Overview

overview

7

Static

static

3

hindi.exe

windows10-ltsc_2021-x64

7

hindi.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    hindi.exe
  • Size 3.8MB
  • Sample260727-mczzyaz1es
  • SHA256 ebec94006391b9fddae02473cf544712aa746553b080d29c6c178b33c6a325f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 50 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\hindi.exe
    "C:\Users\Admin\AppData\Local\Temp\hindi.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5732
    • \??\c:\35ded8c53893921045327089ef49\commoninstaller.exe
      c:\35ded8c53893921045327089ef49\commoninstaller.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1296
      • \??\c:\35ded8c53893921045327089ef49\Bootstrapper64.exe
        "c:\35ded8c53893921045327089ef49\Bootstrapper64.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3804
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:544
      • \??\c:\Windows\syswow64\MsiExec.exe
        c:\Windows\syswow64\MsiExec.exe -Embedding 53053F15223674763B975F08C3EEE1DF
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4672
      • C:\Windows\Installer\MSI429A.tmp
        "C:\Windows\Installer\MSI429A.tmp" install32 1081 0 c:\ProgramData\Microsoft\Indic Language Input Tool\Languages\Hindi\LangBar.ico
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2024
      • C:\Windows\Installer\MSI472F.tmp
        "C:\Windows\Installer\MSI472F.tmp" local32only 1081
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1396
      • C:\Windows\Installer\MSI4B76.tmp
        "C:\Windows\Installer\MSI4B76.tmp" install64 1081 0 c:\ProgramData\Microsoft\Indic Language Input Tool\Languages\Hindi\LangBar.ico
        2⤵
        • Executes dropped EXE
        PID:4716
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:2464
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:6124

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            commoninstaller.exe
            • Path C:\35ded8c53893921045327089ef49\commoninstaller.exe
            • Size 47KB
            • SHA256 284a17cb241474dd9f0fec996b6b8819168e7d3a0b5027e2cf1ae73a9c795249
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI3887.tmp
            • Path C:\Windows\Installer\MSI3887.tmp
            • Size 83KB
            • SHA256 05988c015aa0b37d407d2fae7b9941d5c331958dfb3e4766fcd7b3e636a82f63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI429A.tmp
            • Path C:\Windows\Installer\MSI429A.tmp
            • Size 67KB
            • SHA256 6fe086eed4b8c08c464e94e378e612bef7ce6b7f6ee8f2b837ca3572bba9623c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI4B76.tmp
            • Path C:\Windows\Installer\MSI4B76.tmp
            • Size 71KB
            • SHA256 967821dc9e71c9abb1bcc3833fc958a4a3ed3f22a6696e6718be2720d35d6339
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 35860cadb7fe4bb5ba8f7b65253c9054da15c038f38385b80cf8edc66d8edfaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {a6ce88db-d703-47e7-8a3a-e914e265da1e}_OnDiskSnapshotProp
            • Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a6ce88db-d703-47e7-8a3a-e914e265da1e}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 8a62b0c756b91ac3000685a9f1b0fad9f528821b1ebb531647ee04de37f6b0e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Bootstrapper64.exe
            • Path \??\c:\35ded8c53893921045327089ef49\Bootstrapper64.exe
            • Size 356KB
            • SHA256 811f174595354582ee186f88f80ac2bd7d8dad173cf9222e627ece3d8fc685de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CRT32.cab
            • Path \??\c:\35ded8c53893921045327089ef49\CRT32.cab
            • Size 578KB
            • SHA256 de31a81434f1c4b6860905f5dee527c8d1351daced498818fb8ca30d6a3cee97
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CRTBoth.cab
            • Path \??\c:\35ded8c53893921045327089ef49\CRTBoth.cab
            • Size 560KB
            • SHA256 ad053f37c995981c52975a58d0ca27ca619ffa66a64474c84427bd09cd8e2f4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Core32.cab
            • Path \??\c:\35ded8c53893921045327089ef49\Core32.cab
            • Size 152KB
            • SHA256 113280b7ac6bf6f5a732f186259ac2611a636e9f81c920e82ecf9e8905271c9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Core64.cab
            • Path \??\c:\35ded8c53893921045327089ef49\Core64.cab
            • Size 156KB
            • SHA256 f470d488fb523ad3ac09884080d05661fb609219b2cf0d048c78b7fd332ee5a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Hindi.cab
            • Path \??\c:\35ded8c53893921045327089ef49\Hindi.cab
            • Size 2.0MB
            • SHA256 8e73131e05f4c610fe226457ac8d76514d351c0c393c99a7a4ab11c1c775c135
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IndicSetup64.msi
            • Path \??\c:\35ded8c53893921045327089ef49\IndicSetup64.msi
            • Size 832KB
            • SHA256 4b44fc3ba739122cbe8e2d01e730ea42447715fb4bf328e42d486c9a45fe819a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5732-0-0x0000000001000000-0x00000000013E6000-memory.dmp
            Download

            memory/5732-20-0x0000000001000000-0x00000000013E6000-memory.dmp
            Download

            memory/5732-123-0x0000000001000000-0x00000000013E6000-memory.dmp
            Download