8d9dbf320aee83c537a32d2fd55567a76eb639aa30ec40c422a28c65f52025f2

Analysis

max time kernel
123s
max time network
185s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Leonardo 0.17.70 Multilingual Beta/leonardo.0.17.70.winstall.exe
Size 7.4MB
Sample260707-tbbdhsgy91
SHA256 8d9dbf320aee83c537a32d2fd55567a76eb639aa30ec40c422a28c65f52025f2
MD5 e5a7899831b471a7c5124a1cfb811bc0
SHA1 d79616808cf885392eb452808526d53ab73e4e24
SHA512 a2e56d5b893c4363eb14bf0f5c03030d048be07c7d2473d6805177323da3107e19a36f4e2639f765df7b76d3161d9d081ca28ec3bbe61cbcdad3b65efec6e863
SSDEEP 196608:aYRQiznh8rdoI8NMpPSP6dAERWKx1u8MlKL95/nhig:aYyizodoIfgEAE5rdMlm5/hig
TLSH
T1E47633866F50EDD9FB79623E2A218708FC76E41E98991E5427E11D3C1E0F7CC326E852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
4504	run_latest_leonardo.exe
1360	leonardo.0.17.70.win64.exe

Loads dropped DLL 3 IoCs

pid	Process
4176	leonardo.0.17.70.winstall.exe
4176	leonardo.0.17.70.winstall.exe
4176	leonardo.0.17.70.winstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leonardo.0.17.70.winstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	run_latest_leonardo.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	leonardo.0.17.70.win64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	leonardo.0.17.70.win64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	leonardo.0.17.70.win64.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\shell\ = "open"	leonardo.0.17.70.winstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\shell\open\command	leonardo.0.17.70.winstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\.leo	leonardo.0.17.70.winstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas	leonardo.0.17.70.winstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\ = "Leonardo Canvas"	leonardo.0.17.70.winstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Leonardo\\run_latest_leonardo.exe,1"	leonardo.0.17.70.winstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\shell	leonardo.0.17.70.winstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\shell\open	leonardo.0.17.70.winstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\shell\open\ = "Open with Leonardo"	leonardo.0.17.70.winstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Leonardo\\run_latest_leonardo.exe \"%1\""	leonardo.0.17.70.winstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\.leo\ = "Leonardo.Canvas"	leonardo.0.17.70.winstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Leonardo.Canvas\DefaultIcon	leonardo.0.17.70.winstall.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438	leonardo.0.17.70.win64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 5c0000000100000004000000001000000b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e43820000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	leonardo.0.17.70.win64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3944	sihost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4504	4176	leonardo.0.17.70.winstall.exe	93
PID 4504 wrote to memory of 1360	4504	run_latest_leonardo.exe	95

C:\Users\Admin\AppData\Local\Temp\Leonardo 0.17.70 Multilingual Beta\leonardo.0.17.70.winstall.exe
"C:\Users\Admin\AppData\Local\Temp\Leonardo 0.17.70 Multilingual Beta\leonardo.0.17.70.winstall.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Leonardo\run_latest_leonardo.exe
  "C:\Users\Admin\AppData\Local\Leonardo\run_latest_leonardo.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Users\Admin\AppData\Local\Leonardo\leonardo.0.17.70.win64.exe
    "leonardo.0.17.70.win64.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Modifies system certificate store
    PID:1360

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:3944
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:4920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6012

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

leonardo.0.17.70.win64.exe

Path C:\Users\Admin\AppData\Local\Leonardo\leonardo.0.17.70.win64.exe
Size 9.4MB
SHA256 8df6fc289e3d490c2be013e69b13b49e4e691465b0400584cff6bd6ae37fd0eb
MD5 ec76279d61f33d56bc60cb0226a6e586
SHA1 7b780c37d03be1222443ed6aa45e9ee65c718054
SHA512 698701be34ff99874e245e6176a65678d8a5ecf0e647cd0ff576f5c1ca7cfc86de180df0bcd9d69d5f48cdf789e0d3d238b9a52108cdf1f6d2190512a1bb63dd
SSDEEP 196608:9gUUJlZHsQTGbWDlHQevKMeLB/ppcmmTBz4A:9pUJll1vKMeLGmmTBzL
TLSH
T1A2A68C43B3A184E4E8B681758971DB9AC3727C094F30C7CB2295B96A7EB3BC10DB6715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_latest_leonardo.exe

Path C:\Users\Admin\AppData\Local\Leonardo\run_latest_leonardo.exe
Size 655KB
SHA256 e0f502e5026e2cb408c38bf7feca0d3f990bc9db2a9035206a5a31086270b92c
MD5 1ba4afa924e7f32e6ba498a869cd91a7
SHA1 5da2721d43b976f4d8313c6176da94c28a0b4984
SHA512 aa49226c9145c40f200b7cae9c67f3baae66b6110fb97aad5093daab9fb91a52f6b825a2e8b5246c3ddb4c738e3420055c52a9b70d6c64cbe1f7adc2dd8827fe
SSDEEP 3072:uKiL7GLnO/2XrV+vgnvqaoajmuuffDewRus7IyB0Jt:MXcOarXq9uuffXReyB0Jt
TLSH
T1B7E466E8D7818C75FA9314B85DBEDD265227DDBE1CC209825A2F34F6AE61B8438F4143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3456.tmp\ApplicationID.dll
Size 198KB
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3456.tmp\System.dll
Size 11KB
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
TLSH
T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsp3456.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3456.tmp\nsDialogs.dll
Size 9KB
SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
MD5 ca95c9da8cef7062813b989ab9486201
SHA1 c555af25df3de51aa18d487d47408d5245dba2d1
SHA512 a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
SSDEEP 192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
TLSH
T16312F793E5A820B3C6D3523F35BE2B2EC7B95335B0512C0487738A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Leonardo.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Leonardo.lnk
Size 1KB
SHA256 1b3eb3d3a5e8a061170970bdfd99a457221c2bd08c6dc385ef7310922f9c7d92
MD5 f47cf84862af7a184d6352d2e3b76b6f
SHA1 952c1ef893f73c3b9e913d14a79d3ea66a348abc
SHA512 fbfa0a36d219d49b937a6db880be910ef9de4158cebe553c0d6f0ade6dd7884293614b409ab89c514f02db27858c7243e9f44fcdc72976d6944bd09852f56544
TLSH
T11721F305AAD22F15F77BCB3926B762299171FC99BA678F2C4540A1451C78342AC08F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Leonardo.lnk~RFe59bd1c.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Leonardo.lnk~RFe59bd1c.TMP
Size 1KB
SHA256 f288ee6cd0f582cdba170304deecdeb9528ff0eb58d379122173b184e4e232a7
MD5 e1906eeb441372e6b400f7a59d7a28c6
SHA1 97014f1a08cf96e4540ead4484225768266ca16a
SHA512 d6c8939a23a3529cd16c2189be2107a0e52ce8f0a8d65a0fd5485c98d7f45504f63d41b545769b3e0d1552642002a85cf7c05275e3e42ad8129a3f5d20b55edf
TLSH
T11721C2066AD26F15E77BCB7926BB6225D172FC49BE634F2C4540A1451C78642AC04F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Leonardo.lnk

Path C:\Users\Admin\Desktop\Leonardo.lnk
Size 1KB
SHA256 80fe87d8fff5a660238b0a941b534a53af9e8baff15952df603c8129ca6b2149
MD5 0d9dbb49244a8e288a3ff848bbb28c2f
SHA1 7744dbe5aa7e45204355592e462e31ae3f52136a
SHA512 f7a5b58d668c18aa3ade4add5d69c0de998ae28460c6ccdffae3a8d965f530d75d4298105034226ccba8ecb11652f6e5f43bf0a4d6b18d518b33803625559033
TLSH
T11A2102026AD25F16E77BCB3926F763159171F8993B238E3C4140A2451C74642ED04B2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5792-107-0x0000012200000000-0x0000012200100000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads