Analysis
- user interaction
yes - max time kernel
23s - max time network
22s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/07/2026, 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader (1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target loader (1).exe
- Size 7.1MB
- Sample260724-w92dpswerc
- SHA256 d5e453e04e6af1ecbee910e6d17768dd393de418a6702efe8f904346d02eb3ed
- MD5 578d22410af99c2453d4e7b9865d1be7
- SHA1 3c7f6272d28e21812ce85142bbb3eebe62764cd4
- SHA512 76d36857802a5a81d505d7b1e196923755a7b815f1aac21047e61a71f71d31d8f3889d090dc40f148fdfd1fd88d62a1f8f78eb390f048369a7c223d70c9b0413
- SSDEEP 98304:Qz+YC0fdoGSQ95cGHgF9QaFWlxXVZD57gXuh7FCSQuQMm21P6nA85fxslCPxoXL4:GTlcEKPXQa4lrd5GuhRYu31iAQH6s
- TLSH T14E7623D21882057ED7A6C3B0C159EC7CF01F7E494DB0B84BBF86AA802D72551E8BDE56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 6 IoCs
pid Process 1092 loader (1).exe 2940 icsys.icn.exe 1232 explorer.exe 532 spoolsv.exe 4484 svchost.exe 1504 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe loader (1).exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language loader (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 4972 loader (1).exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe 2940 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1232 explorer.exe 4484 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4972 loader (1).exe 4972 loader (1).exe 2940 icsys.icn.exe 2940 icsys.icn.exe 1232 explorer.exe 1232 explorer.exe 532 spoolsv.exe 532 spoolsv.exe 4484 svchost.exe 4484 svchost.exe 1504 spoolsv.exe 1504 spoolsv.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4972 wrote to memory of 1092 4972 loader (1).exe 85 PID 4972 wrote to memory of 2940 4972 loader (1).exe 87 PID 2940 wrote to memory of 1232 2940 icsys.icn.exe 88 PID 1232 wrote to memory of 532 1232 explorer.exe 89 PID 532 wrote to memory of 4484 532 spoolsv.exe 90 PID 4484 wrote to memory of 1504 4484 svchost.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader (1).exe"C:\Users\Admin\AppData\Local\Temp\loader (1).exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\users\admin\appdata\local\temp\loader (1).exe"c:\users\admin\appdata\local\temp\loader (1).exe "2⤵
- Executes dropped EXE
PID:1092
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\loader (1).exe
- Size 6.9MB
- SHA256 bb27bd01901ce31a07a904ad8b077a019c2dfafe24a40d20b361770dddce1a73
- MD5 233396fb093f2f76254f21872b601bb5
- SHA1 f9afcb8972e065f0bcc97fa2390877428609bf83
- SHA512 6e813962fb806441fc5636906cfe40c75f1792a570dcce378c831a4fba703179d5bf680d0060e4936bf96522a68ec0e9641e1d4b3e1f45e5ebe9cb2af3d8e0b9
- SSDEEP 98304:0z+YC0fdoGSQ95cGHgF9QaFWlxXVZD57gXuh7FCSQuQMm21P6nA85fxslCPxoXLn:KTlcEKPXQa4lrd5GuhRYu31iAQH6
- TLSH T15B7623D1188301BED7A6C3B1C259ACBCF11F7E898CB0A85BBF8669D02E32564C57ED51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 9143fe0685a0eb9a3e23c8ce41fb2abc5a4747f5760a97d388733f75520360a3
- MD5 201fe8d01479d6edac34236feb89f3cf
- SHA1 a2e9ae329f334b3f17f3362336f66b669e8360c1
- SHA512 72a49c90ca4ba059613dc7d4cde67f0dbc8db664267698221d6569ca33d3816fdb9b2e6670ccf52dd3befa61f0c53ae11a55fa26c8e094d0b4e172fc86d2e22e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalI:UVqoCl/YgjxEufVU0TbTyDDalQlI
- TLSH T1F5D3D8637E105C3ED81189F138A6DA6A7E121E7A1B90EE4B7752BB0075B660376F031F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 7cfab96f4086e945aaef52b6abf09f9c5f2706161718f0ac941e017adbadf4ef
- MD5 d1f385d62a5ed0a1ccb0b369548a15c7
- SHA1 ec8f376e7cc4f8969ed153019811839143a2e16c
- SHA512 974f249deb508a2e440744a452a8d0b3a3b21cda637e159f0502ebafb29ddf54637d3a4da5186866ffdfff893df5035f253a07dc07f8fafda576597e6d057a6e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalTFFFFFFFFFU:UVqoCl/YgjxEufVU0TbTyDDalQlq
- TLSH T1B4D30A136E101D3ED915C9F178AED6297523AE3A17A1AD0776A2FB0931B260379F130F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 1c9e4966e9a006c0a970247a19e71eba8e97f1ee5f60dd700203d3629d9c0d36
- MD5 a84b9aaae6eef2b12ce82d8ce5c2a42a
- SHA1 28edb50ef57f160ae0a6c08777c0b32d65a89426
- SHA512 a1b93fd8b4e87922724de7959007f1586774c37f6fde0eb1f7584e6adb7cc55edd2bcc4b584fce196733c933e29c1b9b7c5d5dc58593bba31eed7d11c3d327d3
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpaly:UVqoCl/YgjxEufVU0TbTyDDalQly
- TLSH T18CD3F913BE105C3ED91589F128A5DB7EB9126E261BD4BD1732A6FB042532243B6F231F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\resources\spoolsv.exe
- Size 135KB
- SHA256 30119228b7cb7f384f6b9a7d14ba205507125fa9face7e05b303e78894c75488
- MD5 32a30ef9295c726cb459428db360c5aa
- SHA1 febe0e2f1b20fecfd71118f580cb28b031a30baf
- SHA512 a77fa3fb7d43db8ae1d9935190f8c4db97262d61a383e84db85201ec5a6302c6d4416b898f6f2b961ed57b5de5c824d94e0c7d3e818c8759cea59326e4b5a34a
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalA:UVqoCl/YgjxEufVU0TbTyDDalQlA
- TLSH T12CD32C13BE101C3ED860C9F128B5C65EB9229E360BE06D17B256BB1136B564B76F930F
- MD5 SHA1 SHA512 SSDEEP TLSH