90d6c9046a654b22e8e6ece8b58bc76bc44bc37a4c7cc66b28f7ecad59859cb6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
点击设置中文语言.exe
Size 4.1MB
Sample260820-kl8mbsshle
SHA256 90d6c9046a654b22e8e6ece8b58bc76bc44bc37a4c7cc66b28f7ecad59859cb6
MD5 b9d754052c2d61f50112e3f4ca0851ac
SHA1 9edcefd7fd5261f60dce0fe67b9ecd2d8b149ec3
SHA512 d53f0226fedbcf33470e67405c0f2903f9ea8c92aecb414d4af46a7786478d2110ab85c1fa17004bfbe42dfbdc743eae8cd1936fb9874701511dc2f9e3c02371
SSDEEP 49152:fBabNiB+w61m4GphXJeFFAC4PgdZ/iGyS0J6ppFlXYbVrUKBOVLcGXnZIwHGwsIz:SZOhZ0Aa+0VI1GJ+SayMOixn+nEPLpIB
TLSH
T1E4168D02BAAB94FCD16AC874C34646735F2174CB0B22B9FF41D496393E6AAE01B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\waasmedic = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\waasmedic\\waasmedic.exe"	点击设置中文语言.exe

Executes dropped EXE 1 IoCs

pid	Process
2452	waasmedic.exe

C:\Users\Admin\AppData\Local\Temp\点击设置中文语言.exe
"C:\Users\Admin\AppData\Local\Temp\点击设置中文语言.exe"
1⤵
- Adds Run key to start application
PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\waasmedic\waasmedic.exe
C:\Users\Admin\AppData\Roaming\Microsoft\waasmedic\waasmedic.exe
1⤵
- Executes dropped EXE
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

waasmedic.log

Path C:\Users\Admin\AppData\Local\Temp\waasmedic.log
Size 56B
SHA256 3448ef3b1140b0fe5e1363a562dd6ade242031ec1c7d8b72bc828984962ea589
MD5 1d79723d9fcfc858fcd6132c00fee9b4
SHA1 44000fe52ed0712e43a5e23edc6cc3f43b303cf7
SHA512 df3ab817bcd70cc41818562e531471409535a343e8bd1c5f05ea44e840bc8f9fa062adcb049f54b5dd7275c2db27974c07528ad74a0a3fe9e4c643b4ecf7e04d
MD5 SHA1 SHA512

Submit Download

waasmedic.log

Path C:\Users\Admin\AppData\Local\Temp\waasmedic.log
Size 97B
SHA256 f7ce840bf248279194fa1caeb2044cd24d08b9a1f8270dac1cf86e8c2da6aef1
MD5 4a871aed3919fa4848e5b894ebe0678f
SHA1 a0f0fe1172ea57ad4e0a9496358e7437423eb02b
SHA512 d78e4c760f284775c8cb7fe09a7f8762dfcc1a67e43a94b1a59b15c38c84ca994cf354977547e02647358e5747ae2d599e91112bfee9956007d8ca0e7e868c89
TLSH
T156B001610EE814494672C0AF6EBE5025D743890B1CE4AE7CD4987A7931CC743946B6B1
MD5 SHA1 SHA512 TLSH

Submit Download

waasmedic.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\waasmedic\waasmedic.exe
Size 4.1MB
SHA256 90d6c9046a654b22e8e6ece8b58bc76bc44bc37a4c7cc66b28f7ecad59859cb6
MD5 b9d754052c2d61f50112e3f4ca0851ac
SHA1 9edcefd7fd5261f60dce0fe67b9ecd2d8b149ec3
SHA512 d53f0226fedbcf33470e67405c0f2903f9ea8c92aecb414d4af46a7786478d2110ab85c1fa17004bfbe42dfbdc743eae8cd1936fb9874701511dc2f9e3c02371
SSDEEP 49152:fBabNiB+w61m4GphXJeFFAC4PgdZ/iGyS0J6ppFlXYbVrUKBOVLcGXnZIwHGwsIz:SZOhZ0Aa+0VI1GJ+SayMOixn+nEPLpIB
TLSH
T1E4168D02BAAB94FCD16AC874C34646735F2174CB0B22B9FF41D496393E6AAE01B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads