e49d5d0770bb17220cf11db2365a2307ad1d82eeab1f3ced1d6c0d0853b8a599

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hfsexplorer-2026.4.9-setup.exe
Size 1.9MB
Sample260629-xm4e8aes7n
SHA256 e49d5d0770bb17220cf11db2365a2307ad1d82eeab1f3ced1d6c0d0853b8a599
MD5 5a93ed7be443f5d2cc1276e7895f8011
SHA1 55d14278f72c4c94e1c275624bfc799eaab73924
SHA512 0e31d6cbdb6364c3e74347dec05e208e6372022c107d6a59ae01152ec3752b7a3e12393723fe698ad477761632ada4f03101a1703bef9a0268a76809dd43e700
SSDEEP 49152:v2ei7KXIz8VLmx2c7fKKYzUAlHijDxcUXJ3wgTIOaOnaH5Fmbufx9:vrDXIEidAojy83wgSEQ58qn
TLSH
T10995333435148B1FD47C21300C1E6356AA56AD3AE78526F283B5BCAC5CB7985CF6EE38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2424	hfsexplorer-2026.4.9-setup.exe
2424	hfsexplorer-2026.4.9-setup.exe
2424	hfsexplorer-2026.4.9-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfsexplorer-2026.4.9-setup.exe

C:\Users\Admin\AppData\Local\Temp\hfsexplorer-2026.4.9-setup.exe
"C:\Users\Admin\AppData\Local\Temp\hfsexplorer-2026.4.9-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyB1F7.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyB1F7.tmp\StartMenu.dll
Size 7KB
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyB1F7.tmp\ioSpecial.ini
Size 1KB
SHA256 7dcce90a46acf91405c0ef685515b1ca2efee8bed7e8b9d1dde0908c3b86596e
MD5 04116d83502d6a3ba3910383a0570d6b
SHA1 f4e16573edbed9637d0b1f2e5721f34aebb43aeb
SHA512 dc1ff06c688328542ac698d786d777487dd022bcfb5eabd48c39a7add7097d15ea77e6e2fb3fdcaa2fb73776eebff159caba4111b5703b316f3bab2d50aa964e
TLSH
T1EF319F577BFD1614F2BAFB14FEB541754B3A7C56A838D60D41C0090E09E6A809923BA7
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyB1F7.tmp\ioSpecial.ini
Size 1KB
SHA256 aa2bdba6ee58e0b4d1e084f3a6c473e8d961447e267446d18ef4221aa57d950e
MD5 91fb623073b76d7ee1c47497a07bd655
SHA1 24e8920e43ee451248a9c043c7f1c05c7db49a09
SHA512 b365489a1e2a9df38b82fdce3b632e42476daedf8e322392a6130abe67abc2afe3c5a450d0aa6b193627a503e6ead3bf7c2d544067eda23a34b42c3e133e1860
TLSH
T18431B2577BFD0618F2BBF714FEB441755B3A7855A83CC60D51C00A0E09F6A809963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads