50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Size 179KB
Sample260811-bany4ssdnd
SHA256 50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47
MD5 394097f1a4e28eb630e207dbf5d3c82e
SHA1 5810d65909f4f91265b11b7cd236e55811e485c9
SHA512 b8883e3d2d1d6a6e3790b385c9741768e15a7dd27a591455d9a890ada8c0274af00c50229f5a32180cd5fd1fea7fd18d63bff270003d365bd3b84fa53c3b053a
SSDEEP 3072:A85mqjMcfnM9keJ77f6j+pDtXLTK+UyY/9oiiXvsy:A85bManM9DQQDZLT/Uxs
TLSH
T1F3047C5170D485B2F6B22A351CF2A7611A3DFC794774C2CF63D82AAB5D213C2463A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\NotificationData	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3340	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3340	50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe

C:\Users\Admin\AppData\Local\Temp\50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe
"C:\Users\Admin\AppData\Local\Temp\50646874e3d257efcdf4def279163e9890f5a45c735a185dc8624ac0f913ae47.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads