ecb4cff5f5fdc667b4201b64f86d742021589d91df20cbe84de1ee68d887c5b3

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Recoverit_Installer.exe
Size 2.1MB
Sample260716-w2pd6sa15m
SHA256 ecb4cff5f5fdc667b4201b64f86d742021589d91df20cbe84de1ee68d887c5b3
MD5 535207a66299dc04227b5359a6975d3a
SHA1 f859c679fe216a5e1c8b16f84f896420603a2be3
SHA512 1d402e400ebcf80bba140c123027f9d231cc365970e8d749485a6a7424a9ffccfbf1688e88d7de4f429871b0bd20b0199e6c4dcee2e72d48781dd8b90f208c5b
SSDEEP 49152:4n8zPqzpzTQoPKspSYFoFDxm1Tm3XmN9L7j8:4n8zPG3yG7FoF0+mNN
TLSH
T1BFA5CF02FBC1C0B3F2A31331442AA7295ABABE74573189CB63D46E4D5D719C1E93A367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\wae.tmp	Recoverit_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Recoverit_Installer.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\MuiCached	Recoverit_Installer.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	Recoverit_Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Recoverit_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Recoverit_Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Recoverit_Installer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2284	Recoverit_Installer.exe
2284	Recoverit_Installer.exe

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Recoverit_Installer.exe

C:\Users\Admin\AppData\Local\Temp\Recoverit_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Recoverit_Installer.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 1KB
SHA256 9da5cddd0e01e5f464303b051ec3533a9731c14b49cad845d82b6e506528abfa
MD5 f56e1ee41d22ca17f00297ec0abd11aa
SHA1 36f03f9f99108a8d76c2e51c6147885736a088e7
SHA512 6c79baec4d93b93599fd687f06df214d215f05f86f31557f06b8c0c9c169f1eb8fc8a9ab840580508d76ae4a545819a1076fed4d20db6e22196713657414ca8b
TLSH
T1F22186D26138C1E7C2845A9697699F97D2D4B22ACC4A5C407784E9847B0CF33982FB71
MD5 SHA1 SHA512 TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 2KB
SHA256 64ac6d99eb54ef9227fb068123f8626056ea9f17fec6bfb83af2219e7e321827
MD5 8b640efe206bb5b6ab8262f4b1891cd8
SHA1 7b8d5cd1c1ee9bb5375489977582e4608d6a3e13
SHA512 3900c976391d40f052673c901fbbf08ba4ddd9d30582d025f88f8c9f8287ebe3801028b893e0ba46ffa28ad9b698895ec8a75a5b613ed8296b7eb3188d5cf31c
TLSH
T1BE41D9D67138C1E7D284169697698F97C2D4F22ACC4A5C40B784EA847B0DE33982FB71
MD5 SHA1 SHA512 TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 2KB
SHA256 f5dbb1db73926e0d28e542d8f84ae67ab1f8490526f9ddc4c9bbc9ff7c2a975d
MD5 4e5da7bfe95640d0683beb866438ff88
SHA1 f0303126c351b28aba6b6dc2566af02865f54fcc
SHA512 6dafa890c3667c74c834fa5b28b0c2347de6d87415efbc429474fec8db44d2a25b52541729848a89b24cf2d09a7731053317fec32036684fbaf87b76495833f6
TLSH
T1005106D67128C1A3C2842A9697698F97D1E4F23ACC4A9C407794ED847B0CE338C2FB71
MD5 SHA1 SHA512 TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 5KB
SHA256 7fb74c1905b62e211e67c9a02692d8bd0957c6dbefd01a0753af24afd37e75c3
MD5 81ebd5aa8d57287ab27655259d6b8892
SHA1 e115f89959749b79bed182bbad5d08c911d8ae20
SHA512 366d8468f25dbd7b53dcdc84fe0427acad39c90e25983beccf812a767a9410c2a46289f046b9d9f36e3961d5d57ce5945048ea7a1695559ea295f73d5efd9186
SSDEEP 96:oZOrjWAZOrffG2e9oWAZhlm7tiRSo5iA5vJ5vHE5i4vqvYhmW/7WAZLiuz2Iqn4W:ue6AZFXFAZ+75m0SAZriPn4aphh
TLSH
T145C176D57029C1B3D2C46696D3294F97E1D9B23AD84AAC41B790BD84BB0CD329C2FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 634B
SHA256 6f099f4d743321f16adb486235977294c747d4b6029a3787feac22463f72b47c
MD5 ad0814e85d1c6038e7a4d1c8f4ee43ad
SHA1 fbca2657b3863dd7b92edfb9c01e8ad93f552d85
SHA512 6dc698060745c9063f78ee76f9d0e6e222bd0e8e3ad366f251a649f067cfc3c497fdf416bb0bd168f897e9184835047965ef0496bbe24c886a16c9600499682c
TLSH
T1B4F01DE3312CC0A7C2885A49A6655ED7C6D8B17A9D1A8C447784FC80770CF726C2FB70
MD5 SHA1 SHA512 TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 1KB
SHA256 488ac4715f701338f8762814ef89bfabe5cbef621030ae07d3701f29dc11db82
MD5 4401f2b64e2f6e93752132c2d4b6a5e6
SHA1 9a7d17dba67b8f37c627203d345ff84cb5859f21
SHA512 befd2f3d7794ad69f6999bae63cd6380d01b2b28cc33420e71229824f813ad5b1f77fd649b75d54f750064b7369d0852de8c8c39b567fb7476ea5a0f6314346f
TLSH
T1A03180AA237CD052C55A3F2985289EC7C0D17031956D8DF0A7A0EC903F9CB76152FB76
MD5 SHA1 SHA512 TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 2KB
SHA256 d6739cda9bc1eb75979a4ac41581052c77a7ffd1c86b35a2d0c3236c6f8830ef
MD5 e649950c31d72dc765b381f67df9a3aa
SHA1 88a4de98ec8cbca0866f8b1b504ba5386187b2fa
SHA512 a87582b4bd8429c42e2efe707b6ce7f1bd3e8483ffbf800124a4e09be079688d20a372015ab4d664f808ca0f67031ff76eda824565d4be9b8018187a5bc65662
TLSH
T1F7416DAA237CD152C55A3F294568AEC7C0D1703195AD8DF0A7A0ECA03F9CB72152FB66
MD5 SHA1 SHA512 TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 4KB
SHA256 9f8f8fdf84aa1c2f0b3bd6799c7219b3e29afb9bd7345dd2b874d6e147635c3d
MD5 e6052f8cb7e3535e7d52fa0dacb0caa5
SHA1 f7089f5f17f03d38c8cc1173491bb3b3f6f5cdc2
SHA512 4d3911e27244e5f95fc81b25d167248d419dbdbc278485eb0ed987e5f35f20d863f32fd4f9d3270e6c194f6621774fe14cae47ba1e1324a41a9c488281ce0a4a
SSDEEP 48:ohsjfzdVD+M77eellQQvvSSFPFPUUjjmG/mG/O/O/7777777777777777777777U:omNFb4
TLSH
T176A1B9A9237C9152C56A2F194568AECFC0D17031956D8DF0A7A0ECA03F9CF72152FBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 6KB
SHA256 04e6510550195c20c2a12fc97860b8affbf1e28c335cd654dc37a50549a3f539
MD5 ba112efd20593ac1039aaee801109d17
SHA1 36d80e8ec879916229487af6ce77f9372bc5f7e0
SHA512 7a0c3bb82b69bc39198062687ea5cd1bda2b7a0985fb42486a86b2022a2c8d66f97c55ba87bb40edfa41546e08f55d7e9332aae5b12f24c983c9a70741d86102
SSDEEP 48:ohsjfzdVD+M77eellQQvvSSFPFPUUjjmG/mG/O/O/7777777777777777777777I:omNFbs
TLSH
T108E1D7A9237C9152C56A2F194568AECFC0D17031956D8DF0A7A0ECA03F9CF72152FBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download