491875275520fe754878cfd1d13eed01315455318864a1bf3a328d2cce0a1f0c

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cleaner (1).exe
Size 1.2MB
Sample260807-acn68atdng
SHA256 491875275520fe754878cfd1d13eed01315455318864a1bf3a328d2cce0a1f0c
MD5 f3b2f3ff24acda7ad2865c95b81f05f8
SHA1 af911d672f91e16793fcf8da161193e9210be1cb
SHA512 1feabf3bb286abe0672e2f7abdaab5049c943b4ce38cc733aa0d58f2fb7341912b374b8c4cd981980f12a0317d4f1b437f682b1edd1f82f15e7d8d510f361a19
SSDEEP 12288:PFUNDaztpi0L+FX6iZdsXeQdbldGs00LeLbvYAEBq8fEWmwBn5R8+HdJD9Rm05AD:PFOazNiZmOSfLiEByZwBn5HdJ205dVtU
TLSH
T13645AE43F3A245EED66786788166D30BF7B4781617209BCB33905A227F63AD16FB5301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
5104	cleaner (1).exe
5560	icsys.icn.exe
3480	explorer.exe
1352	spoolsv.exe
4408	svchost.exe
5220	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Cleaner (1).exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleaner (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
4108	Cleaner (1).exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5560	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5104	cleaner (1).exe
3480	explorer.exe
4408	svchost.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4108	Cleaner (1).exe
4108	Cleaner (1).exe
5560	icsys.icn.exe
5560	icsys.icn.exe
5104	cleaner (1).exe
3480	explorer.exe
3480	explorer.exe
1352	spoolsv.exe
1352	spoolsv.exe
4408	svchost.exe
4408	svchost.exe
5220	spoolsv.exe
5220	spoolsv.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5104	4108	Cleaner (1).exe	88
PID 4108 wrote to memory of 5560	4108	Cleaner (1).exe	90
PID 5560 wrote to memory of 3480	5560	icsys.icn.exe	91
PID 3480 wrote to memory of 1352	3480	explorer.exe	92
PID 1352 wrote to memory of 4408	1352	spoolsv.exe	93
PID 4408 wrote to memory of 5220	4408	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\Cleaner (1).exe
"C:\Users\Admin\AppData\Local\Temp\Cleaner (1).exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108
- \??\c:\users\admin\appdata\local\temp\cleaner (1).exe
  "c:\users\admin\appdata\local\temp\cleaner (1).exe "
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5104
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5560
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1352
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4408
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleaner (1).exe

Path C:\Users\Admin\AppData\Local\Temp\cleaner (1).exe
Size 1.0MB
SHA256 534e03e2017fbc7ff62679488aa16d3845309b9be294a69d6b1c338f94a9ee08
MD5 a0f2c5361501324f8bdf4df81b690f35
SHA1 b3add0bcc19bc786802e59ea6a17c8c3443d6026
SHA512 f5d7d5f07bd49231c552bcb209624b5ffff8315e366f7f10ac5a12ac7c00e105ec6d310c3663d65041e82ddf420e420833b79f23e30f09aae9f65ffa023f6d18
SSDEEP 12288:itpi0L+FX6iZdsXeQdbldGs00LeLbvYAEBq8fEWmwBn5R8+HdJD9Rm05ACVg8:iNiZmOSfLiEByZwBn5HdJ205dVt
TLSH
T1DD35BF83F3A646EDD66B85388266D30BE7B47816172097CB37905E26BF539E09F79300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 931a05387f497cbac0be8c7f3157b0f2ae337d4a810dcc4f135eb14df638012c
MD5 002351a5d1656f7267b3ff85189e465c
SHA1 f2dfa06d783ab3aac254a6f0255c012719057173
SHA512 a1a4746f82ccfbaf127e6592312bde98afd5277416ba3bcd8a2a99e444dad12e13788a3ed17893bf23fe04e4827d2bc0cd5498f1839cdef982dd3b637bc62dfb
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX5:UVqoCl/YgjxEufVU0TbTyDDalR5
TLSH
T1BFD30927BE10543ED522C9F278A5E76E7A619E3A1B90AC03735ABF05767120376F420F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 fedcd35c728e6257a0c549d100ad3ff5fb3e94d244c953d63103b27bb7bda2e1
MD5 eac060b92a5376955f6c311c221eaf9d
SHA1 1de9057828ea8a910d64ec5cff6333e1dc7b0d8e
SHA512 b97374d0f4f7de3d2eea61914062bfd5a18152d341b3a58bae27bd1c4e7920dbd12657e0d7bf96e3baf9306dfd6c491b6ada55e4c6d5e94cfefe58a011337b5a
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXS:UVqoCl/YgjxEufVU0TbTyDDalRS
TLSH
T100D31C277E10602AE5128AF134A9ED6EB9525E360FF1EE077251BB40297628373F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 dfadf60ac8f0f25d5a505287b593424244a459cc0ebfb11f9b2f2f1ba673c89f
MD5 f274e7fd17f16778fd12d5b595c7fefb
SHA1 f279414857f9c80849a28c2a9e9b0243c7f0c99b
SHA512 4350bd4000d37ff754f169bfbdf593b3b44f05f668926d0476170dd9b011804380c0e9078a939627ca23aae755bb3eca0900eca652cf56ae592cf5c673745fae
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXC:UVqoCl/YgjxEufVU0TbTyDDalRC
TLSH
T180D31A17AF10552EE921C6F02868AB7EFA241E361BA1AD073362BF5036B514376F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 5c61694b7a98982187e642a42c5f9f509766bb0ba8b246809b333064ea5f38e1
MD5 0ecaf5e8c819bde36448ab51203df752
SHA1 911f06ef80ed7e5d79e39037805e7d714340a6ee
SHA512 b33bd0e0514e17c7ecb366d20ea5061df33e9b6cdbfe818eb027d62f5b92455ea58a8e4bd1300c36f1f7c246a4c729ae2c604986b2569254bf9c2116451ebbde
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXs:UVqoCl/YgjxEufVU0TbTyDDalRs
TLSH
T164D309237D60943ED82286F16CA8AF6EF5211E3A0B94BD0772977B006A7919375F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3480-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4108-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4108-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4408-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5220-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5560-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download