleContentPatch.exe
"C:\Users\Admin\AppData\Local\Temp\FFXIII2ConsoleContentPatch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5680-0-0x00000000745A2000-0x00000000745A3000-memory.dmp

Download

memory/5680-1-0x00000000002B0000-0x00000000002BC000-memory.dmp

Download

memory/5680-2-0x00000000052D0000-0x000000000588A000-memory.dmp

Download

memory/5680-3-0x0000000074590000-0x0000000074D4C000-memory.dmp

Download

memory/5680-4-0x0000000004E90000-0x0000000004F22000-memory.dmp

Download

memory/5680-5-0x00000000050B0000-0x00000000050B8000-memory.dmp

Download

memory/5680-6-0x00000000745A2000-0x00000000745A3000-memory.dmp

Download

memory/5680-7-0x0000000074590000-0x0000000074D4C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads