1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22

Analysis

user interaction
yes
max time kernel
300s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f5o3tf.exe
Size 276KB
Sample260622-kwpbfaa18y
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	52f5o3tf.exe

Executes dropped EXE 1 IoCs

pid	Process
1884	01v1y37e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	52f5o3tf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	01v1y37e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 1884	3888	52f5o3tf.exe	84

C:\Users\Admin\AppData\Local\Temp\52f5o3tf.exe
"C:\Users\Admin\AppData\Local\Temp\52f5o3tf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Roaming\Microsoft\01v1y37e.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\01v1y37e.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01v1y37e.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\01v1y37e.exe
Size 276KB
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download