72f1e6bec6d5c8041f11c09b42e3f4f43f5647df79e2e6525dd2cc45c2e11541

Analysis

max time kernel
152s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Airaware.exe
Size 163.1MB
Sample260709-csfacscy31
SHA256 72f1e6bec6d5c8041f11c09b42e3f4f43f5647df79e2e6525dd2cc45c2e11541
MD5 35aff927cf146a01f73fb4fc0b220285
SHA1 555b4d9f6cd856ada5760df62213cb5857b2b7c9
SHA512 647a4088794a1c2abc6e9dc78c30d097205cf4061b45cbb2f189fe87430f3dbd5c3e5b07193479a8da247227b2dc7d45f7c49f3692ce2af6f87f14142cfc4769
SSDEEP 786432:QdIVEIwfZ3ry6jROX892vY1FUV5OtsFntaRu/bSs5c4ZQp5m8cq80dpMr7yZi:oIVrw5ry6jRG8MvYUFJTSs24qp5VJS2E
TLSH
T1F7888D1163E81A45E27B8678D77382A1E6B1BC535711C1CF0094FA4A2F77BC2BA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper2"	Airaware.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\WallpaperStyle = "2"	Airaware.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\TileWallpaper = "0"	Airaware.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	Airaware.exe

C:\Users\Admin\AppData\Local\Temp\Airaware.exe
"C:\Users\Admin\AppData\Local\Temp\Airaware.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads