5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Size 1.9MB
Sample260716-e99xeagw91
SHA256 5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a
MD5 6c3b2cfc1d7b098ced2d39dfa144b587
SHA1 97c678fb8f8578fcdaa5fd14657d5ec5b2fa00d2
SHA512 ef063403f8f202bffef199332c5d4686bd4e92ca439f0ae541915b776a7431cad32116d263dc88caf0c93867b7ba8df246c3ee81a238e32c62ab360d2abcabb6
SSDEEP 12288:5Uqn2N3GIwpZuxMUqn2NtaXAUqn2DXtW0RMGIwpZuxMUqn2N3GIwpZuxMUqn2N3u:fn/ZuxknPgnwWw/Zuxkn/Zuxkn/Zuxg
TLSH
T14D95C89077E85885E931937C59F65331373DFE908BB28B0B5A04F52A1D23EC07D9AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe

C:\Users\Admin\AppData\Local\Temp\5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
"C:\Users\Admin\AppData\Local\Temp\5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-0-0x00007FF7DB360000-0x00007FF7DB385000-memory.dmp

Download