d55c16ccd53c56fa75d8bca3f5136b8344713d8011bf0ccb4cfcbb16277dfe77

Analysis

user interaction
yes
max time kernel
98s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SETUP_FILE_(PASS_KEY=2113).zip
Size 1.5MB
Sample260808-pbnavser6v
SHA256 d55c16ccd53c56fa75d8bca3f5136b8344713d8011bf0ccb4cfcbb16277dfe77
MD5 943771b70b5f132c8537048eb987edab
SHA1 67c289f6fd634fd31a0d73dd68a779ae7a7ab1b8
SHA512 57a294d30027e2ee78493e503c0aa0ff83a819886cc25aeac675538d053252741479ef76bcd76ce98873171dac94ef9f6e41d4bbe510bb55a4db1fe4e40e341c
SSDEEP 24576:3EoJGJWNqqYLz1V/K0s0fuj/b72ovM9jAZENJ1jyohXG29m578fhm3/X6byDHTzb:DJ6uzKD/K0s0fYjyoMyZENJoQX/Y8M3Z
TLSH
T1CB65334ED73C1BF80F6FF573BD86F0B96B339A06503891131F934665A423AE986B4852
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1496	setup.exe
2628	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4576	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4576	7zFM.exe
Token: 35	4576	7zFM.exe
Token: SeSecurityPrivilege	4576	7zFM.exe
Token: SeSecurityPrivilege	4576	7zFM.exe
Token: SeSecurityPrivilege	4576	7zFM.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4576	7zFM.exe
4576	7zFM.exe
4576	7zFM.exe
4576	7zFM.exe
4576	7zFM.exe
4576	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	LogonUI.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SETUP_FILE_(PASS_KEY=2113).zip
1⤵
PID:4048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5896

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SETUP_FILE_(PASS_KEY=2113).zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4576

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a36055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\Desktop\setup.exe
Size 4.0MB
SHA256 4bca65e75f6e6810e8f314ca65f1f68c2c5f02d108e1e89bc9989e69c80c8196
MD5 d88029b818a7523679dcd7484e1e305f
SHA1 54812796f34b419dca9d32f4a8363eaeefdb4993
SHA512 5ff147f991580a6d8b590924d2b07f190f0b30a524d9b4ebc40713d49fd85c54cb7e9b230487d2feab73609ecf62b609744bc33fd2fc641fa7c56eb98b8ab79a
SSDEEP 49152:r1HaM0YDHKSqWnIISczIZhC+s5wDArbQxOhcoqT:J6M0YDTzIZhC4xUqT
TLSH
T1C0162801FECA40F2E4031B3154E7A36F6739A9054F799B97EE543A69EE372A50C33246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download