d4d2266a19876beccc95a97e1e5821ef42d98d503818c1e3f19be75e9358b100

Analysis

max time kernel
194s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MCPR.exe
Size 12.1MB
Sample260802-pm286asgre
SHA256 d4d2266a19876beccc95a97e1e5821ef42d98d503818c1e3f19be75e9358b100
MD5 dc6683da32e6d5a0ce1ce5f9978c13ba
SHA1 de5fb0d55106dca3b7733e8d26b3306678ba1996
SHA512 90aa10f1f292c69756876938b836c726a01dd17326e2c2df442b2cef9a69a2fe01edac356039f0abfcca0701672e23101ddbbe7a04a8a1b3142e1d493e3c1353
SSDEEP 393216:dwNFyYt6Vy21bOAcRumYtt0v6ezSn2oIA:dIEYt7ebc0X0v6em2Y
TLSH
T1F3D6331162A6FE98FC42CDF6D1E3792911E0B7CEB39E01579370923DDDB922067281E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1444	McClnUI.exe

Loads dropped DLL 1 IoCs

pid	Process
2632	MCPR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	1444	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCPR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	McClnUI.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	McClnUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	McClnUI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	McClnUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1444	2632	MCPR.exe	89

C:\Users\Admin\AppData\Local\Temp\MCPR.exe
"C:\Users\Admin\AppData\Local\Temp\MCPR.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\McClnUI.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\McClnUI.exe" -p 83D598B28704805D599AE0512AB8066E31DCE48D6BD9691F304FD895B191EECBCD86900CFF18E603CFFE8D7C27F362E53B70ACFDA1D37F101A7CFB3856D2D8825AAEE68DAF7C988D46EDC54D2D26ECC333F6BA0D7D22873D45ECEFA2BB9FC87DC244F5B791222430B708DF22895F8AC3145986F07477A545A0E80A5556B372E7DEB7CD959C715F65034C68D657F62A9206582AB1244FA8AAA6917BEAD2E85F18D66F3A66FF4282EFA57AD3A594E18060C0A2025D9EA8B1D9877CE83C7BEC08C05486C99308FF967895F3324D082669D00BBDFE004B9D4243580A0C7103664DF768D10E6BCC479553D3159E4DD51BC81418368B3C790155552AE8817015FE2DEF9C77ABFF09AC18A9CD0F01D7871B9CA962971272A09C43B35B5C003436EACB40CCCE9B5837EC92DECBFC11A6E3D239F1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 2200
    3⤵
    - Program crash
    PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1444 -ip 1444
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

McSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi4827.tmp\McSplash.dll
Size 65KB
SHA256 c587ed7d64618c927245554a25dab549d32237cc44fdf4963f094dd12c673a3c
MD5 7e4b9d459ee28e2afd2b83188a0215f6
SHA1 e5426dd32a593b8bdac8d9582365a0454042ce09
SHA512 63e7776dc897a4f22e5db3751aa94ded57181963646d991d562a6e6adc28a1812da7c139447a70051d0cdbe90938f01845926278716028d737a3b8cc0a78ef56
SSDEEP 768:Y2YI6IJ7maxwpNaMPKEHMrivQS0OvYs1H0BMtorXC2L3IbQ:Y7rtvayKMS1FYKBMt2hQ
TLSH
T1B3636D11B59084B3D85A46795096CF17AABE76901FE480C33FFA468E6F623D16B3A306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Files_Win2K_SHRED_6_0.txt

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\MSHR\Files_Win2K_SHRED_6_0.txt
Size 1KB
SHA256 d5f6492b5567fcef6fac1b8d8cba46066e8838a3aa6c29d0b8bae7feca211f4a
MD5 aa147195dcea096f904b18e5b257b39f
SHA1 1668499b626948398f2d8aa5a3bfbd1a24e56ccc
SHA512 aeaabd70059947b6140595999c7c255eead6636a3005836ce69c91359fb2eac45380f0fd98d9a40d9b593389fde373a14504443cf658fa329c7a5030fade1f29
TLSH
T1313150AB0387262265DAB87C1B4F6C1BD78EF782758D4460B25C33DE4734D6250FB298
MD5 SHA1 SHA512 TLSH

Submit Download

Files_Win98_SHRED_6_0.txt

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\MSHR\Files_Win98_SHRED_6_0.txt
Size 963B
SHA256 ef0a1e2c0ada3619446b55c9dafa0065064c9d2355e2f2a1659893d3cbdab484
MD5 aa95f256307a832e72c1d43a5d03d1d6
SHA1 940b3340f2dcd80c8d940873a6ac18714c19e19f
SHA512 c9eaf4d8bdc9c49b19f87e3193dffedd2ef644b9818ecccb75808b19168d45c3f645050fc11c48d18e2c7d0fe7875ee0a56940bc376759518f912ae1f5e9fc80
TLSH
T15D1166E7138B2B1288C4B8BE17BB6C13D5DE7780B8965930A26E73DD4324CB6546B168
MD5 SHA1 SHA512 TLSH

Submit Download

McClnUI.exe

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\McClnUI.exe
Size 4.6MB
SHA256 47811761644a676f906245b66d51a489f9602f4e359d54c7f0c700ac480d38d1
MD5 f3a4b890dbbbb0e56beeb1904ec4e3c5
SHA1 6b04879145f14b72ddd820ad8d6eee7f1904d1ec
SHA512 342cb8fdb7004f6f326f39e66b06b306cea6662b190da79594e38be9f8ade0fe0f884d345a04750770407de6324a168fcd066ea0aa37c1340b4c7830aeeac58a
SSDEEP 49152:oKSvHEL2WfsH9ezCu84hdft2I6Y9o5iQSll/jNZIw4XsYmdvWHfCEgSIU0VC3DH9:bSvyEH4pft2I65kZIw4XszdvW/Ck
TLSH
T13226B37271A08863D1A24AF16FE8A510D0BA7534175B82CFB6866E2817F37C1357CEDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfeclftk.inf

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\VS\VSCore\latest\32\mfeclftk.inf
Size 811B
SHA256 9a4e4f8f8ec4d940ef2f5f338741e416e04ead8abbc9b2426acfe44309a720d9
MD5 8c98a2243236630ec9c88371f4b85d4f
SHA1 c5ed2ff2b693d851bcd9f8fc5e32bd6a868f56c4
SHA512 7d7040468d6fa4f98b162b0984cd1ef45ac7fe20f117b2f01fad5bc71d9ba2df86e3346c3a592f6df0bfd22e2e00ea56cd4f5aa934392822f485011340da32ac
TLSH
T1A601A6EB22164B693472396A0A0304837F44E0B459EB101CB8D9C64FEA28D2C03B99FE
MD5 SHA1 SHA512 TLSH

Submit Download

daConfig.cab

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\daConfig.cab
Size 16KB
SHA256 ef059f19aa1e6ce93f6535476319c490adeaa9c0a751943d6ac25ffd51eda198
MD5 d6d0ada834f58b8157b63a4e55c48a5f
SHA1 161faf402dbf74006a5c4591dcceb592ba9f9fd1
SHA512 1c1aaae7e9cda1342a25d815c9d0c1c70a2359e65fe72a4f0f33da83e606f6904953345711af19d701385ddecf549bc5f03e87df81a21d67e9949ca7bd3696e6
SSDEEP 384:OOBGz+1V9hR8xwk/VvTMQv/u2WuFRWe+6veceUnAM+o/8E9VF0NyWiL6:w6P4xwktvi2T4e+CecegAMxkEhL6
TLSH
T165728EF79B195C03EE8A8C9D71C49427ADB8B7CB5DC9C4C7A256C1144B883C2BFE1269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataConfig.cab

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\dataConfig.cab
Size 170KB
SHA256 1a9bba0bcde129f16e72ada219afdb2b2cf89730dab80d40a17e72d51bd9b97b
MD5 c607068212f594d455ec24b1228d64cf
SHA1 74a490e9af24e3a258e89f280e66517253995bd2
SHA512 5af5aa43dab45e488fa32ee455b83dbd0d5ca6f81a991ac479249616c3c5a258343dfd62c02ca3eff06355af30a3e29f7cdf7bafa50b8324d7d7ad963dedcd61
SSDEEP 3072:kjQ+YOc03jERYDVPBtCJTgNjlJu0MCnpXQHuUKKO8ZJ6Lov3RDgMYh:2QOc0TZPqgNjlI0MCnpX4mKD7l2h
TLSH
T15B042345A624EE03DD43CEBB95D8B53A4E7E63CB18D9F4BDD21896D44BC86C29780238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mccleanup.exe

Path C:\Users\Admin\AppData\Local\Temp\nsy4838.tmp\mccleanup.exe
Size 760KB
SHA256 aa1fa7987d0693a42c5711b6596fd46deed113302961be713e7cf857b42f508d
MD5 c96cd37794f6f593d6e8eb961894aaee
SHA1 41a8f5121b6c797c1dd92ffe0a6e0c0fe1d27f14
SHA512 62c7d5a8b2bae8b1c55e665b66b725f5f57bdc08e424ae292ac96a396be963381541de78bc61b9a029affbeb389e41545d0c26b2f5159589a224ef4573304c4f
SSDEEP 12288:EjPFYuiQgNJl4S8K6dHjtPdkjZOFC4r7sjb6+F0sWEjx4jsjYKVGuZ4i54Q4J9:EjPDiQZS8lDtKjZOFC8syA0sWUxo6YaK
TLSH
T183F4BE32B9C08033D0B242318A599B3267BDFC316B7608DBA3D9872D5E645E16F36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1444-1091-0x0000000006EF0000-0x0000000006F10000-memory.dmp

Download

memory/1444-1089-0x0000000006E70000-0x0000000006E90000-memory.dmp

Download

memory/1444-1100-0x00000000081E0000-0x0000000008200000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads