3ac2ceabaf5fff67cecaa02d597ed1fb419fc890f33ac6c53a6c8339b1e35952

Analysis

max time kernel
30s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tailscale-setup-1.98.10.exe
Size 1.3MB
Sample260803-m6ssqaxtbx
SHA256 3ac2ceabaf5fff67cecaa02d597ed1fb419fc890f33ac6c53a6c8339b1e35952
MD5 550fab9682d356706aab5c27a4b42222
SHA1 53cbb461e3b5c90c48f341a36c091180abcbf20f
SHA512 42c138df5415be33248698b2a2efdd0a77d10e2e39860c1ccf95d09674fa365fdf71354420ce5fd0a4c5919333dde9f398625a4079cdfb5b54a198c0094ce37e
SSDEEP 24576:neoj/BTdRjCHLLfAEVGREH1uyWcf4EOAOv5trt:tfRELrbGuEyN4EOA0
TLSH
T14D555B3165A55027E7F50533F910E730FE29F60C1B5889AAD6C0AC5C39789E96FFB20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
6100	wixstdba.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tailscale-setup-1.98.10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 6100	5576	tailscale-setup-1.98.10.exe	89

C:\Users\Admin\AppData\Local\Temp\tailscale-setup-1.98.10.exe
"C:\Users\Admin\AppData\Local\Temp\tailscale-setup-1.98.10.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Windows\TEMP\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3D0A959C-6EB7-4D9F-A01A-1548528B6A97} {151D334E-8599-4662-9A0F-E9BF29F1AFBC}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\BootstrapperApplicationData.xml
Size 6KB
SHA256 218fdf610af9e411995f2b80cc30e2eef3f93af329c83d188976393a2027d3ac
MD5 d2d8a59e3fe40b33fe90371cc90ec3d3
SHA1 efbd845fdb77d55c659aa5f34b10fff29ce9d795
SHA512 07eea5a6d351dd11675895140461abb52f38f6ca100bafd4c04690e6ffbc4f449229e29aea30a7d042e11dbb8c4327160218b823a4029dcf282ccd071d885232
SSDEEP 192:PvVWqOU8pZ6Fvj4jpZWv6lZTp7jFsqj/sgjfsRsRsLU:k08FcsRs4
TLSH
T100D1C4412BFD1215F0F35E88FEFA65125A7ABD526E38CD2D01511D0E4972E81C8B2FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\TEMP\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\logo.png
Size 3KB
SHA256 db6bba454a48ddfe440727a8fdfe0fd777bc95d0e8f597ff56f6f886bce76ca0
MD5 0005bdf4d4008128def29442c0de88c0
SHA1 94c5486fdf093c069bbdf65291f1ef8db8bc80d7
SHA512 be739646e95b385c3b99eeeb7f84ad2e56b46056e9b816f33a5da3e9711fc3cfaa4ce023331010df0f696ae5209bff62a3923fbc9d8b21259dc446c7285e9849
TLSH
T117816CBC0613A14FEB3607759B03979390217A1BB4019839E4C9EC7F369EC6C45802B5
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\thm.wxl
Size 5KB
SHA256 3a4fbb839544c4b4e80827fcb3aa91648bb73a1e84359f207264ec4bd468ee4f
MD5 f65abbbe0c427fb3bf79b893f02e5ad9
SHA1 f050535eb2f52e609afcd790d7dd884aee55e938
SHA512 d28cd76a0045a44f99f20d49d78a499f78fd1c055992c07c7837650c6a0b4457a682e7d91e57b7e1175a1e1f706f7007176911f1130de6482541b207e2b21982
SSDEEP 96:HL/vK0c0vMcivL5MQP1+XS/cEOYJA0SCwZQipCeyAC:rHEbdYuwYK0r
TLSH
T1CFC1D36B58CFEFE02A736654B5F3988A3518C1D6432B2CF1F86A454B876710163B3753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\thm.xml
Size 9KB
SHA256 90466c5e24effb000bc7c38a5a8d8b5c65442d8d16afac5a9938480846e50477
MD5 2b1ec08eef7ecfbe7bc2b4250a59f144
SHA1 1b6f9630d77ec0b4e911b55064f90857dd446dfe
SHA512 2f263b4a0c0d3f88ee14db8ee9896774fee43b651053e0620bfead1de579fda6021ab38cceb7f2d7b9073691c8568f1834a484f578fa414d1826cedf62ad750a
SSDEEP 96:8Lap45zHMLlh4HsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeTFpws4xM:hg4OB7UpyQP
TLSH
T14D12DBB546DDBC01C233E75267E325C2BF226972C1C46949B84E26BB0FF211079BB26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{64D45EF7-5CD2-4D16-8CA6-0CCA78200ADD}\.ba\wixstdba.exe
Size 426KB
SHA256 b09a838f5b1807af96937bbb46491bf8e129ede9d838bd3945f3d82ff85c791a
MD5 773ccb94ec7db9f315a6adec1f2a55ff
SHA1 8b643533a4b289262e090448caab2ab8e4a5c8f9
SHA512 97a13cddacae354345ad6a8eea9ed3bd71c8bb919a0eff7478b2be288213ab598eff48aff2726b25783ef42d68ca71f4b2240475c0b91938a2759eabc5646a3b
SSDEEP 6144:8y0PCf6d1hUucQJRj41loBIAsowmQ6BIxLf9xlJfoKr3HKUtrCiX:321DcCRj41l7o3Qtf9x/Jr9trD
TLSH
T1AE942C3164F44023DBF64572FD15FA31AF2AF208271095AB93C0DD293968ADA6BF7247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads