c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b.exe
Size 6.1MB
Sample260729-ftz8pseb87
SHA256 c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b
MD5 ff7fe10f230b5a135cc877e5c2e8ad31
SHA1 4d1a694ee5fc981ac1dd08fcfd86a2d903277901
SHA512 4827b6cbd5419be5aae5180ae5aa849eaca1e3080e556718f28147953d6d15f75504350462c83ab22b1e753e3068cac6d7a285518ed45929afa18c466dd0ab85
SSDEEP 196608:LYhVGCOAhg4uVgyTG9VnizlpHnswkb+iZ+F6vPS/:4mAOTKyKVCHnLkrZ+Qs
TLSH
T1495633E03576C888DAF2AC34FDAC2F19AA3DF518065C917AC71D4A69D9E1D2F0B82135
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4160	priPrinterProSetup.exe
2772	install.exe

Loads dropped DLL 6 IoCs

pid	Process
4160	priPrinterProSetup.exe
4160	priPrinterProSetup.exe
4160	priPrinterProSetup.exe
4160	priPrinterProSetup.exe
4160	priPrinterProSetup.exe
4160	priPrinterProSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	priPrinterProSetup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 4160	424	c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b.exe	89
PID 4160 wrote to memory of 2772	4160	priPrinterProSetup.exe	90

C:\Users\Admin\AppData\Local\Temp\c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b.exe
"C:\Users\Admin\AppData\Local\Temp\c330878abf05ebe1ec5e845b4e71418848d0603bf2a8e4be5c640c0312d44d5b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:424
- C:\Users\Admin\AppData\Local\Temp\priPrinterProSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\priPrinterProSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\install.exe
    "install.exe" onInit
    3⤵
    - Executes dropped EXE
    PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.exe

Path C:\Users\Admin\AppData\Local\Temp\install.exe
Size 120KB
SHA256 b62ff7186cdd956fe1bcfa39f743ecabc7eb611631ed66c8d4dc5cf16a5a0562
MD5 6bc5a5192b5cdabbccb23149b1342a00
SHA1 6bfbd55dacc3cf45e1e8e5b2f13dc86e03a3c138
SHA512 ef66eaa57aca5c531507a3e6b6825d695bb7f9e8f7d066d45ab39c0ab3a3865480c0f4a30726355bce0debf167153d0675767513abb02552f54fa18ffe3e9802
SSDEEP 3072:7RR7UXZMDMrKJXdZRTYtxDlJwCkh7+SBdBx3WPWSoLFJGvj:7RR7UXZkMqXdDTYtNlJLsUWRFJGvj
TLSH
T1CDC36C4233A410F9E9A78778D9B24A02D7B278565375978F0370815A1F37BE1BE3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\InstallOptions.dll
Size 15KB
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
TLSH
T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\StartMenu.dll
Size 7KB
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\UserInfo.dll
Size 4KB
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
TLSH
T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\ioSpecial.ini
Size 1KB
SHA256 e0f70c9e91b3486e653bef866822f3b635d4e4d5fcaebd430a545ab44a1ef06a
MD5 c5745f72664b7931f536e5f62a57f000
SHA1 3f5e5adf421115cd4911c3cc2ca18013fc187769
SHA512 0a4bd08c3c4786c8e72f6b7413591161a89cd5dd57012795506c36024c66d56309eeef58ed8c1c0f200b39ada649c1119f35dfb822275cc1e156a0af9cbf5a21
TLSH
T1C0218903BBF81204F2FABB14FEB541759B3A7C56AC38D61D41D0094E08F5A408962BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsn4975.tmp\ioSpecial.ini
Size 1KB
SHA256 234f3bec453c27ad0e4a003c84f4b2529a3b336220a1ae63fb210496ed7520de
MD5 5b142f87a18a2f5f3afbe9245f6b042b
SHA1 929c2545220698f57483afbfcab518bd21d49e73
SHA512 74cec8b00afe5b8d76dbebeead75dd9aa4e74e54d03944e97f97ea8405e936a3c6940ea6d651ce4c215738cdc901e4f3285e85de8980445a869c38cc6343d646
TLSH
T13D31A007BBF80504F2FBBB54FEB441759B3A7C559C38D51D51C00A0E08F6A409963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

priPrinterProSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\priPrinterProSetup.exe
Size 6.0MB
SHA256 c2cdcd7deaf3f7fe8a0d9454be3847b09b297b7655541dca65034c3a959f313e
MD5 27fcdfe27e84358b97e50eba8e1b79f4
SHA1 e8be695ef295ced3993b097f99d67f9f7acbf18b
SHA512 d3ec0e7b5ec665917f2301416327d984d0293dccb50f8169b7ee9bdc60d8b4697774c85784ee08a2f5a50c740e42e1f358c5f34d4691924bf9016acc1bde7b60
SSDEEP 196608:q9JP4c6AXUa2R+ABm9hzPZF7HgYcv+0Pa/6vr0:qH4AkVMAMh77Hxc1Pae
TLSH
T1E85633A03632D849C6F29C34FCEC1F25AE7DE518069C957BC71C0A69E9E1D5F0B86236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads