Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 12:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
UniExtract.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
UniExtract.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target UniExtract.exe
- Size 1.6MB
- Sample260628-pry3asht5l
- SHA256 bfdc491eeeeb8e146734366f209ebd3afe03d6f0d7c965991c0b624ccd71e8d7
- MD5 488a5f36bb6809811f3572c2eabc8f4b
- SHA1 469fb51894d343aba6091d26a035fb567a28fabb
- SHA512 9e71379cd7c7810508faac0b13e0650625388b46395f2643305fa1af1492345fb6a0574d949670aa7ded4867c977f52f190246abb58fb5b71227f6e59c62f96e
- SSDEEP 24576:BsyHcLstcJgysnbhhX6dhB/LRe4uCc33eK0rDVfd/dBV/W0Re6B/EERnkMh3:B+stcJgB/X69LAqnrDVFXk0s6txRkM
- TLSH T18E75E00273D18022FFA396B35E57E7114BBCAD654123856F23D83DB9FA305B1462EA63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ UniExtract.exe - Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
pid Process 4292 cmd.exe 2336 runas.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UniExtract.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UniExtract.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UniExtract.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runas.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 624 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4332 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe 4456 UniExtract.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 624 wrote to memory of 4292 624 UniExtract.exe 90 PID 4292 wrote to memory of 2336 4292 cmd.exe 92 PID 2336 wrote to memory of 4332 2336 runas.exe 93 PID 4332 wrote to memory of 4456 4332 UniExtract.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\UniExtract.exe"C:\Users\Admin\AppData\Local\Temp\UniExtract.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /c runas /trustlevel:0x20000 ""C:\Users\Admin\AppData\Local\Temp\UniExtract.exe""2⤵
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\runas.exerunas /trustlevel:0x20000 ""C:\Users\Admin\AppData\Local\Temp\UniExtract.exe""3⤵
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\UniExtract.exeC:\Users\Admin\AppData\Local\Temp\UniExtract.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\UniExtract.exe"C:\Users\Admin\AppData\Local\Temp\UniExtract.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4456
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
- Size 808B
- SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
- MD5 878e958d6bff424e59d1feb51584a01f
- SHA1 b11261559bbea40f1874448196e2934277a537e9
- SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
- TLSH T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A8A4CE43DA65177907B85FEC6335160B
- Size 57KB
- SHA256 fbc0ebc7ba9a89fdc28f11ed0b7d5bd980f37ea32d06b48583cffa1fbf3ed30a
- MD5 5be4dc3de99db81185777392100789cd
- SHA1 7b1af591211d18fefdd11a3fca2cf42e4090c672
- SHA512 612498becc3e1360ec7cd25c83b58831f17ee3a1309abc7cd025421d0bc630c92c1f2cd40e44d925e31a4bb37cf0cbd22b3e4dcb5b9a22e421d9d414f2b4c171
- SSDEEP 768:mYFkTYV++lj+Pwlik/jb1IyX81VlajBF+wFIEtbtAKuvYRdhLnlkaDp/K5k7p2jD:t+PGd/jZIyX81Gj5IEsK5dnlk0FKnf
- TLSH T1E3431C689D77F2A1ED598EEA4EAADE9E1EE551D71E01030F4E307E901C13AA7EF57000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
- Size 701B
- SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
- MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
- SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
- SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
- TLSH T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 8820dcf5ae944c8ce4a1d5695f890f6df7d23090ed6a23aabe0f706f952075aa
- MD5 6feb0c84b93a94c4ae788868f66b925b
- SHA1 77ce09db5970ef4602ded70cf114bbf0cb0be012
- SHA512 3b3fbf44119d20c8460ce73b4d580fe95d6956c42dc6e1e66055257bfba4b03126ad7f7190f38bbb45b6899367570bc0e56f549f11e46b5b819bc94182523f4f
- TLSH T15DC08C1C1AB60A06F2A8437D12D139039B208101E3458F091AF92A08ED97B162C38C2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A8A4CE43DA65177907B85FEC6335160B
- Size 246B
- SHA256 dbe7bc52cd3202c9c44a7dc750c2129e6507cfcdddb776fd1ed524793e9d0400
- MD5 00fc45f1a692a8c9d7ba501b629a6a72
- SHA1 5a53aecb66856673976e2d936dc8494e0a97b649
- SHA512 c13d2cd76cc37e8cd1a57479f2b2370ffa42f691053e7fadc2e829e7b86065d9490754a0b169402a04abe5a529947bedb8a4cd9a5429e3584798135029525b10
- TLSH T10DD022301B640232F4B486B6CCA003A6CB90710AB0819B0D0FEF92194C2BF1B0CA380C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
- Size 192B
- SHA256 998f34ace5c93bdff0e0c1df7792a65cf2d2bbc361221200edf51f97431bfdcc
- MD5 7c068b570614bd5cfa571eefc4a6c143
- SHA1 565fdaa3a9abf94a4fb02122c0df83379a9affcd
- SHA512 7a6d46dbffc5ca916a15b17e433bdc9d5a8fec4cf8299ef11fb361fc14c0dad700ecb7b19ec969190e327b358b99953c27a7c31c73ea1de62263d1742f439896
- TLSH T1CCC08C1C06650606F6E883B802C23D879A208110F3819F0526B52A08DE24F122C34C29
- MD5 SHA1 SHA512 TLSH