1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22

Analysis

max time kernel
298s
max time network
253s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/06/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f5o3tf.exe
Size 276KB
Sample260622-kwpbfaa18y
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5616	7x3ns84r.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	52f5o3tf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 5616	5068	52f5o3tf.exe	80

C:\Users\Admin\AppData\Local\Temp\52f5o3tf.exe
"C:\Users\Admin\AppData\Local\Temp\52f5o3tf.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Roaming\Microsoft\7x3ns84r.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\7x3ns84r.exe"
  2⤵
  - Executes dropped EXE
  PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7x3ns84r.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\7x3ns84r.exe
Size 276KB
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download