6e53895018ec0ca7af4473d0865a43f948cd8ffc121cb4689a7c08fc1fbb5993

Resubmissions

06/07/2026, 01:26

260706-bt2z3scx5m6

06/07/2026, 01:13

260706-bk3v1sgz5t6

06/07/2026, 00:57

260706-bbfdcscw9p8

Analysis

max time kernel
899s
max time network
417s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Facebook_564.0.0.48.74.zip
Size 305.5MB
Sample260706-bbfdcscw9p
SHA256 6e53895018ec0ca7af4473d0865a43f948cd8ffc121cb4689a7c08fc1fbb5993
MD5 8f2eb94a79ebc4cf43b0c411906d5370
SHA1 a52587f9360d2ef6069818c07f1d4d98d3f54d9c
SHA512 28fa8586c1c7db197905c233e3c467a2751ee96c136879bff84c059ccf34c8ee7fcb9aed58f3b2185c722e93b4ef36cad597e47021c5f15eed49307ef4f6cf61
SSDEEP 6291456:VDoSAK8ka9vEjvcEuB/Z9HaCa2GlfwMfcspj/:Vqoa9vE+BzaCa2GlfwMfcEj/
TLSH
T1C6E8C000B90D5823EACFF0BD8ED1039232173D598561D38B2167A22EDE936D6579B7F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5808	mspaint.exe
5808	mspaint.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2444	7z.exe
Token: 35	2444	7z.exe
Token: SeSecurityPrivilege	2444	7z.exe
Token: SeSecurityPrivilege	2444	7z.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5808	mspaint.exe
5808	mspaint.exe
5808	mspaint.exe
5808	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 2444	3656	cmd.exe	88
PID 3656 wrote to memory of 5808	3656	cmd.exe	89

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\Facebook_564.0.0.48.74.zip -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\Facebook_564.0.0.48.74.zip -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ext\icon.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4892

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icon.png

Path C:\Users\Admin\AppData\Local\Temp\ext\icon.png
Size 2KB
SHA256 57ca90a6fdf0702ebb8369a6cde3e34721e849d5c3566e6f48b7186fcdd9522a
MD5 372f8e8a1ae45d612310b4cf3e84a360
SHA1 c9a75be74af7a028e30902e01f4e9acaec684b19
SHA512 971a62a3b2a62939aca5d8b7334c9766a3d6a34f133c7f919dfe8383d6c0b31fd64f5abb523f0d068d49c83e5c80df8f9a810a9ab72569fcfb126670276ded97
TLSH
T12641D208399449B44D1B545B0A9D8AE3341956063921132EA0AFFE2977FFFAAECD060B
MD5 SHA1 SHA512 TLSH

Submit Download