Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
touchskins.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
touchskins.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target touchskins.exe
- Size 5.3MB
- Sample260709-vj2fcad17q
- SHA256 8d6d99db0a954e84a4ab312a6d3d86a32ce79fa8c85b0b51ee12b2b78b8b8dec
- MD5 d98ab0c6d936f1849b0f5ed89f38e0c8
- SHA1 e0c13a72faf0c16a0be0aa3dc9aa8c8043361024
- SHA512 128eca5480900acb0dbc703a288893023381f0d012c43f7e19d710ed559e40f08c94a90dfdd346f2a745a84911609f3d2d4a1960b1efeb72d0ba636133a47464
- SSDEEP 98304:6fNMsIqwZCnwUbSJ9ZqVv54v5EtxGhjFuSz:6fxn5GJjZ3hYM
- TLSH T1FA468D43B2E664FCCA16C134930BA733E9357C491631ADAB16D0EB703EB69605F2EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins\shell\open\command touchskins.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins\shell touchskins.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins\shell\open touchskins.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\touchskins.exe\" \"%1\"" touchskins.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins touchskins.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins\ = "URL:TouchSkins Protocol" touchskins.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Touchskins\URL Protocol touchskins.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe 4364 touchskins.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4364 touchskins.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4364 touchskins.exe