9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Size 487KB
Sample260722-snsynaxeqf
SHA256 9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8
MD5 bdc4254284746a48fbfe96a1887e11e1
SHA1 7470ca8a6594a9af381d13c5860cebabe0cbc4da
SHA512 5e9d73d89222628429cbd7792ec2a1e1b7745c0ceae090ec18f07404db88f2774d02e011d742b6f3336568d0f63881437e05fc47e8404e33fc8920f36dcf436c
SSDEEP 12288:OS3NhIPYYE49Se82bB0n9r47fvKG2VHIyV+5:h9LYuehbB4cvf2VHIB
TLSH
T13FB42333539408DCE0DBACB84EE78BAF9EF7320174BE66835A71C5116816DABF464D60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.MyNSHandler\ = "this is my ebook"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.MyNSHandler"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.MyNSHandler	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.MyNSHandler\Clsid	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe"	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5108	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
5108	9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe

C:\Users\Admin\AppData\Local\Temp\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe
"C:\Users\Admin\AppData\Local\Temp\9204b653f0bc76e39afaeb7bc859f0d91bcbff76268d5c37478a6d790f0194a8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5108-0-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5108-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/5108-2-0x0000000002270000-0x0000000002271000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads