491875275520fe754878cfd1d13eed01315455318864a1bf3a328d2cce0a1f0c

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cleaner (1).exe
Size 1.2MB
Sample260807-ab7beacq41
SHA256 491875275520fe754878cfd1d13eed01315455318864a1bf3a328d2cce0a1f0c
MD5 f3b2f3ff24acda7ad2865c95b81f05f8
SHA1 af911d672f91e16793fcf8da161193e9210be1cb
SHA512 1feabf3bb286abe0672e2f7abdaab5049c943b4ce38cc733aa0d58f2fb7341912b374b8c4cd981980f12a0317d4f1b437f682b1edd1f82f15e7d8d510f361a19
SSDEEP 12288:PFUNDaztpi0L+FX6iZdsXeQdbldGs00LeLbvYAEBq8fEWmwBn5R8+HdJD9Rm05AD:PFOazNiZmOSfLiEByZwBn5HdJ205dVtU
TLSH
T13645AE43F3A245EED66786788166D30BF7B4781617209BCB33905A227F63AD16FB5301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
1956	cleaner (1).exe
2772	icsys.icn.exe
5632	explorer.exe
4936	spoolsv.exe
4308	svchost.exe
1688	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Cleaner (1).exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleaner (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
1284	Cleaner (1).exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe
2772	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1956	cleaner (1).exe
5632	explorer.exe
4308	svchost.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1284	Cleaner (1).exe
1284	Cleaner (1).exe
2772	icsys.icn.exe
2772	icsys.icn.exe
1956	cleaner (1).exe
5632	explorer.exe
5632	explorer.exe
4936	spoolsv.exe
4936	spoolsv.exe
4308	svchost.exe
4308	svchost.exe
1688	spoolsv.exe
1688	spoolsv.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1956	1284	Cleaner (1).exe	89
PID 1284 wrote to memory of 2772	1284	Cleaner (1).exe	90
PID 2772 wrote to memory of 5632	2772	icsys.icn.exe	92
PID 5632 wrote to memory of 4936	5632	explorer.exe	93
PID 4936 wrote to memory of 4308	4936	spoolsv.exe	94
PID 4308 wrote to memory of 1688	4308	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\Cleaner (1).exe
"C:\Users\Admin\AppData\Local\Temp\Cleaner (1).exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- \??\c:\users\admin\appdata\local\temp\cleaner (1).exe
  "c:\users\admin\appdata\local\temp\cleaner (1).exe "
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1956
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4936
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleaner (1).exe

Path C:\Users\Admin\AppData\Local\Temp\cleaner (1).exe
Size 1.0MB
SHA256 534e03e2017fbc7ff62679488aa16d3845309b9be294a69d6b1c338f94a9ee08
MD5 a0f2c5361501324f8bdf4df81b690f35
SHA1 b3add0bcc19bc786802e59ea6a17c8c3443d6026
SHA512 f5d7d5f07bd49231c552bcb209624b5ffff8315e366f7f10ac5a12ac7c00e105ec6d310c3663d65041e82ddf420e420833b79f23e30f09aae9f65ffa023f6d18
SSDEEP 12288:itpi0L+FX6iZdsXeQdbldGs00LeLbvYAEBq8fEWmwBn5R8+HdJD9Rm05ACVg8:iNiZmOSfLiEByZwBn5HdJ205dVt
TLSH
T1DD35BF83F3A646EDD66B85388266D30BE7B47816172097CB37905E26BF539E09F79300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 b8560c06b3896f30aacaceb93c526a82a1b1fb8783c5e7fceeaaf4c458ab4a61
MD5 4ad1a6b0f3710d5d94fa2c6fefcd6bc8
SHA1 dcb4d1ccf02e0ca26e8656f7183d41a6e5fe4a26
SHA512 c3815360ae33877dd764febfa2211eb212d7801b19abdd563c7f7a6459a111d76f46086797234d52de738afa7e49a05342bc02ff527c1730c2beee8555a46ee3
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXq:UVqoCl/YgjxEufVU0TbTyDDalRq
TLSH
T1BDD30A236F40586FD810CAF028B5DB7ABA515E311BE4AF4763A6BB0179B1543B6F420F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 fedcd35c728e6257a0c549d100ad3ff5fb3e94d244c953d63103b27bb7bda2e1
MD5 eac060b92a5376955f6c311c221eaf9d
SHA1 1de9057828ea8a910d64ec5cff6333e1dc7b0d8e
SHA512 b97374d0f4f7de3d2eea61914062bfd5a18152d341b3a58bae27bd1c4e7920dbd12657e0d7bf96e3baf9306dfd6c491b6ada55e4c6d5e94cfefe58a011337b5a
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXS:UVqoCl/YgjxEufVU0TbTyDDalRS
TLSH
T100D31C277E10602AE5128AF134A9ED6EB9525E360FF1EE077251BB40297628373F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 d42fb21f543ea8667ef846085428e22f67f4432ed5d1f175b545e3dea13b2183
MD5 e0505a3b4262e4fc5e2550e16a9d4489
SHA1 5ae1a6ce9b02351211e6cd5820d164bfaf3d2422
SHA512 62b02779b6a76c01f5bc95d29a4611fb05d241b284ae37e3e3c13f54f1cc7bff72e2183d1d1b453ce1484e27e62bbaa9aaf14404df8eb600dc2939ef04dd9735
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalRuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0:UsLqdufVUNDaiAAAAAAAAAAAAAAAAAAY
TLSH
T138D317273E00903FD452C9F168B9FA6979A51F390BD25E0BB2A5BB01A57219772F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 f38ea4528daba2777f6410a0a60f778b0e3667b2a2bff7178e1253cebf5fc72b
MD5 b2a8815f67cb8c8c7f9f5a11bb93585d
SHA1 1498aea603de98e44716ef9cbe22d101b936064a
SHA512 e5133b457b35af541c25751c483036025fb3f1afda91caaa0ccf9c23024961d54c7ce502823bdc3ee0111be2c068e4df2021a15359f676ebd0bd5df796fff5a5
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXj:UVqoCl/YgjxEufVU0TbTyDDalRj
TLSH
T1E1D309236E50102BE9258AF028A5D65EB5665F361BE09D473367FF802632783B6F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1284-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1688-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2772-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4308-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4936-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5632-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download