ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

Analysis

user interaction
yes
max time kernel
898s
max time network
858s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChilledWindows.exe
Size 4.4MB
Sample260815-eckk9ael9v
SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
MD5 6a4853cd0584dc90067e15afb43c4962
SHA1 ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA512 feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996
SSDEEP 98304:XyDt6K4MJVnjOobt/JN1LA5elHc+S4fRp5UvluKo:XyDtK8bbxn+IHcBEV/F
TLSH
T17E2633D0BB96B957DA25233404C097507B3EEE50A346F2DB52946FABBCB54C3AF024C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	SearchHost.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "1"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3047"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "3047"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2986"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3095"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "3095"	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "2986"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "3047"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\NumberOfSubdomains = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\CLIENT.CBS	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "2986"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "3095"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{451E0B09-C32D-44CE-8F21-D91FC011E969}	ChilledWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\CLIENT.CBS	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\TOTAL	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\TOTAL	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\ = "0"	SearchHost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1220	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1220	ChilledWindows.exe
Token: SeShutdownPrivilege	1220	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1220	ChilledWindows.exe
Token: SeShutdownPrivilege	1220	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1220	ChilledWindows.exe
Token: 33	4060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4060	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	ChilledWindows.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	MiniSearchHost.exe
3320	SearchHost.exe

C:\Users\Admin\AppData\Local\Temp\ChilledWindows.exe
"C:\Users\Admin\AppData\Local\Temp\ChilledWindows.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1220

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4156

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2520

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1680

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3320

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4200

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 704KB
SHA256 ac94dca3b88e69d0f2854bdc62354046f46b2ce5fe6693b312c56b737c47f0b9
MD5 bc7684cfc060ca9efd8ff16594f25b81
SHA1 057df93acbbe23945c668bbc0c3c6f0a22917f55
SHA512 ea0f112c4478f9a68f098ed8689cfcb138ebf97a460665e7f80652c066456dc2f2607a777b951d40c8dbf70adf21508f7c739f9c37bb79027a4111f53fef1dc1
SSDEEP 768:i7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz9MjxngbCjPsgTVXRi7c9zyHy:g98eoVYoIYpktMhKSo/oGX
TLSH
T145E40C3BA470A098DF3C36B2E1BC6F4DBD72641612E006411F60B67F76237D8DA4A9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileCoAuth-2026-8-15.349.1680.1.odl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-8-15.349.1680.1.odl
Size 706B
SHA256 4a1d137aea13753c45df60377c551950870ef3c5d798eeee370a4d98351e2721
MD5 867f414962c93b4f27bb2c6e85947db8
SHA1 9278df60676c2296ee10318617d135e8ea9dffe9
SHA512 ce1d3df4dc526c2dbc49d15592573a0dbe8d743d1e21325693175325e1d52cc54df163b81b247ab5b80c143098f6207cef88583f430fc453f719db6b2b900434
TLSH
T1EC01276AFD9719B6DE31413CC40FF3291C4ABA623D9D2826C6C90B99594F7E1221AE31
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\E1Z9YJJA\microsoftwindows.client[1].xml
Size 96B
SHA256 b015706749327ffdfff64515cd33e307af99463a842a366dd5c3ed2999d6a9de
MD5 6508611f62d6be4e050151f7eda750a8
SHA1 39588766e38fe25cffeffb03ef7873e992480c13
SHA512 c74a36b6e14dd3fb302995f0ab6f8ba80c9ec1ce9ce2b7e2e98bf1f0c0c59816b340131867d9ec4de902f0e24e335bbd788508d8b97676ee2b42a19eb2e6d8c3
TLSH
T199B012113A484C1D0B4489F62D0950E431FD00D2B306BD7438E4FC01B5C6D06D822CF1
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\E1Z9YJJA\microsoftwindows.client[1].xml
Size 4KB
SHA256 0eb67fcdf76ff3ad14900ef487510b1dac48d8317098b6d16197cad2aa94bad8
MD5 de9121bc63551250fd6b97f0e136c118
SHA1 5eec8fd80f1a3a5afcdec87d98505b9b3826fd1c
SHA512 b1fad612e939c454b2f222a1381c17a48f896bce377aa2943b6d5b549efa52f07db5856ca10589df00b50dea6b2f25d1d43d74ea8aa07477ec0bd9bc8aed84a3
SSDEEP 96:GE6O2u52+kiKbSHY7Zvb6O4u52/uauSvmsPVtshOGCC5rmgwHY+Zvb6OEu52kbOF:SbacvBIG1oBve1cv03
TLSH
T12B91AD5DE3F2493A803D3212EB51E78C72ABC7279BC317F174617A881B9664E8D538D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 05f5f41bd6027217f2603b0865e03c5490658a666ef4a1c9e6a3558c6ca818e9
MD5 3b558accd8756743697edd6149441cab
SHA1 291e9ab2440d9eba607d5784ec65b5f294575aa4
SHA512 b80d40144f5035675569ab39196a508c063c1f0bae64268e75c032c477f9d72b32539debc67b451300a51043ba0251e464e3c6aeac7088219d301db6585a193b
SSDEEP 384:oJWJLVca12krtuVm+DYglBOVjeQ8RJoS5gh0jU+jW+5P/m5m+GDa50R/ocx3a:k+LVcWrll8RJh5gKjU+jrwm+GDa50R/E
TLSH
T1269239743AF41355F3B29F749EF1A95AA43AB866AC00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chilledwindows.mp4

Path C:\Users\Admin\AppData\Local\Temp\chilledwindows.mp4
Size 3.6MB
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155
SSDEEP 98304:nJVnjOobt/JN1LA5elHc+S4fRp5UvluKY:jbbxn+IHcBEV/F
TLSH
T1BB0633E0BBEA7C1AD665377524C44340BA6EE2505387B7DFCAA4426BDCB04C3AE131D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-36-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-12-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-16-0x00000000248C0000-0x00000000248F8000-memory.dmp

Download

memory/1220-15-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-35-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-0-0x0000000000920000-0x0000000000D84000-memory.dmp

Download

memory/1220-37-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-38-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-14-0x0000000024410000-0x0000000024418000-memory.dmp

Download

memory/1220-17-0x0000000024890000-0x000000002489E000-memory.dmp

Download

memory/1220-1-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/1220-2-0x000000001D5D0000-0x000000001D5E0000-memory.dmp

Download

memory/3320-121-0x000001FFD3E20000-0x000001FFD3E40000-memory.dmp

Download

memory/3320-103-0x000001FFD3E40000-0x000001FFD3E60000-memory.dmp

Download

memory/3320-122-0x000001FFD3C60000-0x000001FFD3C80000-memory.dmp

Download

memory/3320-85-0x000001FFD37C0000-0x000001FFD37E0000-memory.dmp

Download

memory/3320-71-0x000001FFD22B0000-0x000001FFD23B0000-memory.dmp

Download

memory/3320-68-0x000001FFD2670000-0x000001FFD2770000-memory.dmp

Download

memory/3320-66-0x000001FFD2670000-0x000001FFD2770000-memory.dmp

Download

memory/3320-72-0x000001FFD22B0000-0x000001FFD23B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads