Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
General
- Target e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe
- Size 65KB
- Sample260706-p647vsbt9n
- SHA256 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6
- MD5 d9ca651b92aa06526b97b9623a0960f8
- SHA1 279953f9d3afa1858a669d31b94672abd69c5d85
- SHA512 0895c77a5dec72d7e1f86e4879dc2f9c075eb9b7ef5706b54b39cfb5a35908543e5952f7f6629f993cb0b3695420c7b678613b32018f2575bd08296946650049
- SSDEEP 1536:oRHXNH/82b85qxk8uOhbiDejk2Kv8Asytw4LYvP:olXZ82AWuEI78Asytwfv
- TLSH T18F633923769582B2F2B687B039B19765877EFC312F6492CBE3D2D50C0D346C1A8B1766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Control Panel\Colors e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe - Modifies registry class 56 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "3" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\NotificationData e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000dd5c8b5214004c6f63616c003c0009000400efbedd5c7c4fe65c2f672e00000092000000000002000000000000000000000000000000ff7d20014c006f00630061006c00000014000000 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000dd5c7c4f120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbedd5c7c4fe65c2f672e0000007e000000000002000000000000000000000000000000e97994004100700070004400610074006100000042000000 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000e65c2f67100054656d7000003a0009000400efbedd5c7c4fe65c2f672e000000930000000000020000000000000000000000000000005d498d00540065006d007000000014000000 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5784 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5784 e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe"C:\Users\Admin\AppData\Local\Temp\e9aee8d0c2df1004cd19c6e0b0a2a4025580c557af2b399de75c1414de6d05d6.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 d9dd196b3529df5419ae22b429052fdb48d6fb487e585463bb6798d1994896c8
- MD5 d96462e6e81be30af17a3a9dfb343410
- SHA1 51f11856182f547e4728a38ce00885d2969533c5
- SHA512 ae2e5337af02ee915c45881527ba6e4921153da67ff9ab7d9cd03f89957a7fbf897399d44f5c035e3a40176e1902685f4496a4a797d71a73c4ea16ca76c0539a
- SSDEEP 96:D+fTGRdtQY4K9KQUBGw7u77XY8GNAT6VFsP8FK53u238Eam:D+7GFCK9XU4Pw1AaFskFK53u238rm
- TLSH T117D26716F404EA12DD092C36EFEAD9EC23317E61CD9A036379D2B77F48B70C08868549
- MD5 SHA1 SHA512 SSDEEP TLSH