7fe62ae0f80021a3f1b1aa2195bec50256467a8f54c1d09c51027dcc0d3ba82d

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
silly.exe
Size 2.8MB
Sample260709-b1ne9sct2x
SHA256 7fe62ae0f80021a3f1b1aa2195bec50256467a8f54c1d09c51027dcc0d3ba82d
MD5 0150893882793291c98a6d869b60e3ac
SHA1 ba7fec8cf9ba15450cb3df05013df57e4b34b593
SHA512 699513913d3abe4c8d3577ee26b64cfc04102daf44ef6b5f33578f6a8655ababa9e97fee416f74e034ddfac5b744c35fed2a1d081c3b8a0fe34898373489e225
SSDEEP 24576:TAb11vADcOy6HsIiTKD9vVos7fNoZ+MN9L7vToXWUo+Ec0xMki8UsU3AoTapOb7o:TAb1RAIOoIi6vVos6zMFapOb7v9SF
TLSH
T133D5F74369DB0DE5CED677B4A5C72335A734FD368A291F2BAA08C2312D536C4AD1EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.jpg"	silly.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2836	4948	silly.exe	89
PID 2836 wrote to memory of 3292	2836	cmd.exe	90
PID 4948 wrote to memory of 4956	4948	silly.exe	91

C:\Users\Admin\AppData\Local\Temp\silly.exe
"C:\Users\Admin\AppData\Local\Temp\silly.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s -L "https://pbs.twimg.com/media/HLlMMMWW4AACOfN?format=jpg&name=900x900" -o "C:\Users\Admin\AppData\Local\Temp\wallpaper.jpg"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\curl.exe
    curl -s -L "https://pbs.twimg.com/media/HLlMMMWW4AACOfN?format=jpg&name=900x900" -o "C:\Users\Admin\AppData\Local\Temp\wallpaper.jpg"
    3⤵
    PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4948-1-0x00007FF693FE0000-0x00007FF69412E000-memory.dmp

Download