Analysis
- max time kernel
150s - max time network
160s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/06/2026, 00:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ScrubDummy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScrubDummy.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target ScrubDummy.exe
- Size 1.6MB
- Sample260624-apb3eshv3p
- SHA256 0ab22927d1a3e57abcfad547c4fd69f0caa9df0d4b22f4396af62841e08e075a
- MD5 a01bb689692081a972eb4859ad27accf
- SHA1 0f43db1898d1f8281eb39d3940218421b897e0a0
- SHA512 9762c9ece64ffab0e4cb21c73854480ee974d00a6bf7519d6e900ca647f69dae339d2d65484e0c157156dca14b134483e9530af675b204291a3039bde2509897
- SSDEEP 49152:LHPMdPfyjnLWNFgaTncvmtvIDc8EXcSl+CYRhRwkrSQoZVJ:LHPMkDSFCmtTcS41TrdU
- TLSH T1FB756C11F290903AF9F700F69ABA45BCAA287E30176950CB53C07D9E5B719E17E31B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScrubDummy.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Control Panel\Colors ScrubDummy.exe - Modifies registry class 28 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 ScrubDummy.exe Set value (data) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 ScrubDummy.exe Set value (int) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ ScrubDummy.exe Set value (data) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ScrubDummy.exe Set value (data) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff ScrubDummy.exe Set value (data) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ScrubDummy.exe Set value (data) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 ScrubDummy.exe Set value (str) \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell ScrubDummy.exe Key created \REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\NotificationData ScrubDummy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ ScrubDummy.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4308 ScrubDummy.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4308 ScrubDummy.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4308 ScrubDummy.exe 4308 ScrubDummy.exe 4308 ScrubDummy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScrubDummy.exe"C:\Users\Admin\AppData\Local\Temp\ScrubDummy.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 1cfb2e386253a74da91abc413dcecf2e9594ab1008042504154fb4187c8de4b9
- MD5 372bb3985efaa6d480ca287878171e0f
- SHA1 a02c100ebcef23db1be61571b12e24b1412156b3
- SHA512 448daafc384f5cc056937c0af3bfd5a7596a5d81b5e8d844274052cb0790d49fe50cfabb7487f9e03ba0d4bff3f49d6c14e863a6d8b8fc44d984a2abdd6bd105
- SSDEEP 96:LeK7KZd4L5ZFyBF1x8BTfcK2WGFAVxPfYJEJgCQ4YS:aK7KZdQ5ryX1uBVnfnYJIgCRYS
- TLSH T1B8D27556B548EA06DE092C36EFEBD9EC23313E25CD8A036335C1B77F48B70C08969589
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 1KB
- SHA256 1db9139681190758020d8262626a5a0d8e6ed3d7a2b9c25554ecf13313f6bbcb
- MD5 34b5165dc9b0d914330defc223258e71
- SHA1 b06f60a47f4602a7cdf574132bec79b00eaaae64
- SHA512 19e4c13d1aeaf22f24245bb025e02956d9d4fafdf0a3c8798f69e95b449eff2c0fa76a1d84c959e8e10ec78b23a5a2b8ee5b1ecba401ffdba76c8ec56b0b4548
- TLSH T1C3310DC7A720F314095231FC27696DB4D122B25FCA95139BABD8D0C8B49B2F5F588027
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 5KB
- SHA256 4dd0dc01286f1ee3320ca498da74480bf8bba06dd4000754545983ed89f5b560
- MD5 1660d6df3745064b7ebdf8cd777419b9
- SHA1 4b9f1ff6aa427b596c588db1453d944dce6fabbc
- SHA512 81f7dcb4026662527f69c5aef275952ac1244059c3f4b4054167f521f4a9cc721a668078c5278186f842c9cd0add3b48f4107cf181dfd719095b48bfb710e5fa
- SSDEEP 96:Rk/OtVtBga9g6rkLeyMdXdB+wyEeIwlfqEenwv:Rk/+rOa9g6rkLeyMpv+wyEeVlfqEewv
- TLSH T1C8B1E4D7E730E30107E271FC176A6DB0E11AB26F8655039FDAD9A0C4755E2FAB64802B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 7KB
- SHA256 6bb3428145620fc0a59c387c553e5d81ce3b35c847dda6d9d464998eb89daf2f
- MD5 2bccb71fb5ef8beb250e0a78f4c767f8
- SHA1 f467a7c5daf6bbb10f31eda9894888768aae67e5
- SHA512 496b4278f1509bfc16d1ebd2d804fd228ae9b27b42edb807cc9bd2ac0f0992c23db4e09f25883ca9f3e9287aa796fb90dc244c1c21f85080e98033b612edf5d4
- SSDEEP 192:Rk/+rOa9g6rkLeyMpv+wyEeVlfqEewZuvySYyCfC/Qv:Rk/+rOa9g64LeyMpvTyEeVlfqEewMvy/
- TLSH T155F1D5D6E730E30107A371FC275A6DB0E11AB26F8655039FDAD9A0C4755E2FAB64803B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\OrNoteProcedureAuditCpp\temp_data.sqlite
- Size 17B
- SHA256 f5b478ed8cb0ad3d42869f6731964d3afaf023e69cfecd90325a5b8cb46b6bdb
- MD5 96da09ce8a4b34346cbed6b2c39165ee
- SHA1 784f15a2ca5886d4f70cd0030a8f6fbf80283238
- SHA512 2aca8ea95e9ab9b1f038d7064050845e69339bf7682f1a29133b7547e110c89574a456bac047f16f65c7ea36327afb659745763faa6b74fcc49027097066d3e2
- MD5 SHA1 SHA512