45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Size 4.0MB
Sample260722-g4mk2azekf
SHA256 45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884
MD5 92e12a7b4e0ccf338d03365d270b35e4
SHA1 abe4982bc48f284a5450fb46d77c5475a3bba3cf
SHA512 d2aa9aa57e98eb800e2a54acf13b659b572b09292c00fafb589719dda673136ae55a4182bbd2a8268f9f03fd468e2e6f161e9b9a0b20453bd24162eef555d115
SSDEEP 49152:IScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:7cAmPLE6dY/j7oQqV14R6
TLSH
T12E168C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4740	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884?.exe /dde"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF ??"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884?.exe\" \"%1\""	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID\ = "FoxitReader.Document"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884?.exe /dde"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884?.exe,0"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2\ = "PDF"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884?.exe"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884?.exe /dde"	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4740	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
4740	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4740	4544	45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe	89

C:\Users\Admin\AppData\Local\Temp\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
"C:\Users\Admin\AppData\Local\Temp\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
  "C:\Users\Admin\AppData\Local\Temp\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e5931a5.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e5931a5.tmp
Size 5.2MB
SHA256 faed862959fa09b93a884d3f81cb0167800b2a66f8eb410554f9d3781b59c0b7
MD5 b27ad67d258543187490cced4649c83d
SHA1 1c62ffcdb3e5f8b2fe7320dd11bc89228927a337
SHA512 9e54836d6fd8c4ab509652b69447a5c6cbef0af2270de92f9818364f7dac3c12ede9e8e6ff584e598c2918cb4f8917d19ec81958e283975f301c268d5149fcd0
SSDEEP 49152:8sQmSoFCuQrb/TWvO90d7HjmAFd4A64nsfJzDtlod5Pqe8tOCED4PgasvccmnkLH:8wFCu6jHICG+D4y9kULnTH
TLSH
T1F7468C03BC9560E8CAEED130897A4252B7717C891B3177C72B64B6B92E337D85E39394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe

Path C:\Users\Admin\AppData\Local\Temp\45185506509c7580d6969413285bed420ee37e83a09209e5309a9f31f6c5c884.exe
Size 4.0MB
SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
MD5 b1191e63619b914fe659dd64ddc3b0b8
SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
TLSH
T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
MD5 SHA1 SHA512 SSDEEP TLSH