a4df0e59a28d75e143117051a04d52f4a61a9ea7b23c41ad51a3a829cad62b58

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
superscan.exe
Size 245KB
Sample260623-qb2zpac181
SHA256 a4df0e59a28d75e143117051a04d52f4a61a9ea7b23c41ad51a3a829cad62b58
MD5 0071813eb4668769a15fcd2d1ca1686d
SHA1 a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d
SHA512 285f760efac8ccfaba213e88998d37a5e3191071bb245f63d7952b65ec9a1e7ec214270beca65d9a3013db849f64977be7f6110425fd29fcc58eb78cac982e8a
SSDEEP 6144:TT0j11f8NszyMXvb2k/fJq8DncxsBO7F/bOCbtzMI:TK8ctXRfI8DncC0NFbtzMI
TLSH
T1F0342318533CCDDBD6B61979868787E4D7249C2717D91606BECC7C8DFCB83226EA18A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4596	ws2check.exe
3100	scanner.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2900-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2900-31-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2900-40-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2900-41-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SuperScan\scanner.cnt	superscan.exe
File created	C:\Program Files (x86)\SuperScan\trojans.lst	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\scanner.ini	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\scanner.exe	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\ws2check.exe	superscan.exe
File created	C:\Program Files (x86)\SuperScan\scanner.ini	superscan.exe
File created	C:\Program Files (x86)\SuperScan\scanner.cnt	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\scanner.hlp	superscan.exe
File created	C:\Program Files (x86)\SuperScan\hensss.lst	superscan.exe
File created	C:\Program Files (x86)\SuperScan\scanner.lst	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\trojans.lst	superscan.exe
File created	C:\Program Files (x86)\SuperScan\ws2check.exe	superscan.exe
File created	C:\Program Files (x86)\SuperScan\scanner.exe	superscan.exe
File created	C:\Program Files (x86)\SuperScan\scanner.hlp	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\hensss.lst	superscan.exe
File opened for modification	C:\Program Files (x86)\SuperScan\scanner.lst	superscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	superscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ws2check.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scanner.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Control Panel\Colors	scanner.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	scanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2"	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 9800310000000000d75ccb68110050524f4752417e320000800009000400efbe8158443bd75ccb682e00000026050000000001000000000000000000560000000000e16c5b00500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	scanner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\NotificationData	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5c00310000000000d75ccb6810005355504552537e310000440009000400efbed75ccb68d75ccb682e00000018b3010000000e000000000000000000000000000000352c5700530075007000650072005300630061006e00000018000000	scanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	scanner.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	scanner.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	scanner.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4596	2900	superscan.exe	88
PID 4596 wrote to memory of 3100	4596	ws2check.exe	89

C:\Users\Admin\AppData\Local\Temp\superscan.exe
"C:\Users\Admin\AppData\Local\Temp\superscan.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\SuperScan\ws2check.exe
  "C:\Program Files (x86)\SuperScan\ws2check.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files (x86)\SuperScan\scanner.exe
    "C:\Program Files (x86)\SuperScan\scanner.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scanner.exe

Path C:\Program Files (x86)\SuperScan\scanner.exe
Size 63KB
SHA256 afa241787fde424249c8b445b1d66f40de8b08bc7bed7bef97c1fec4b069e53b
MD5 5c7050e14e090c71b3373aeb2ee13914
SHA1 b64e57d7dd7e8b500ad53800aad4d132a1a1bd36
SHA512 1868cfbc01a94d095690d69cd09661e88d65359fba589a7cd775db9d0b9784201631fe65e1f84b3e3dab8f7814af22fb5ad4d6773473b67a270fbeb9171d6682
SSDEEP 768:FMnOSTQgJxCCTyyS/py5GT3LYSYNzKolqPB4jrYdTABGWzOBhCHElKa5op+zgfjp:FMOAZWpKgLYqouWYdWhOSklKM0x
TLSH
T19F53F75A2EE0C473E272427406B35FA2ABFBBE4157318B8B5F147E3D6874611ED1A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scanner.ini

Path C:\Program Files (x86)\SuperScan\scanner.ini
Size 731B
SHA256 f27406224eadb67b86adb2bd73bffb8ad95060f12d96b20dfbeab0e1e3167ac0
MD5 8acaff1fec4a06b8c8a2e923b13ccd7e
SHA1 b0e405728d27a56952ffd1d8d2324776e46d2867
SHA512 f2ec24346520911fa65373011fbe5ff4dfe0b468a673c7e550b7424e59d317b380a45f9bd8e243d5f39a0f11c68ce5b113ece0dcfbccce9f6b9c6707c0a2774a
TLSH
T151019C818745CEDF52D6399216E221E1FA5A6400438500F271E44E4B5DADDA65538B9E
MD5 SHA1 SHA512 TLSH

Submit Download

scanner.lst

Path C:\Program Files (x86)\SuperScan\scanner.lst
Size 35KB
SHA256 cc94555ab3cba9fd37f711066ebd5f816fb7db99f2a1c716a9d0cf15f81d0508
MD5 16118e510f5ed223e097897fb23e2d03
SHA1 b625807e6d773233df32d5fc3d6376597d61c212
SHA512 76dba63d7ec8338bb8ce45e6f6c49f6e76978258fc14d734d70100af58d9fef536d2d8cb9c9fbe7c29fe0148bfe320f4ca305d6a8dae9eb2a3e4cbd6dbcec34d
SSDEEP 768:aFBYcJo1RUWIhn3HAPzzYqTp0poj64OakOwBENof4kMJuJvo7I:KBE7UWIhn3HKYqTp04JOOwn+JuJvr
TLSH
T126F2A6962B00F68B37DA8DDBB6835188964D6F7F575F204B1EB193DA46BF09D3364002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ws2check.exe

Path C:\Program Files (x86)\SuperScan\ws2check.exe
Size 3KB
SHA256 15cf248082298f6770b847744d13bfe0fd1a696b20fd80affb1b55eaae917b97
MD5 e00fb6a3d285ff3ed482a5748e51baa5
SHA1 61637803dc4e46f013a4ee709f7cdabca0f259b7
SHA512 46166b083be62a8ae81d001830c1f2daee27bde3cce5e1e3a8db0548dbe022df89e48fafd3cad9b7f1879f9e7fd16d28e473a626b9321c3b155d380f036b7a31
TLSH
T14551865F9F711D72D68D17731347ACC4B506933007A68A8D56A316E240A3E1B6C6936F
MD5 SHA1 SHA512 TLSH

Submit Download

pftw1.pkg

Path C:\Users\Admin\AppData\Local\Temp\pft47EC~tmp\pftw1.pkg
Size 190KB
SHA256 792e6fabf87af7db9c186cdb35bb055b3194f871c92c265efbbb80a6cf82a508
MD5 c481d93ff0653144cec573484ad6fc92
SHA1 096584bc172fe1268fad0400949dc86bb3c942bf
SHA512 f033ac97d7c49376cbff03faae29b1ccfe455c6273097182b32898f2bcc407e99e12d564743ee1318ce3e0305862e5d7a46e205911c0606655d88722dc701439
SSDEEP 3072:l04xMR42cx/fJST8DARqKH8e4N8xi9odMOqGFPAobO/Ca0btz+4YcT:lvb2k/fJq8DncxsBO7F/bOCbtzMI
TLSH
T15114237C5338CEEB4B9D7AEEE7C447D0E076807B32D992066FDD6848D84471746E5460
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2900-1-0x0000000000429000-0x000000000042A000-memory.dmp

Download

memory/2900-31-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2900-40-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2900-41-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads