Analysis
- user interaction
yes - max time kernel
149s - max time network
86s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/08/2026, 06:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aqua_cursor_1.0.1.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target aqua_cursor_1.0.1.exe
- Size 412KB
- Sample260801-hat9fszerf
- SHA256 f47e1ad19079bdfa9f764214bbd4af1d3c2bea0b20d024ed10f04e3ee795fa6e
- MD5 1ef4fb1761e324570e37c449b44c7edf
- SHA1 0be78ec1bd40d64cc81b750b957783451b511be9
- SHA512 48b510009b4d69b4b37e52293d9d970fb0e4aaa56752359b83250c1bfa2ce6117d07e383b1b82fd98b94cacd2683c9dbba2823411bb1e3dabe5c0b2fd7c94eed
- SSDEEP 12288:2Be2YVn1uZHBg0JDgSAoHOxwj7yOiDm+aPIaqIj:VhEZHu0JDfAoHOxwj7y/RaPj
- TLSH T1CD94282433FA4B0AF7FF9B79E87642914B36B953AA7AD39D0944209D08F1790DA41733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies Control Panel 22 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Hand = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Link.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Person = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Person.ani" aqua_cursor_1.0.1.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Schemes aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Help = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Help.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Crosshair = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Precision.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Precisionhair = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Precision.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\SizeNWSE = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Diagonal1.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Pin = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Pin.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\IBeam = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Text.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\NWPen = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Handwriting.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\SizeNESW = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Diagonal2.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\SizeAll = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Move.ani" aqua_cursor_1.0.1.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\CursorBaseSize = "32" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Schemes\aqua = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Normal.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Help.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Working.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Busy.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Precision.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Text.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Handwriting.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Unavailable.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Vertical.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Horizontal.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Diagonal1.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Diagonal2.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Move.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Alternate.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Link.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Pin.ani,C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Person.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\ = "aqua" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Arrow = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Normal.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\AppStarting = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Working.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\Wait = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Busy.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\No = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Unavailable.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\SizeNS = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Vertical.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\SizeWE = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Horizontal.ani" aqua_cursor_1.0.1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Cursors\UpArrow = "C:\\Users\\Admin\\AppData\\Local\\SimpleCursorPendantLoader\\CursorPacks\\aqua\\Cursors\\Alternate.ani" aqua_cursor_1.0.1.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1248 aqua_cursor_1.0.1.exe 1248 aqua_cursor_1.0.1.exe 1248 aqua_cursor_1.0.1.exe 1248 aqua_cursor_1.0.1.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1248 aqua_cursor_1.0.1.exe 1248 aqua_cursor_1.0.1.exe 1248 aqua_cursor_1.0.1.exe 1248 aqua_cursor_1.0.1.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\SimpleCursorPendantLoader\CursorPacks\aqua\Cursors\Alternate.ani
- Size 25KB
- SHA256 edf1b4d3f3b6483226c72ce83979c9cd7e304096082505830af541e5b34dd177
- MD5 8b53a43eef815df51f601cdc415ef2ca
- SHA1 6697be7aec423f441851987dc7e3548c50f937e8
- SHA512 c8a941b8430d7f3316dc7c2819f8fe442ebce8ae06788512f7bd92abb0222786c603f97fc1d72638f40ac9302d7d736a147c2aa050c46d100aa4480f8748a290
- SSDEEP 192:z9RPNIxM3FW6SX4TkLFONGiN4BHO0L0x0H6W67qrP5:zn1IxM3FW6SX4gLFOND4XL0xxq5
- TLSH T1DCC27E66B305D10ED55069B04E17E3E11381F88A6D358393BD672B2EEEBD0A3C92ED4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\SimpleMousePendantLoader\ExportedPackages\aqua_cursor_1.0.1_46db7cefa92cecdc\assets\000_CursorOnlyPicIcon.png
- Size 575B
- SHA256 ede245d4668a67e66fd43ca25e5abd661f6dedc3778200076772a8991c51a80a
- MD5 7cbfe3055ea6dcbacff51d4138b3b4f5
- SHA1 01d679e8936d8a2d917bab5e12496598543464c1
- SHA512 5b7ccc69b507f1e6cc12d36659356aef218a016dd8dbfe59604d3254353f47631777851f70fb5756c14e589924e1bac8a6cf018a610b5bfdf3b915b5591e93f9
- TLSH T14EF041C31C150D6C431C7D8499923212FE6F660C9056A0598D13A9537E8F4C4CB00756
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SimpleMousePendantLoader\ExportedPackages\aqua_cursor_1.0.1_46db7cefa92cecdc\cursor\EmbeddedCursorPack.zip
- Size 23KB
- SHA256 ba4a0b0fc409ea9676413f23d0cbfd8bd70f3bcbebc7fe767761c64604db8342
- MD5 33942ac01177075932fec71e3add7aa7
- SHA1 38e9f32b4133ec5c06ecdb9b84c5ccb0ba3d7026
- SHA512 f56125df51ec0331e40eca961de65132a29b514cc4f63ec1ba274cb10c037c22823f1681c835186c8b218113b2441d40635729a250da8e73fcbaea1d385c70c6
- SSDEEP 384:wIsGS0lETKOXHaq+56G5KvjZvTMG6hUi9s5jALR3FrPN9vrPN9grPN9lrPN9RqQh:KGZEb/+gHh6V9jLR1jN9vjN9gjN9ljNn
- TLSH T165B2AEFAE47223E6F97BD1783C095CFB4244635225759C01AE4CD3E0AADB0A4C69F8C9
- MD5 SHA1 SHA512 SSDEEP TLSH