7129d3d31ebfd86d04925f2efaf70e5d7cb6e925a8c506c672318ec4e9768fb5

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
101temp.exe
Size 304KB
Sample260705-vqpecsh12r
SHA256 7129d3d31ebfd86d04925f2efaf70e5d7cb6e925a8c506c672318ec4e9768fb5
MD5 0a92a4dee63e67cf30e99b340969eef7
SHA1 3634b8bc7143776455b97706da788737cfd44a04
SHA512 990db45e07852d88ca35002d14f85fcd74b5c3d06ce1b45694b269c22811a21b05fde20509a3272106ca64d8d1821d0c1083dcc764661a2d3d1615f8036e7e7c
SSDEEP 6144:UsLqdufVUNDaea6LxBzKF/SPlFbmnMhOuX2CFWlyrD:PFUNDa169BPNFSnMPQe
TLSH
T1B9645C03290C802AD511C6B914558B06F3F27E2A4794AFEF33E8AE741F776C375B961A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
6104	101temp.exe
5760	icsys.icn.exe
5572	explorer.exe
2900	spoolsv.exe
6944	svchost.exe
5656	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	101temp.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	101temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
6908	101temp.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5760	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5572	explorer.exe
6944	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
6908	101temp.exe
6908	101temp.exe
5760	icsys.icn.exe
5760	icsys.icn.exe
5572	explorer.exe
5572	explorer.exe
2900	spoolsv.exe
2900	spoolsv.exe
6944	svchost.exe
6944	svchost.exe
5656	spoolsv.exe
5656	spoolsv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6908 wrote to memory of 6104	6908	101temp.exe	88
PID 6908 wrote to memory of 5760	6908	101temp.exe	90
PID 6104 wrote to memory of 4268	6104	101temp.exe	91
PID 5760 wrote to memory of 5572	5760	icsys.icn.exe	92
PID 5572 wrote to memory of 2900	5572	explorer.exe	93
PID 2900 wrote to memory of 6944	2900	spoolsv.exe	94
PID 6944 wrote to memory of 5656	6944	svchost.exe	95
PID 6104 wrote to memory of 3416	6104	101temp.exe	96

C:\Users\Admin\AppData\Local\Temp\101temp.exe
"C:\Users\Admin\AppData\Local\Temp\101temp.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6908
- \??\c:\users\admin\appdata\local\temp\101temp.exe
  c:\users\admin\appdata\local\temp\101temp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3416
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5760
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2900
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6944
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

101temp.exe

Path C:\Users\Admin\AppData\Local\Temp\101temp.exe
Size 169KB
SHA256 0da6f09ea2757bf266b9b933bc30dccddd01a7f16dd8f92bdb66769519b1718b
MD5 d5b46966f426a6910e65c07869d196fb
SHA1 4559cc22cea4851ecde33e098317d22671d0029c
SHA512 ec0aaf45e772c01a526e1b0c673d451f5c8d0f2a787205dc9d6c6f68f0e326c32bcdf0d5e98bb2dbdf69ee49b7386c8e7eda4755fede979c28bbf334c4f9f89f
SSDEEP 3072:zTMD3BEiWxBOm7KBF/S7zlzxuP0mnMuAOu1N19yPKhE0GnmJTQSaMm5/6fixC:Ha6LxBzKF/SPlFbmnMhOuX2CFWlyr
TLSH
T1A1041847210C8066D626E27D549A0A42F3F27E5983589FEF33F88DB44F97AD0393E694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 43e09d36f7affd9a5ae5089bf28580d20ec7540aad6b935595e1d3aff4892752
MD5 10e0ba7f880295b38cde710fde85857a
SHA1 472e62d2450fad47518df0d6864e30bf549147ad
SHA512 609308c78511b380d7654088d6ee8e0607d9eb1125d92b1c1792166c947000e92d451f93cd8367f056bd9751354ec759729ec07a5db5f42018e3ae0ad7c4d56a
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalRO111111111111111111111111111111111111d:UsLqdufVUNDai111111111111111111J
TLSH
T18BD3192B7E11956ED41188F1B864E76ABA621E390BE09D8372E6BB507B7210371F431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 0d191bed317aa88beb1817325fff1d44191b919af2d506f710d9f17dddb603f8
MD5 dcf0447cde442cd8aabdf41ce044ae85
SHA1 17b86ff24a686e937332f92aba2a519080773ac4
SHA512 594a738c20769a5ea86481c7c4676480eebec48897da87a6bb14887eb672950e0787f9c7b8736ac84f5dc183b60daf703353cfbd4986ac377cf2cd5a10ff716d
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXK:UVqoCl/YgjxEufVU0TbTyDDalRK
TLSH
T196D32B237D10643FE8118AF114A4DB5EB9328E360B91AD177A9ABF153975283B6F070F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 71d63644bcfc1f53bee3652f791159d47f68a12c2a79b120fc75fcaf6dfcc67d
MD5 54db7b75428aeee19099f4662ab2c3e1
SHA1 62aa590abade5d3b01fb71d3ada416725d63fe0e
SHA512 324f39ac376a73611f33d9a5324b1b223e066f760ddd35f256f7f91d3ff89086de84cddb06f1fe92c82fc2fd50789e9223f1cba5d8294ca181a243ac4226cf31
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXU:UVqoCl/YgjxEufVU0TbTyDDalRU
TLSH
T1BFD30B237E10542FC82289F16868EB7DBE254D2A1BD0AD4B72967F50397224776F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 c997860052e654dff2f2003a33c0e5d065bba44c9c043343d74a6e54da6e9467
MD5 8f1d5623afe86eff3bb7c5d5ddbf560e
SHA1 fe23cd68be53cbe3b3d9e3e4e55e499e8deafbf2
SHA512 5fb96ed5f7704031b51d394d54a9dc4761b0b9fda8c38b990b94e64e2e7abd407d2f052c9b31248a88970ef711ccb2733eb58f8824df3bcedf7cccd635197bd1
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXH:UVqoCl/YgjxEufVU0TbTyDDalRH
TLSH
T13BD32A23BF60446FC85289F17CA5FA6FB9555D3A2BA0AD077296BB01267108772F031F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5572-52-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5656-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5760-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6908-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6908-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6944-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download