e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Size 449KB
Sample260722-sd63jagb62
SHA256 e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa
MD5 c5394590b4178a4ecb8f140ec624e6a7
SHA1 66e64997e93d1c554cab51f551702ac1895006d6
SHA512 93f4b1fdb0d70ebb546299f2a6c1607defb58a43af81a0004489a424dda6ec6d467862f3377a41625b69e75634435c02c467016cf9d42206edfb25af1b7f689b
SSDEEP 12288:OS3NhIPYYE49Se82bB0avRclrV64LaKX6dv9C:h9LYuehbBjOrciaKsv9C
TLSH
T130A42336A78820C4F56BE8349DF373D78EBFE14164ABAAC3257089137E058FF6861564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.MyNSHandler\ = "this is my ebook"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.MyNSHandler"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe"	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.MyNSHandler	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.MyNSHandler\Clsid	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
4340	e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe

C:\Users\Admin\AppData\Local\Temp\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe
"C:\Users\Admin\AppData\Local\Temp\e14e6f7977535683c81a9a05fbd4c01aef30c10b7fd093e1caee6aaafd040ffa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4340-0-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/4340-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/4340-2-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads