72f1e6bec6d5c8041f11c09b42e3f4f43f5647df79e2e6525dd2cc45c2e11541

Analysis

user interaction
yes
max time kernel
301s
max time network
306s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Airaware.exe
Size 163.1MB
Sample260820-admpsawepc
SHA256 72f1e6bec6d5c8041f11c09b42e3f4f43f5647df79e2e6525dd2cc45c2e11541
MD5 35aff927cf146a01f73fb4fc0b220285
SHA1 555b4d9f6cd856ada5760df62213cb5857b2b7c9
SHA512 647a4088794a1c2abc6e9dc78c30d097205cf4061b45cbb2f189fe87430f3dbd5c3e5b07193479a8da247227b2dc7d45f7c49f3692ce2af6f87f14142cfc4769
SSDEEP 786432:QdIVEIwfZ3ry6jROX892vY1FUV5OtsFntaRu/bSs5c4ZQp5m8cq80dpMr7yZi:oIVrw5ry6jRG8MvYUFJTSs24qp5VJS2E
TLSH
T1F7888D1163E81A45E27B8678D77382A1E6B1BC535711C1CF0094FA4A2F77BC2BA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper2"	Airaware.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\WallpaperStyle = "2"	Airaware.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\TileWallpaper = "0"	Airaware.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	Airaware.exe

C:\Users\Admin\AppData\Local\Temp\Airaware.exe
"C:\Users\Admin\AppData\Local\Temp\Airaware.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads