f7203529a4bcc804a141f7f15715c0e257992e23235c8c1dde3e847950fe3b9d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kversionswitchdaemon.exe
Size 477KB
Sample260727-w3dn3acd94
SHA256 f7203529a4bcc804a141f7f15715c0e257992e23235c8c1dde3e847950fe3b9d
MD5 da4e939c2670b15a1d6d1db1ec1a6ece
SHA1 254321507d0cb8fffc2236bafb69257ea9790821
SHA512 4b0077b48887ef6f74ce07c17d633e4870425fcd77f0a92eac78c265d76c7afe267a8c4a979cb05714a28345c4f1222981c5b3907ea752914cde72ff5c66d857
SSDEEP 12288:AN4HHBnIf436zVuuvq8g2UMTNMscKOE/3wk:k4HHxwvql2/5OQ
TLSH
T19AA46B2076BBE131E4B244F05E78EEA1647D7D282B7046DF73C42B2A6E305D15A34F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kversionswitchdaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kversionswitchdaemon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoet\URL Protocol	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoet\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksolink\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksopdf\shell	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp\DefaultIcon	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoapp\ = "URL:qingbangong Protocol"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowps\shell\open\command\ = "\"\\ksolaunch.exe\" /wps \"%1\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoqing\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupET	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksopdf\ = "PDF Protocol"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoqing\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowps	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPS\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoCustomProtocol\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoqing\DefaultIcon	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowps\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksopdf\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksolink\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksopdf\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPS\shell\open\command\ = "\"\\ksolaunch.exe\" /wps \"%1\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoapp\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoapp\shell\open\command\ = "\"\\ksolaunch.exe\" /qingbangong \"%1\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPS\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\URL Protocol	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoet	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupET\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksolink	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPS\ = "WPS WebStartUp Protocol"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoapp\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoCustomProtocol\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoqing	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoapp\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPS\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksopdf\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksopdf\shell\open\command\ = "\"\\ksolaunch.exe\" /pdf \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr\shell\open\command\ = "\"\\ksolaunch.exe\" /qingbangong \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\URL Protocol	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowpp\shell\open\command\ = "\"\\ksolaunch.exe\" /wpp \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPS\shell\open\command\ = "\"\\ksolaunch.exe\" /wps \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoqing\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupWPP\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoqing\ = "URL:qingbangong Protocol"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoWPSCloudSvr	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksolink\DefaultIcon	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoet\ = "ET Protocol"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\KsoWebStartupET	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksoet\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksolink\shell\open\command\ = "\"\\ksolaunch.exe\" /qingbangong \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\ksowps\shell\open\command\ = "\"\\ksolaunch.exe\" /wps \"%1\""	kversionswitchdaemon.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5804	kversionswitchdaemon.exe
5804	kversionswitchdaemon.exe
5804	kversionswitchdaemon.exe
5804	kversionswitchdaemon.exe
1716	kversionswitchdaemon.exe
1716	kversionswitchdaemon.exe
1716	kversionswitchdaemon.exe
1716	kversionswitchdaemon.exe
1716	kversionswitchdaemon.exe
1716	kversionswitchdaemon.exe
5804	kversionswitchdaemon.exe
5804	kversionswitchdaemon.exe

C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe
"C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5804

C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe
C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 2472b7388c99562851530f5452764b9e5279cdc8d3b8a233c0db2acd35e9bb4d
MD5 11e2738bd65f8d0a48f3436208a7ffbc
SHA1 714b0a8e46bd16404a9041f54606b9433f7acd0d
SHA512 489775813dafd84a9efb1f5d6bfeb6ec07fcb5250ac94c4b75ade3c87174464f877ea661f9bd64eab09d40128107836d634c23133deff19d23047c5f22d6fe31
TLSH
T17431C49A8FB63A41FF405D4226CACA3D6AB06AC0A87E04066235928615503623B6B90E
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 5045a429a0906d44362ece5b4e3d0431da744a4d86e1ad4d9d50c4d6cfa9328e
MD5 b28dec3c6e992e64828c74e9f54d3896
SHA1 9c868c8109d377e027b9703b17af36e2a304797c
SHA512 9be74d571d275bc18d93d7cff0ab2e2c5559c0a1084430b3512519b625fa2f56e7be0d6de028ca82461557a39803f295f3bd72629fe72b1b8ffd921f288353c5
TLSH
T1AEE0C6041A7B813CF070C9391BCEB96303AFE224380512F00AA08708E34AB016E528B4
MD5 SHA1 SHA512 TLSH

Submit Download