034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5

max time kernel
598s
max time network
427s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capa-testfiles-master/034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe
Size 71KB
Sample260625-sbpepsc15l
SHA256 034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5
MD5 4d98794167c09a103cfab06e73b68f42
SHA1 5d5fbe0fe6984f82511584e1a9dc6dc9503b2f6a
SHA512 f90984151c34aa2ff6e40c5cbfb7d052337066395324f29f2535f48d63d18611e9a95d7ca8c6aa9c7e726db24a47d89b2c21f52d0d7f5c96ef4c159d47fb330e
SSDEEP 1536:BSKXNOuFMNSNZrzsbDfyCTv/dBuFkI2U12F5F9Z6lX2nkc:93McZrzEfPZaItZ6lX2n7
TLSH
T10A63AD03B8B28072F5D3827165B45F799FBBF4521422CC8BD36A98862C315F59B2B2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mozilla_cleanup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\capa-testfiles-master\\034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe"	034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mozilla_cleanup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\capa-testfiles-master\\034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe"	034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\mozregistry.dat	034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe
File opened for modification	C:\Windows\mozregistry.dat	034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe

C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe
"C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1072

C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe
C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozregistry.dat

Path C:\Windows\mozregistry.dat
Size 335B
SHA256 f0ce74a30b20180d80cc00b9eca56a049c7e520452d94d50f0e4f506703e6033
MD5 36030478cf71652b855da3e06fe68e4b
SHA1 55068e7a564b94d04a54768f8568150da7b112a3
SHA512 642ad20c4c4e1d44131d1e7bf703d980e7eb5c64f5cb78add558e2bcebda7784a1be136ce8f2b33c17657ecb611e1ccc945ecb9d616adcfd37bae5320af132d9
TLSH
T165E09B4353844571C1C427BC5C59D7514BE3C5D5F715C78A815571DD4F74D4C6F18014
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads