Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe
- Size 3.2MB
- Sample260702-e2syxsas2j
- SHA256 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07
- MD5 0ee629d651a70f8ea2e4d3f2f496d1dc
- SHA1 b88ddd3f36768a03305b473fcef51ab0f05f4c1c
- SHA512 5ad355cb1fb5c282d32e58a06273de83928e36263ef2eb9882ed0a5446fe6709d6e340068a165f25f75c57dce550cf61fd2749be66cf299b310e60cb100bc2de
- SSDEEP 98304:w/jXAOhPbyy13j3XzHhEPFST6SClNCzV3dP6:2hPVWFST6Smb
- TLSH T195F5AF323DA08065C533D2719E5DBB5961FDBE710B3A02C721D63E1D2DB8CD2A93C66A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 29 IoCs
description ioc Process File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\temp.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Logo_Sample\POS.bmp 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib.zip 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test12.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test4.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\Queu.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\TempQr.bmp 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Bmp_Led\Black.bmp 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test2.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test5.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test7.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\NETtool.exe 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test6.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\Printer.ini 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\QueuSet.exe 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Bmp_Led.zip 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\EG128X128.ico 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\NETtool.config 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Logo_Sample.zip 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Bmp_Led\Red.bmp 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\EnCodeQr.dll 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test1.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test10.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test11.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Bmp_Led\Green.bmp 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test3.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test8.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test9.txt 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe File created C:\Program Files (x86)\PrinterTestV5.1C\Lib\QueuMonitor.exe 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4212 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe 4212 0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe"C:\Users\Admin\AppData\Local\Temp\0f3e959c94790328f5ec6570363746624adcda6354da35af93fa13ea9d38ec07.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\PrinterTestV5.1C\Lib\LabelPrintTest\Test7.txt
- Size 805B
- SHA256 41493eb79f1dbb3bcc52272917b1afb6e64cc167722bd2cd94ff51a5e7fffc0d
- MD5 1cb31617b6c0753c44a1c1fe7d237c17
- SHA1 727f3a26a573070b63413d7b3aaf827969aeeb88
- SHA512 aa3ff93e21281041349804a886db8d4632c0a346778fafd8ac5bb040386f8c0efdbead765c2642f81bc2693da99070cbf7287165406bcbaf121c992a200a747d
- TLSH T1D101493EC4C64FCBCE718B52B046D1CA6096896A8E9C8BCFD3118F63471028185BB656
- MD5 SHA1 SHA512 TLSH