7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
Size 65KB
Sample260628-2kl6dafw9x
SHA256 7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b
MD5 694efccf0c905305f5c8418499fe335c
SHA1 1fa42976df8d8b1848ac2d99468da3c17785d285
SHA512 294fecfb3abb91a9a61001b26acced7a1cc99abb0a140a8bc352b51794e3750b7579b44543d1afde676c0e75ddc6c80c44eb49b959946654bc5f88e0d2b49fcb
SSDEEP 768:PcbE6oEmGV3ldq9GVM5+d6u4QLBr6Oa9ub:P+EkmGPdqgVM5+sXQLRk9ub
TLSH
T18E53968166C7BCCEE02DF9304D75746A65FE6C32AE22358A79F47E793438600716CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5972	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "C:\\Program Files (x86)\\Windows NT\\explorer.exe"	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "C:\\Program Files (x86)\\Windows NT\\explorer.exe"	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\explorer.exe	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX964F.tmp	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Windows NT\explorer.exe	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5584

C:\Program Files (x86)\Windows NT\explorer.exe
"C:\Program Files (x86)\Windows NT\explorer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Program Files (x86)\Windows NT\explorer.exe
Size 66KB
SHA256 e588658ad40e8490e1fd89c72c05d935977b115e1da710ce9703ab9395b8d36d
MD5 79a5234397b6bc3260ffd8f0e5382679
SHA1 96022ce3477d73ce5c89610e903ec57307e70a21
SHA512 1144c4d1e3c1e7b73023961d9ae3596b791fe33c39e0f3e6d3cc5d50f3241c1f9600548ee23578afa31ce322329a90a2fb5b3d8994795dcdd35b4ab4faa2d644
SSDEEP 768:7cbE6oEmGV3lVq9GVM5+d6u4QLBr6Oa+6u0:7+EkmGPVqgVM5+sXQLRk+6u0
TLSH
T1BC63A68166D7BCCEE02DF9304D36756A61FE6C329E22358A79F43E793438600B16CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads