251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
Size 3.9MB
Sample260805-bhnnbabd69
SHA256 251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882
MD5 16a751d8798c18060b2078572a7dd086
SHA1 0d7c940ba293b7b9a98aa41d5783c058ed320e37
SHA512 d0240ac74c823142ec1bfef4e856131afb0e90c02aac4dbfa9d9286ddcda24dbb0310b7715fe50249a6d0064e1cbd69c9ef5d2aaca5f1f90e5a8ecf2d1512b8b
SSDEEP 98304:JFG0GNHeVwRz8aGnkYc6ynef5zHRG6PgTraRDEvsIZVP:/LSHeVwRz8aGnkYJyeWrMEvlZ9
TLSH
T1F7168E87A2B801E8D0B7C1B885164913E6B27C6507719BDB02E4E5676F33AF21E3E735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\BrowserGUID	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\BrowserGUID\MachineGUID = "11111111-1111-1111-1111-111111111111"	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\BrowserGUID	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\BrowserGUID\MachineGUID = "11111111-1111-1111-1111-111111111111"	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5960	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
5960	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5960	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
5960	251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe

C:\Users\Admin\AppData\Local\Temp\251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe
"C:\Users\Admin\AppData\Local\Temp\251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5960

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads