53ddc5d37bc112fcfdf7a0b02b8e961b02df21bc105ca8d4e9d32b4ed20b7805

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$1/MFP/x86/sediag.exe
Size 1.7MB
Sample260802-pm286asgre
SHA256 53ddc5d37bc112fcfdf7a0b02b8e961b02df21bc105ca8d4e9d32b4ed20b7805
MD5 070f4cb4c1a8a77840043133d971b519
SHA1 a429cf9ae2fb0b9c2fe58ef4e76ee75f7c92ec59
SHA512 ec00d283f9aae04d414e4f8d8bc951fc818637b17e406f5de0714e6b67cccd366d1c8b995ddf8f7716fe77d1cdf4e048f883130014b82ca881bf49fb841dfa0d
SSDEEP 49152:/d3sVUtB6ylWs+Hl1nNId7PDu8NyP2gD5eLZOU9IURO2quGhYywpolr3:FsVUtVld+Hl/INPDu8NyP2gD5eL8tkOB
TLSH
T1FE859E323690907BC63B3234951DA3F8E6BEB9304D76520B66A11E3D2E705929E3C75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sediag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	sediag.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4524	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5752	sediag.exe
5752	sediag.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 4524	5752	sediag.exe	89

C:\Users\Admin\AppData\Local\Temp\$1\MFP\x86\sediag.exe
"C:\Users\Admin\AppData\Local\Temp\$1\MFP\x86\sediag.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\sediag.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sediag.txt

Path C:\Users\Admin\AppData\Local\Temp\sediag.txt
Size 407B
SHA256 0f79c7047cdf4d44c0149ea99019ec4074bdc28e8346121511bdd96d887191f4
MD5 5688c33d93601c6c52726d286a8a10ff
SHA1 b3c876b425ad0696c04b225c7c9bdfe438c9cf75
SHA512 813068f13e888595a659b4323a7013cda2d1db0555caa59de629a73f0c0384c100b8dc25271e22357a6e559cf8012b38eb98a38b4034bee699fc1c94a6585fb9
TLSH
T16DE065AB55C67EA4228348503C0ABCF1B6EC035CD1BD9195D67A4428E4D7944FD9CB93
MD5 SHA1 SHA512 TLSH

Submit Download