0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6

Analysis

user interaction
yes
max time kernel
30s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
06/08/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Mes_Drivers_3.0.4.exe
Size 1.5MB
Sample260806-scsthstenh
SHA256 0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6
MD5 50a5e891da27e63d54e68511e48aa026
SHA1 87073d85a7ba420b15c8bb9a9e4adc64db2bcfef
SHA512 6df8811e3e1f6a4110ca3b7c498af13898b46962a30888879180b2f11dda24344a1de4807663d46dd86f7ea11855d08137980cc85fe71e688d082f2f79994909
SSDEEP 24576:AfHFw5b9DOnFYrv+kjqipUompMEoNMDYSkbDknoI6JK+ZYtEi8ETtAM5B:sjFYrv+kjV45oeYSRnyJhOtEVcf5B
TLSH
T1FA75BE13D9CA883EC09C85348CD3F21AD82EED5919BDFE17FD902E2EB5A594118BB1C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3064	detection.exe
1712	curl_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5128	cmd.exe
5032	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mes_Drivers_3.0.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	detection.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waitfor.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "110"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 5032	612	Mes_Drivers_3.0.4.exe	79
PID 612 wrote to memory of 3064	612	Mes_Drivers_3.0.4.exe	81
PID 5032 wrote to memory of 5128	5032	cmd.exe	83
PID 5128 wrote to memory of 5936	5128	cmd.exe	85
PID 5128 wrote to memory of 5240	5128	cmd.exe	86
PID 5128 wrote to memory of 1640	5128	cmd.exe	87
PID 5128 wrote to memory of 5876	5128	cmd.exe	88
PID 3064 wrote to memory of 1712	3064	detection.exe	89

C:\Users\Admin\AppData\Local\Temp\Mes_Drivers_3.0.4.exe
"C:\Users\Admin\AppData\Local\Temp\Mes_Drivers_3.0.4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C START "" "C:\Users\Admin\AppData\Local\Temp\interface.lnk"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\interface.cmd" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\SysWOW64\mode.com
      MODE CON: COLS=76 LINES=15
      4⤵
      System Location Discovery: System Language Discovery
      PID:5936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" VER "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5240
  - - C:\Windows\SysWOW64\findstr.exe
      FINDSTR /I /R /C:"version 5\.[0-1]\."
      4⤵
      System Location Discovery: System Language Discovery
      PID:1640
  - - C:\Windows\SysWOW64\waitfor.exe
      WAITFOR unlock
      4⤵
      System Location Discovery: System Language Discovery
      PID:5876
- C:\Users\Admin\AppData\Local\Temp\detection.exe
  "C:\Users\Admin\AppData\Local\Temp\detection.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Users\Admin\AppData\Local\Temp\curl_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\curl_x64.exe" --connect-timeout 5 --max-time 20 --fail --silent --request GET "https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4"
    3⤵
    - Executes dropped EXE
    PID:1712

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

curl_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\curl_x64.exe
Size 840KB
SHA256 3df4725778c0351e8472a0f8e18caf4fa9b95c98e4f2d160a26c3749f9869568
MD5 e80c8cb9887a7c9426d4e843dddb8a44
SHA1 a04821e6d51f45b72a10bdbd3bb7e49de069ccd2
SHA512 41b4bd84336785d4da13b5653183bf2a405b918afad3acd934f253d23b1e00460173e36b2d65a61f77ef2b942dba735655fc5b4ec561c375896f5a010e053d33
SSDEEP 12288:VBhSKWefubWiuJBmMSa1ayJZlQyyEmRwYGd0Cj/cHBg3ui7KMTFhlMVs+b:VBhSBwy76MM1vBycddHj/cGTFS
TLSH
T1C8056B53E39411B6C2638175C6951793E3B1B06E1320A3CB76ACC2683F57BE876BE790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detection.exe

Path C:\Users\Admin\AppData\Local\Temp\detection.exe
Size 1.1MB
SHA256 7fbe59195f5f6f45c8b38b12488a169fdcb3a272004dbaf44c9d92a60a3690cb
MD5 02ba1c44b6392f013a7aa0b91314f45a
SHA1 724c1977101ecae88e4f104a8422b64bfec01a98
SHA512 56bed935b028257e6eb485c555002f3e07e86788452cca0e28786098cc9254a7462b777a7a46ae6594911a73d786a6d15dee248f05a4c33a1bc749be071bcc3d
SSDEEP 24576:4AmTUWOc8w79cO634s6zyG2fzjTrqVHqOx:4B/OBVloswV2LjHzOx
TLSH
T1AE453352B0C0F64CE22F213B172EF15EAA41AD0E5D4516666343F74C94B3F27ABA9B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

interface.cmd

Path C:\Users\Admin\AppData\Local\Temp\interface.cmd
Size 2KB
SHA256 11993a03f68a33500a3ce8fbeb3e3c2042a28299d04f39eed40147709e76ca79
MD5 e0eb53551aca2acff814ddd7aca212e2
SHA1 ee825c865d5abf244d6165ee838735f1ba05bfcb
SHA512 ddde3d274b2ea8da0d645f88bd6b340902dca83e599ba0c7249953a7c1f2dd512f764802134a6efa1f48ca6cae23b78881569228f908dd0746abe3c46e95a348
TLSH
T1B251DFCA49A7EC0D016233573D86B1222B93F75A5E4DE00EF58D4B1A233D9D949B87CE
MD5 SHA1 SHA512 TLSH

Submit Download

interface.lnk

Path C:\Users\Admin\AppData\Local\Temp\interface.lnk
Size 1KB
SHA256 50234f268b841d906874b740c98736f0e398b8ddc8ac7b87f83936f222603e24
MD5 150a964d5781029e1f2b00f70cc32a9f
SHA1 10947b573293d8f8b65ba0a098f2af3d51e4b0aa
SHA512 cc9b746e9a3ccbfa4dad28cb174b4d3ef710cbf3ba7b5e6c405c9d6a30ac12237f91d439bc1d7489d71e16549ccd9cdff3085a3ca97fc597f363566f81476d43
TLSH
T15341C162DBDE4B21E3EFA43955F743016BB8B8606E417E1E0080838A1DB2E919E54F1A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-0-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/612-33-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/612-37-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3064-15-0x0000000000400000-0x0000000000693000-memory.dmp

Download

memory/3064-18-0x0000000000400000-0x0000000000693000-memory.dmp

Download

memory/3064-32-0x0000000000400000-0x0000000000693000-memory.dmp

Download

memory/3064-35-0x0000000000400000-0x0000000000693000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads