6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Size 615KB
Sample260722-sd87wsgb63
SHA256 6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3
MD5 20c02a833c8e1b91a2b2fb57230a45ba
SHA1 4c3d332d803705059c67bd771988718400b00e7e
SHA512 9f740e1df49307c13fd73afc30dee5d7ab48f7d55a10e7ab3d8e1f51adc76778054b8ac3215a2e36cfd37b3db3be1419dbbc55396ff8018d545699da766e8c8a
SSDEEP 12288:OS3NhIPYYE49Se82bB0pvRclrV64LaKX6uYDYpVHABmMND1HjYqa:h9LYuehbB4OrciaK+aHeHXsq
TLSH
T1F0D42372F79814C4F6ABF93ADDB3328B45BF554224F3A94325B04E126A0BCFD6C12249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.MyNSHandler\Clsid	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.MyNSHandler"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.MyNSHandler	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.MyNSHandler\ = "this is my ebook"	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4504	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4504	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
4504	6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe

C:\Users\Admin\AppData\Local\Temp\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe
"C:\Users\Admin\AppData\Local\Temp\6b2eff78031e9d1ba11c903f93c98a603ebf02c16d90359300b17a027f5d2ec3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4504-0-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

memory/4504-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/4504-2-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads