e229cebdf018b83658fa9977aa6b5cf7ee51e7a2a2c5dd9db1f61ff340f30723

Analysis

user interaction
yes
max time kernel
106s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Everyday Sexual Life with a Sloven Classmate.exe
Size 40.0MB
Sample260804-ge44saw1ct
SHA256 e229cebdf018b83658fa9977aa6b5cf7ee51e7a2a2c5dd9db1f61ff340f30723
MD5 5ef7acc5658fc75919f655e2df4df996
SHA1 5a889eabc6451677e9648abb57bdb924a889cffd
SHA512 b76d83661e40dd132025a3a3e1e8b5bb54fab6efcd94c5c628493da146ba561cc532c997114bb795b52a00ce2bbe25a5488ffda457f73495f67d215e9c558f9d
SSDEEP 786432:fJ0Ie8Hjz+F5vxneAcLJIliphMRSlOaelrGfTzKSsjcPW:hWeg5vpeAcLpyRS7QGfTzKK
TLSH
T17197330BB77C2717C07E19F105F10B2BACAA6E9DF8B4716B7910583AAC1B659CA74F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	Project_RH05_English.exe

Loads dropped DLL 1 IoCs

pid	Process
3012	Project_RH05_English.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Everyday Sexual Life with a Sloven Classmate.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everyday Sexual Life with a Sloven Classmate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Project_RH05_English.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	Project_RH05_English.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3012	2800	Everyday Sexual Life with a Sloven Classmate.exe	86

C:\Users\Admin\AppData\Local\Temp\Everyday Sexual Life with a Sloven Classmate.exe
"C:\Users\Admin\AppData\Local\Temp\Everyday Sexual Life with a Sloven Classmate.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Project_RH05_English.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Project_RH05_English.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DX9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D3DX9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project_RH05_English.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Project_RH05_English.exe
Size 4.0MB
SHA256 deed6510426124a12ffd008652e7116c0a13be9e10ab1e3b435cf4f4336c80ce
MD5 e9f67e526c3000c2d06a517c9ba45e7e
SHA1 e1ad50cbe0d772acd39f18fd3e8c7fc34e37f43f
SHA512 91f510c392a19fb83e8ba87cb95ad96408ad110e4a871bf23a17af7c5667abc7c7856714af5d99228ca525e51bd0dc8b3ee577dc91a3712771d7e3beb30340fe
SSDEEP 49152:XKYCrVAeuEz0kmg099krIuKF4WF4dRIMlUSMFTcrf:x5EykrmrF7MlhMOrf
TLSH
T178167E807A81D1B1E44262B898AAD7EB16397F108F24D6C3F7E13F2D5E709D45EB3189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\options.ini
Size 97B
SHA256 e267293f58d257d2dd1e00ad25425bdb798fcbf75256a7d45b7d7086159dbc58
MD5 396f73a1185a5642f5f1e2538b64396a
SHA1 d72d687a5a1258986f218bfccacc6118c39ec4f9
SHA512 e17cfca14ce79c71eea01973385fa4151989d40bfc5a04b97fd3534ff5b4f04b385d11867d80a60325aa0bd13403910fee73ab9379f0e05c669d24d5d95957da
TLSH
T1B8B012C50D228A495C7A70C4146592854DD0450814039B842DD9494ACF950D0111D065
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads