ec3c8489436f64916d43500ca3d3ec4f0690048ec9c32400fc3198cd9904456d

Resubmissions

02/07/2026, 04:28

260702-e32x8abx7s7

02/07/2026, 02:56

260702-dfgs4ahy4p3

02/07/2026, 02:54

260702-dd46lsbt5v8

29/06/2026, 14:02

260629-rcb1bse19t10

Analysis

max time kernel
149s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gnp.scr
Size 581KB
Sample260702-e32x8abx7s
SHA256 ec3c8489436f64916d43500ca3d3ec4f0690048ec9c32400fc3198cd9904456d
MD5 d17ed16adad09ce33d0c4a6590026985
SHA1 1d4199ad72c28ffc7553502bffa14878f4a46cb8
SHA512 dfc4b552279d722c5df7fe95f7cd8f6d5327d4196d0f57615a76f299911ac7609e50c2ddd2fc6d69391ef45d74d8ecabc54049f5ed406350720214ce7008f36c
SSDEEP 12288:CciZ4qN4ZkKdcLtmUzG8GIJ9EprpaiWUz1KLGS:525kkKdcLt08/9urpn7S
TLSH
T194C49E19E7E405F8E1B3E574CE838912E7777C4947B1D69F03AC69A61F232908E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	gnp.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings	gnp.scr

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	mspaint.exe
5080	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5080	mspaint.exe
5080	mspaint.exe
5080	mspaint.exe
5080	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 5080	4472	gnp.scr	83

C:\Users\Admin\AppData\Local\Temp\gnp.scr
"C:\Users\Admin\AppData\Local\Temp\gnp.scr" /S
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\image.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

image.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\image.jpg
Size 78KB
SHA256 1620321218acc807c11500d3bbedf2df3d86e5af69fdd12e1bdb7673dee6b968
MD5 9566bac0e38952afeb2806f5c1985527
SHA1 990ef04b41ae1221e05d20e5be042153ae1bcd51
SHA512 4d8637499801284dbac488a34421d59e5e9caaad73470d26f1e21dccb11cc2be44656af06f6243a29cd10e84a66c96b6ea7bd3960dd8c6bd8dca6781724f1bc9
SSDEEP 1536:G8soMFGfqwluO6zF6+2hxNLIKRJ4TRsHVAm8kCKECnu8mPN9x5H:nMkfqwlUzF6v5EkJ4CyBjKzntA7H
TLSH
T1077302987DA76989F7E17D3944C43C840542C20CC369D9ECC1A70C9B5F8D4AFA7ACB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download