Overview

overview

7

Static

static

3

6f35122ccc...f9.exe

windows10-2004-x64

7

6f35122ccc...f9.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9.exe
  • Size 639KB
  • Sample260820-k155ratblg
  • SHA256 6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9.exe
    "C:\Users\Admin\AppData\Local\Temp\6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Users\Admin\AppData\Local\Temp\6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9​.exe
      "C:\Users\Admin\AppData\Local\Temp\6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9​.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ie_to_edge_stub.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
        • Size 578KB
        • SHA256 f063881924582acf0f2d27dad9cd6714e1eb2015e2f444ef256040ac134053b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 7.1MB
        • SHA256 0b6b93cd7b334577edf81cf5806198b7795e525caf1d578966247ee9c53d9824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
        • Size 3.5MB
        • SHA256 5794234f4ac2cf9cdd20b4d2de59a5e3c95145a569258e8ba0ef4b861586210e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pwahelper.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
        • Size 1.4MB
        • SHA256 8ea6bab46464bda93f0308a1a5783c7e1604d3be98b2503ea841065f9f6fa8e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        • Size 4.6MB
        • SHA256 78e9c54eb71b5ab13ca5859ce8cde39132ad003e99aa92acd6593c3bab00ecfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0e596dc4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\0e596dc4.tmp
        • Size 2.8MB
        • SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9​.exe
        • Path C:\Users\Admin\AppData\Local\Temp\6f35122ccca4af0eef8ecdf300865d0797ff00bd5883f14aa63545e6ba0472f9​.exe
        • Size 583KB
        • SHA256 b69a2feb8b34a6759b11cd0cb5e55644c2b5e1d100f87ecfff528ddd57c7d514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download