7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe
Size 9.9MB
Sample260718-abftfshx8j
SHA256 7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7
MD5 b77eceff4cc735edfc031cf3cc6c0d14
SHA1 a5ef1785fd415ed7bd595050e13f1c134aae321d
SHA512 daacc90cb1507b8c3263ea583c49adfeb6c80353d8a48c8222bb00ff475096b5afdb3d74bddada9c04347edab579472f9347762fbb39e0613ba48d477cc97f9f
SSDEEP 196608:233kmOY1STQDrCzZkRuAGpOpfwNbWBhvd/wrJawaST:2HkmOYwc/CjAaOdw1WBZd2a5I
TLSH
T1E8A61221B6B2C072D55652308B3DAFB645ECA734472091C7B3C45E2E6E316D3E236B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5744	7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe

C:\Users\Admin\AppData\Local\Temp\7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe
"C:\Users\Admin\AppData\Local\Temp\7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e67a_d2e7_db7e_fa395571919d25d2ca64c3a296fb05dc[1].mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T3RVB22\e67a_d2e7_db7e_fa395571919d25d2ca64c3a296fb05dc[1].mp3
Size 1.2MB
SHA256 c85250326d175e97a9e4b92ff5ae44389c52354e9b8ea85cb333de2e3c5d5aa7
MD5 5feeb4b830157f008781082896151fc9
SHA1 08a05b9e57b9f6a9af445a0369a4c507b1cc8777
SHA512 fb9691b28655f1daeb915574320744efae593f644e6aa505da96b18eb9a0be6062409499f142d16c95b97b9a4150d6ce516d110bdd3ca9cf8dcdd8cf1c55f73d
SSDEEP 24576:H8kOJQyh/54zUjp3FQRVSf04cSlg1HNGx/6hH6+oCw8zZjLGwG0zCC:Heh/5oU1FQRMuSliHNGm638N6wG0OC
TLSH
T1BF5523DC8019DB0A8F407B1369BD6A4736E43BDC27E5F0E684BC23C62FA6DA0D8D6545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5744-0-0x0000000000100000-0x0000000000AEA000-memory.dmp

Download