c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Size 144KB
Sample260716-e5g1tsc15n
SHA256 c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8
MD5 7e1fde35bbbb38f25b2248fb5034fb6e
SHA1 c7da96027464f719d294e4e978c192de4b8d9e95
SHA512 4c98314017598cbd7ccd30ca82cf712d0274345031753e2427c47abe6198e5c05d0063cdf6212a4da1f83fc69e68d3eeedc22117c1118aef2381e467c19eb6eb
SSDEEP 3072:WDwVxUonFnBJggJ+0rtooo13BT1usUzS:5UqnP+0g1u
TLSH
T193E30802B7E329DCD537C6358AB66333EB32BC105930AB2F1E54D9660E71E94AD29F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe

C:\Users\Admin\AppData\Local\Temp\c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe
"C:\Users\Admin\AppData\Local\Temp\c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-0-0x00007FF63A1F0000-0x00007FF63A215000-memory.dmp

Download