Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
touchskins.exe
Resource
win10v2004-20260513-en
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
touchskins.exe
Resource
win11ltsc2024-20260629-en
4 signatures
150 seconds
General
- Target touchskins.exe
- Size 5.3MB
- Sample260702-3pdv8sds2q
- SHA256 bbcabe312cbb2cc098f9ac4c1468a171b6773962a1d4e8c8a01652abf370a581
- MD5 28ffbe398d8fc9606390fe19009cb927
- SHA1 c15711ac4b292765fe1c9b6cf95dc33934c79c2f
- SHA512 23a8f1ccfc296fc6c4d4a933ac7353a5bdf68280bf58cb60c579d44e8e469194d998905007438fdfc0c811b7ffee6fc6922e93a7d33108e2d0f4e644a4a8090b
- SSDEEP 98304:BvhT0yNsaOtkp11nZVavSgaFOyphjFumtM:Bvlsi7VZVhYt
- TLSH T104468D43F2E664FCC916C134930BA733E93578490621ADAB56D0EB703EB69606F3EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins touchskins.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins\ = "URL:TouchSkins Protocol" touchskins.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins\URL Protocol touchskins.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins\shell\open\command touchskins.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins\shell touchskins.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins\shell\open touchskins.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Touchskins\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\touchskins.exe\" \"%1\"" touchskins.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe 1128 touchskins.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1128 touchskins.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1128 touchskins.exe