Overview

overview

6

Static

static

1

windowsdes...64.exe

windows10-2004-x64

6

windowsdes...64.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    windowsdesktop-runtime-10.0.10-win-x64.exe
  • Size 57.3MB
  • Sample260803-vb39zacd49
  • SHA256 e82fc901c8f52d716293b2bc0830ce0dd254a06268c457a19e8fc503560a84d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1F5A7AB8-D3D8-4F9A-B0AF-2922D815B11B} {C9B9D3D7-1204-4CCB-A1F9-B180F23D9F8D}
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:6056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BootstrapperApplicationData.xml
        • Path C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\BootstrapperApplicationData.xml
        • Size 9KB
        • SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetLogo_256x.png
        • Path C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\DotNetLogo_256x.png
        • Size 2KB
        • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dotnet.ico
        • Path C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\dotnet.ico
        • Size 44KB
        • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\thm.wxl
        • Size 7KB
        • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\TEMP\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\thm.xml
        • Size 11KB
        • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.exe
        • Path C:\Windows\Temp\{E9056DA2-42F6-43A0-975A-14D4321434D9}\.ba\wixstdba.exe
        • Size 431KB
        • SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download