Resubmissions
06/07/2026, 04:34
260706-e65taahy3x706/07/2026, 04:28
260706-e343kshx8v706/07/2026, 02:28
260706-cydcyscz7m706/07/2026, 02:26
260706-cw7h1scz6k7Analysis
- user interaction
yes - max time kernel
117s - max time network
120s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/07/2026, 04:28
Static task
static1
1 signatures
General
- Target 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe
- Size 324KB
- Sample260706-e343kshx8v
- SHA256 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b
- MD5 bff0d401bfb634df88b9e0a534435b43
- SHA1 1530ab1f4b0b4f635e2d709b52093cb2a14347bf
- SHA512 b192b1d6815bc721c7ea2bacdf44aa40df03e18abd6a310f6a2655f503e29d45bfc5d63433da5262449c093f61959f2d99997725d782137a2edbf1e67baec0c2
- SSDEEP 6144:/2lZBsFrLf0ZwhxR23tT8kN57WVyyG54rEWzAPQ0dGJ:/+ZaFrLf0ZwTM3tTHN57AyydrEVo
- TLSH T1C4647C1277E080BAE6A207310FF64779A7BEF9945E358A4B73C4DA1D9D32541CB3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1092 FDRgYRdNnx.exe - Loads dropped DLL 1 IoCs
pid Process 1092 FDRgYRdNnx.exe -
resource yara_rule behavioral1/files/0x001a00000002b759-7.dat upx behavioral1/memory/1092-41-0x0000000000400000-0x0000000001400000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDRgYRdNnx.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3956 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe 3956 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4688 taskmgr.exe Token: SeSystemProfilePrivilege 4688 taskmgr.exe Token: SeCreateGlobalPrivilege 4688 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3956 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe 3956 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe 1524 MiniSearchHost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3956 wrote to memory of 1092 3956 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe"C:\Users\Admin\AppData\Local\Temp\0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\FDRgYRdNnx.exe"C:\Users\Admin\AppData\Local\Temp\FDRgYRdNnx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1092
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1524
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\FDRgYRdNnx.exe
- Size 8.7MB
- SHA256 95aedfcfeeda7f3030b88533b3df9715cd78effd2458d534c672d64f026d4dcb
- MD5 f51d43bc8d62fee7460713e35ee8add7
- SHA1 10745cfd1a0742e87e46ee923422806ab61c921f
- SHA512 923502a8b92e19e38da0e222d0fe0403b2c0d0ddb4e902420b532536525e5bfaaac6482b38e30c964a2b86162844bf820eb974487bc2234269d9090703de1d3f
- SSDEEP 196608:jhMeadrf+UOyVAzcwv6aPE9s6oBT9BhV/Fte:jepdrlOyVIcIPPUJc9Bhde
- TLSH T1149623BFD94ADC47E50975F4D9A2E5F14010DC7AC02A6D138CD9BF4AB33A8E99A42433
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\update.dll
- Size 156KB
- SHA256 f94d261b527ad996b49e1b05584435f2b9cd4a323689dc4a75c40ada216c5f03
- MD5 a70f447ad3f3115552ea0e018c6520fa
- SHA1 8b493e9efa235e331a3f77522100f51da83eb03c
- SHA512 6b8776c74c09319f56241835f0f1717838c1e3390fdf1e080490fa3d5e84ed0c17a218e2b941598b9967bb19cc1f7d78c21a02462f7bfe820e4f4a47fefd2c87
- SSDEEP 3072:lykLMtr26vROUmTMscNY13U25jDGfPtJMWCHFOpI:uxROUYfJU25mfPMWiO
- TLSH T1B1F39F127260C07BD2AD463D4D62AF3793FBF960CEF24A075BA4DB9C2D319419E26217
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\WonderFox Soft\HD Video Converter Factory Pro\config.ini
- Size 21B
- SHA256 d967609819ace47a142d98b80281c5f8812cf408d2eb13d593f3b3e1203cfb2a
- MD5 8d56828efcb7c4253a3260c5e1c18907
- SHA1 cede4be063d0d4914606751ec60e48c398fb0817
- SHA512 d30d3a6e9e21d755112da4df9125d64d5211f414eda6af031c16a4f91445bac6b61f099d13dc417217cbc85a1403e8b53ed1644eda1222e685bb923b69cee3db
- MD5 SHA1 SHA512