Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe
- Size 1.1MB
- Sample260818-dn5vwsvemb
- SHA256 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035
- MD5 f61740234f0b85be40939209f3f30bf2
- SHA1 fa8f074f04e537365ad3abcf32bc1bc984aee9bf
- SHA512 4096d4963984f35ee8d4943606ff1f6b73a6cb0352901f3c4f0a82fbf024dd5ca6d29280821f268e4ac16ff99ccbef583afbe1917ef644aff812a7c06311cd7b
- SSDEEP 12288:WnM3iZ0sKosWkVTvEadeRJHmczrdNz8mOLtYSOORlRe45iDGwjEh5zbl/Sx0B9+d:ResWQzEwmetIORlI45i6wjozpf01
- TLSH T192357D1172E800ECE1B7D1B8CF766913DB77784607309ADB0790A69A2F279D05E7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\shell\open 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.mmd\OpenWithProgids 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\shell\open\command 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe\" \"%1\"" 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.md\OpenWithProgids 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.md 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.markdown\OpenWithProgids 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.mmd 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\DefaultIcon 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\shell 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.md\OpenWithProgids\Tinta.MarkdownFile = "0" 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.markdown 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.markdown\OpenWithProgids\Tinta.MarkdownFile = "0" 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.mmd\OpenWithProgids\Tinta.MarkdownFile = "0" 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\ = "Tinta Document" 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Tinta.MarkdownFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe,0" 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1936 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe 1936 65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe"C:\Users\Admin\AppData\Local\Temp\65766b590adf4383b9418d67180324ecbe9ca8b996480f8dfa17853f46c92035.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1228