Analysis
- user interaction
yes - max time kernel
38s - max time network
42s - platform
windows10-2004_x64 - resource
win10v2004-20260513-uk - resource tags
arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows - submitted
09/08/2026, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
Ghost.zip
Resource
win10v2004-20260513-uk
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Ghost.zip
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Ghost/bin/temp/resource_53.bin
Resource
win10v2004-20260513-uk
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
Ghost/bin/temp/resource_53.bin
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target Ghost/bin/temp/resource_53.bin
- Size 578KB
- Sample260809-stbxbs1anb
- SHA256 72fd906603d88838c343ead5d3bcf0e143eeb08a628659e263fbf647f43e30de
- MD5 4e87d50d712d2c036959de7083faf006
- SHA1 b64fb9d990b9d782663a66c0fa4c53754efc62ed
- SHA512 99111e296a412f944d46bf70b14528dd78c73da4720233b0e28c79a058a9a476bdaa5463a16c8f90b3bc53131ca47b3c107d85aa410244cac7d94eccb9b6b6db
- SSDEEP 12288:oj40Fvs1bERqIB5SoWxzpflHRhiHCTa2TlVfKGl/Vj63SeXIe:T0Fvs1bERqIB8zxluCThxVf7d63Sex
- TLSH T10DC433A4A4D92FD509C52972C736342B7DC9F617E25D222323AB7F34D92A270B2FB405
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2668 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE - Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 1f11039554e3dc01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{EB1395C0-097B-464F-9017-2B1E342DF6C3}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{98D4D9E5-9406-11F1-B996-D6A49CC5B7CA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.bin OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.bin\ = "bin_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\bin_auto_file\shell\open\CommandId = "IE.File" OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1300 OpenWith.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4772 iexplore.exe 4772 iexplore.exe - Suspicious use of SetWindowsHookEx 33 IoCs
pid Process 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 1300 OpenWith.exe 4772 iexplore.exe 4772 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1300 wrote to memory of 4772 1300 OpenWith.exe 95 PID 4772 wrote to memory of 1620 4772 iexplore.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Ghost\bin\temp\resource_53.bin1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2668
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Ghost\bin\temp\resource_53.bin2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4772 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Ghost\bin\temp\resource_53.bin3⤵PID:1352
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4772 CREDAT:82948 /prefetch:23⤵PID:4912
-
-