Analysis
- max time kernel
24s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader (1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target loader (1).exe
- Size 7.1MB
- Sample260724-w92dpswerc
- SHA256 d5e453e04e6af1ecbee910e6d17768dd393de418a6702efe8f904346d02eb3ed
- MD5 578d22410af99c2453d4e7b9865d1be7
- SHA1 3c7f6272d28e21812ce85142bbb3eebe62764cd4
- SHA512 76d36857802a5a81d505d7b1e196923755a7b815f1aac21047e61a71f71d31d8f3889d090dc40f148fdfd1fd88d62a1f8f78eb390f048369a7c223d70c9b0413
- SSDEEP 98304:Qz+YC0fdoGSQ95cGHgF9QaFWlxXVZD57gXuh7FCSQuQMm21P6nA85fxslCPxoXL4:GTlcEKPXQa4lrd5GuhRYu31iAQH6s
- TLSH T14E7623D21882057ED7A6C3B0C159EC7CF01F7E494DB0B84BBF86AA802D72551E8BDE56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 6 IoCs
pid Process 4124 loader (1).exe 1188 icsys.icn.exe 2596 explorer.exe 5800 spoolsv.exe 3856 svchost.exe 4408 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe loader (1).exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language loader (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 4264 loader (1).exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe 1188 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2596 explorer.exe 3856 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4264 loader (1).exe 4264 loader (1).exe 1188 icsys.icn.exe 1188 icsys.icn.exe 2596 explorer.exe 2596 explorer.exe 5800 spoolsv.exe 5800 spoolsv.exe 3856 svchost.exe 3856 svchost.exe 4408 spoolsv.exe 4408 spoolsv.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4264 wrote to memory of 4124 4264 loader (1).exe 88 PID 4264 wrote to memory of 1188 4264 loader (1).exe 90 PID 1188 wrote to memory of 2596 1188 icsys.icn.exe 91 PID 2596 wrote to memory of 5800 2596 explorer.exe 92 PID 5800 wrote to memory of 3856 5800 spoolsv.exe 93 PID 3856 wrote to memory of 4408 3856 svchost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader (1).exe"C:\Users\Admin\AppData\Local\Temp\loader (1).exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\users\admin\appdata\local\temp\loader (1).exe"c:\users\admin\appdata\local\temp\loader (1).exe "2⤵
- Executes dropped EXE
PID:4124
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\loader (1).exe
- Size 6.9MB
- SHA256 bb27bd01901ce31a07a904ad8b077a019c2dfafe24a40d20b361770dddce1a73
- MD5 233396fb093f2f76254f21872b601bb5
- SHA1 f9afcb8972e065f0bcc97fa2390877428609bf83
- SHA512 6e813962fb806441fc5636906cfe40c75f1792a570dcce378c831a4fba703179d5bf680d0060e4936bf96522a68ec0e9641e1d4b3e1f45e5ebe9cb2af3d8e0b9
- SSDEEP 98304:0z+YC0fdoGSQ95cGHgF9QaFWlxXVZD57gXuh7FCSQuQMm21P6nA85fxslCPxoXLn:KTlcEKPXQa4lrd5GuhRYu31iAQH6
- TLSH T15B7623D1188301BED7A6C3B1C259ACBCF11F7E898CB0A85BBF8669D02E32564C57ED51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 85b8d4c54a481926ae97c947f8060e8e45515d6845ce01604539ab480c807c44
- MD5 63a3c3a3a670aced19df7ea2720e7575
- SHA1 d5f81f3424c76ee4ff4d3cf90ae03878d10c2d9b
- SHA512 4a33c0b8e80805026763ba252ccb00e3ac35f0d93ac7e0f9e5d19d881b24eaf0571d651a0e3869107db9ee52aefcd8c65cfad5af0d8bfe96a3040da688dbc7d2
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalN:UVqoCl/YgjxEufVU0TbTyDDalQlN
- TLSH T1D7D3F823AD001C3FD92686F62899DB2E79126E3A1BE46D0B3793FF512971143B1F521B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 7cfab96f4086e945aaef52b6abf09f9c5f2706161718f0ac941e017adbadf4ef
- MD5 d1f385d62a5ed0a1ccb0b369548a15c7
- SHA1 ec8f376e7cc4f8969ed153019811839143a2e16c
- SHA512 974f249deb508a2e440744a452a8d0b3a3b21cda637e159f0502ebafb29ddf54637d3a4da5186866ffdfff893df5035f253a07dc07f8fafda576597e6d057a6e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalTFFFFFFFFFU:UVqoCl/YgjxEufVU0TbTyDDalQlq
- TLSH T1B4D30A136E101D3ED915C9F178AED6297523AE3A17A1AD0776A2FB0931B260379F130F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 6351476f1ac192f8748a127ffc250fa95466d111f7f9a073e3d7930f81c62f17
- MD5 b3e60b91560d934cb993441e1f67321d
- SHA1 06e497b8eea814e3585b833cd407bb8b9f6deccd
- SHA512 68e0b1110c7dbe53fa5ed35f8c82ba9bcf56d813a7c37299e10336864983b0d6da4cece63adc668f03d52f65fb05b99bd0f3c1f9720473b658a7cdad3074effe
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal6:UVqoCl/YgjxEufVU0TbTyDDalQl6
- TLSH T104D3EA23BF002C7ED952CAF128A5D66FB911AE2517B0AD073697F70026B524376F621F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\resources\svchost.exe
- Size 135KB
- SHA256 dbcb0cd8abfc072903dc692d553ae2b4b14433540309a7f9d325489685f873b3
- MD5 4971e5d1ce017d85e1a7f8ddb62e63a2
- SHA1 fb326f0f46710139187242b78efd3dd0eed24e80
- SHA512 ae9c31cc15d49f4a370d51cc0c965d877c105cd54adcacc14b900f00f8f4141e7425331b4b57e24dbfe80af26c696227c9b9d13326f24fbd1bfc0b6c28e86b52
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal2:UVqoCl/YgjxEufVU0TbTyDDalQl2
- TLSH T13CD30A27BE515D3AE91589F1A8A9DB1EBA225F3517E1EE0363A2FB01347610331F431B
- MD5 SHA1 SHA512 SSDEEP TLSH