Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe
- Size 992KB
- Sample260803-tp48raer4w
- SHA256 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4
- MD5 064eebc9d3d75a92ae68fa0dceaea3a7
- SHA1 87c25acb0d0f899588e7255d1be04298c66bfa81
- SHA512 e8ca284a660abb09c4f6cc8f744010f341072b209180f31794d9973e18b3f2ba66f5e60d7648fffc34e2300834422f3307fdfaa2c3e008fb58fd9d2c61a1d1b5
- SSDEEP 24576:rJBRyf3m1dCvOEeXdDvLZeP0q/tJNxo0ii+sT+VLbeWWwJS3+O+h+SAS8dOKbl/j:rJBRyf3mXW+vLZeP0q/tJNxoMT8cLcpK
- TLSH T12425A18BDB30E185D8030435FC6F595C27366CF11721986BAE40BE5A4FF6783BD6922A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3212 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe 3212 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabDlg.SSTab\CurVer\ = "TabDlg.SSTab.1" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Control 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\InprocServer32\ThreadingModel = "Apartment" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{BDC217C8-ED16-11CD-956C-0000C04E4C0A}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.1" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Version\ = "1.1" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\MiscStatus\1 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\ToolboxBitmap32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ = "DSSTabCtlEvents" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC217C8-ED16-11CD-956C-0000C04E4C0A} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TABCTL32.OCX, 1" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabDlg.SSTab.1\CLSID\ = "{BDC217C5-ED16-11CD-956C-0000C04E4C0A}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{BDC217C8-ED16-11CD-956C-0000C04E4C0A}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TABCTL32.OCX" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\ProgID 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TABCTL32.OCX" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC217C8-ED16-11CD-956C-0000C04E4C0A}\1.1\HELPDIR\ 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ = "DSSTabCtlEvents" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Required Categories 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{BDC217C8-ED16-11CD-956C-0000C04E4C0A}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\TypeLib\ = "{BDC217C8-ED16-11CD-956C-0000C04E4C0A}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC217C8-ED16-11CD-956C-0000C04E4C0A}\1.1\ = "Microsoft Tabbed Dialog Control 6.0" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObject" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{BDC217C8-ED16-11CD-956C-0000C04E4C0A}" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\TypeLib\Version = "1.1" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ProxyStubClsid32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786}\InprocServer32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TabDlg.SSTab.1\CLSID 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786}\ = "SSTabCtl General Property Page Object" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ProxyStubClsid32 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\TypeLib 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A} 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabDlg.SSTab\ = "Microsoft Tabbed Dialog Control, version 6.0" 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Version 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC217C8-ED16-11CD-956C-0000C04E4C0A}\1.1\0 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3212 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe 3212 6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe"C:\Users\Admin\AppData\Local\Temp\6faa62d81a1992dc18f21aebca9227371139169d445f4506a23cad58e5bb49a4.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TABCTL32.OCX
- Size 218KB
- SHA256 72fe896050a94be0baa7cbd6d6d942a54534145c1013ba320b1e4f925ee4237a
- MD5 5c04d46354c7f2854b1e545e787bca75
- SHA1 21eed96e55ab78ec52f08025e5b6aacd86e2dbab
- SHA512 29ee87fa7e8a8f8e00e5ecd62f1c9fb6eb8e79bf5b3097f6a8f87534867e65de8d6abca9dc0008980e374a1f9f1199e6d0ee6cd387e92842f8b1b67ed109f87c
- SSDEEP 6144:9QLCiNdwZReDv/ofRm6jHCPrFBDLR44WKr:9qdasDofR5HCP5k4WKr
- TLSH T11A247C03B3E18176E4B3273009767BA1AEB9BE621E39C50F6B542A5D1C31B85DE34327
- MD5 SHA1 SHA512 SSDEEP TLSH