860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Size 3.6MB
Sample260727-jx239ayvas
SHA256 860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2
MD5 efc2a188fe5f5292393f1b934b02199b
SHA1 281efbcc9c25f68d7bab4ef561db613f8bfdd4a2
SHA512 e4aefb4a10958cab8dc63011b783bd5f91ba6e5d4337e24ca3e9b56ddbc42a104401b23c130d052d22325f9eea39d9dc0a5b93a4f5ea228fffd432ac705538c1
SSDEEP 49152:2li4xMDZJXuf6R2q5kTeo9paH5M9OisZPFWT3VhCmcYpRqAOmZT3br6K753LwOq3:rZWzpCIUOqyiFUQSQlHYo6+I8Q
TLSH
T18F06AE13FA00C436E0920374583BB7B9B83ABA343B5596C3B3E56A4C9EB67D07916357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3288	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe\" \"%1\""	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File\DefaultIcon	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe,1"	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pkg\ = "Download.Package.File"	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File\shell\open\command	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pkg	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File\shell	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.Package.File\shell\open	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3288	860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe

C:\Users\Admin\AppData\Local\Temp\860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe
"C:\Users\Admin\AppData\Local\Temp\860ca28f85ff2f74356dbe15936b0ae5d18d64f109774f5fde5f631e1db23ff2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libUsb.dll

Path C:\Users\Admin\AppData\Local\Temp\libUsb.dll
Size 397KB
SHA256 67a8707dbfaee9ea49cc9fa5c0c43114524dbcb7d941996846b35bd166baca32
MD5 d5c3c069cc2fea4870e22a2d4068500f
SHA1 d8185e4bf30578625eb0a5c3eef875bad5054592
SHA512 ddf6362f34ac9e7d2226fab53358ae877b19d12dc715d01e6d55ec61113ab9be45c38ee36c86ba216eba89a818b6ad7c5d2652cee9d43dd0656bc08861ee2147
SSDEEP 6144:TxVnVKyTvxAC+tyiJKTBH5j4rqlhNYH6nRyFURlQzNFUV62yFvFbn:tVlxXyqilHUANvN
TLSH
T1B3845B03E68199B2EA9F44F8705B37F646213B3173DAD1F3EB93698AD9611E1623C305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3288-0-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/3288-7-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/3288-6-0x0000000000400000-0x00000000007B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads