4e0cdc90819279924c3391e5ed088a51e36243c8d2870793e65187f835eba09b

Analysis

max time kernel
300s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LicenseSupport.exe
Size 158.5MB
Sample260814-dkqa2aeh27
SHA256 4e0cdc90819279924c3391e5ed088a51e36243c8d2870793e65187f835eba09b
MD5 575679ebf50eab97a11f12dbadededdf
SHA1 92a26357b1af6bb4b1726fe3a34ca5cb79a55abe
SHA512 3cb4fa7d321528bb9c51cf292415a7c568dd58867fba7b1227055052ebfbca524cb6d862118573f5e8a402cfed23466fe219e609fa1752ba3f01ab1c64025237
SSDEEP 3145728:3xl+21pSn9tuVLViqp+nGkUTnBr5G4LwiLzBhFF7SFi+Ce8X0yawPGxFvDnmLy:D+8pSn9OLLpUUrBBckBhr2dCeq0ydOff
TLSH
T1A988337277E80DBDDAB682B5C5D5E030FF35A868332410A795EAD92D9F3225617BB300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
824	wixstdba.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 824	248	LicenseSupport.exe	89

C:\Users\Admin\AppData\Local\Temp\LicenseSupport.exe
"C:\Users\Admin\AppData\Local\Temp\LicenseSupport.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B20C7174-7D4F-4E59-9406-DDE8ED8F87D4} {45005654-BAF9-4A67-9B1D-4EB65287C94B}
  2⤵
  - Executes dropped EXE
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\BootstrapperApplicationData.xml
Size 6KB
SHA256 3e9da8513303318fc7a7499e9df6cf09a02af479a3e0f8060e51522887c97329
MD5 9e80388735715f30f84d8f4359c01891
SHA1 7d2b57016e9ccf27057960c0012360d06df3a3aa
SHA512 bbb1780f2c97a7971f0a5c52475ac726f1bb56c4ffe990735a4c79a9c50b08ed07aeedb3ec4454e85e18580961ba919ac2b55fed7b557ed5cb076515296a39a2
SSDEEP 96:ewcn6smh0w1ycHMOn63e8cVUUycNn67eYvtUQycZn6esM0waycCFGWKrSXW6reWu:acyXsMOslKAkGwu14Imvf
TLSH
T123D1D6653BFD0216F1F35E88EAF955121A7ABC527E38C91D01601E0E4A73E81D832FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\license.rtf
Size 11KB
SHA256 93b71e98b0ac813fbf2ebd34c03347f23173c874ba433c7c2f25f930fa34e34e
MD5 d5c10b719c6ba511a35b6b51e57cad99
SHA1 2428fafc5af05901328653228232a3278b16c9da
SHA512 4cabae01070db55d47f37c22e134ecbdbd195de5fb8880b93c0876344b9e4c18037ab13e55875316692319cc1e22520a8779f66b89a56d488d8f3fc14b1cf5fd
SSDEEP 192:3z7RO3qv5k6r59WQkLgdAbFa31YoovPOoxITUVuEVdJGS9r:js3IhV3lAFk12vlyMJGS9r
TLSH
T1353282BE761013B307C113153B2799CBB71AC378B62E9F952029C19C2761C79C2FBAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\logo.png
Size 1KB
SHA256 4f1c6ff4a00190802558d79b591c3b12db5051be89501baa6353fa16dd1386c1
MD5 41b40efb7642dbe391b4ea8fa1343c45
SHA1 2f3df1b136a2af9b9696c4d94e9e10cb1f09c167
SHA512 8014d7197952c517fc7ed5545db195989f451767f8cd009d3e9e31b8d9eb1da9a99deb98938f3cc5415bc8165a1a7ab362fe5eff53b3bc494e852fda5c1dc407
TLSH
T1FF31C9DEC8A7724584E7C1EB5DAB61481FA2A0342807B9019120DCE011E34F07FD4DF9
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\thm.wxl
Size 5KB
SHA256 c59d91c5e1b5026c3b5a2da110f824f3896606b8bd984fa8b583604c49004f91
MD5 213b9713da99527bd70788b506a03940
SHA1 3404d3df21fbbfe1e5a0d7853b2884146ac8fc8a
SHA512 ac837357dbb35f587403350c17f17e97002235ed5d341840f44c09039b328b0efaa7d6b48c8a42e247511447f16fb4f26462ddc65b463b9bd2c71d1e36ce8d5b
SSDEEP 96:HL/vMcivL5M1+XS/cEOYJA0SCwZQipCeyAC:QbFuwYK0r
TLSH
T122B1D36B6CCFEEE02A736A14B5F398893518C1D6432B2CF1F86A454B876710163B3753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\thm.xml
Size 9KB
SHA256 e922d2c823be9a81b72a3d026bd5435f6da406b3349332e000f1f9c312443acd
MD5 dad2ee28db0cc6a1c66b88c1d460c58b
SHA1 f002f983158c3251e17f28d3008113b8d43a9ada
SHA512 5226892906ce8ae04c4cc2a18c2e3acf5af3952b1d1e1a5b966486c031f997db167c36e7c3e83b2844cf3c5aaaa0a0991a43293b873a014d9488f0559da940fa
SSDEEP 96:8Lao4vPzHMLlh4HsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeXss4xM:hZr4OB7Upyq
TLSH
T1C612DC7546DDBC01C233E75267E325C2BF226972C1C46949B84E26BB5FF2110B8BB26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{FB2008B1-4B39-40BA-B426-3E9E87AE672B}\.ba\wixstdba.exe
Size 489KB
SHA256 e05dda0c23421cfc7a2a39b91074928605e1e69ad5f0a2a4e230ed5996fe2ff9
MD5 8c03e8907ba4ab272dd305a3bca52bc7
SHA1 bdf3b9ad081792cce2a6ea8ac4b23d54c8add31f
SHA512 36a96a722df0d9a3e8ea8b9e4d98b4fee3c869883c2530863c6ef5b8255c73488e9607280f0491d9969fea8bf09381310a5684a2ac475ba569834549f5e119af
SSDEEP 6144:5jdeA6Rk9w8aCu8CwlLSHosx7BxoUzLKo2XSgt5Yxsuy:5ZfwkOpCu8N+jEUnOXSgLBZ
TLSH
T1F5B45BBA22F422E9C5F94276D581A122FF70B54C370091AF8614C93D6F3B9A939BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads