5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Size 1.9MB
Sample260716-e99xeagw91
SHA256 5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a
MD5 6c3b2cfc1d7b098ced2d39dfa144b587
SHA1 97c678fb8f8578fcdaa5fd14657d5ec5b2fa00d2
SHA512 ef063403f8f202bffef199332c5d4686bd4e92ca439f0ae541915b776a7431cad32116d263dc88caf0c93867b7ba8df246c3ee81a238e32c62ab360d2abcabb6
SSDEEP 12288:5Uqn2N3GIwpZuxMUqn2NtaXAUqn2DXtW0RMGIwpZuxMUqn2N3GIwpZuxMUqn2N3u:fn/ZuxknPgnwWw/Zuxkn/Zuxkn/Zuxg
TLSH
T14D95C89077E85885E931937C59F65331373DFE908BB28B0B5A04F52A1D23EC07D9AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe

C:\Users\Admin\AppData\Local\Temp\5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe
"C:\Users\Admin\AppData\Local\Temp\5811087c5fd8979e8a237e54eefb71c32d02604874a11807020bc537092e1c4a.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-0-0x00007FF7D8F80000-0x00007FF7D8FA5000-memory.dmp

Download