ace170c7d3a63597a83dd897dc79652846c68c552762e657c122da124f61a34d

Resubmissions

21/08/2026, 02:06

260821-cjmcba1bjf6

21/08/2026, 02:01

260821-cfmtns1amh6

Analysis

max time kernel
152s
max time network
167s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LarpGram.exe
Size 199.8MB
Sample260821-cjmcba1bjf
SHA256 ace170c7d3a63597a83dd897dc79652846c68c552762e657c122da124f61a34d
MD5 79db1698a3f4f31c75e8991d8584dd29
SHA1 64af5a39b60d812d226db467ecc9d14db798ce0b
SHA512 327d7b2476548d45a8fb5f7d408e6902087be588712b312d2972671184afcafdf225a6ce7874f0be6fda4b4fec8c7752e71817c02ea755abecdcc34a044c1c18
SSDEEP 786432:YRAKFD+SfPG69IPClnJ3LAVbCVxnl3VocPL6fySptiwt7U92Klg4E:YRAKFqS3GAIPCBJ3Oq3VDL27hKg4
TLSH
T14CA85B95B11801EAE0B4E1388914D523E7F9351453A38ED7307FAA311D67AEDFE7A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	LarpGram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	LarpGram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	LarpGram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	LarpGram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	LarpGram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	LarpGram.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe,1\""	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe\" -- \"%1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\shell	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe,1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite\shell	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\shell\open	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg\shell\open	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\DefaultIcon	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe\" -- \"%1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg\shell	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe\" -- \"%1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\DefaultIcon	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite\shell\open	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\ = "URL:TonSite Link"	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\shell\open\command	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe\" -- \"%1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\shell\open\command	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg\DefaultIcon	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\ = "URL:Telegram Link"	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe,1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\shell\open	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite\shell\open\command	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\URL Protocol	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tdesktop.tonsite\DefaultIcon	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LarpGram.exe,1\""	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tonsite\shell	LarpGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AyuGram.tg\shell\open\command	LarpGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\tg\URL Protocol	LarpGram.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4472	LarpGram.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4472	LarpGram.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4472	LarpGram.exe
4472	LarpGram.exe
4472	LarpGram.exe
4472	LarpGram.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4472	LarpGram.exe
4472	LarpGram.exe
4472	LarpGram.exe
4472	LarpGram.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4472	LarpGram.exe
4472	LarpGram.exe

C:\Users\Admin\AppData\Local\Temp\LarpGram.exe
"C:\Users\Admin\AppData\Local\Temp\LarpGram.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayu_settings.json

Path C:\Users\Admin\AppData\Local\Temp\tdata\ayu_settings.json
Size 3KB
SHA256 6ab7a7a6cd96d34b9eb6183f0b5aabd292abd0be2b5e7ecfcc629a8be12fbf7a
MD5 7c3743a0e1557c333ea0f2555d49267b
SHA1 03db119539fdda79f13078d94a10c015258a9361
SHA512 2b1c1e26df21bf94aedeeacc3d2c28c86cc650063fabc1a10e255f132e3620eb999b7eeb942af74d8db07659a59f2eff4d75e7b0a33fba3f3a3b1baa623edaaf
TLSH
T120817A31D8244C7F2DB8A17A98746443CA62D74F22406E2FF1FC668E1F7726E3941AB5
MD5 SHA1 SHA512 TLSH

Submit Download