1a111d3ef9b3c4432c0436b76e5e8939c6dbddbee7bdf630a25f06cc0b50f972

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FSCapture113/FSCapture.exe
Size 7.4MB
Sample260823-fpf92ashjf
SHA256 1a111d3ef9b3c4432c0436b76e5e8939c6dbddbee7bdf630a25f06cc0b50f972
MD5 51dbe5e71d61d3f0a270f151e1104230
SHA1 a223f405533eb54a356bff2a37aca406f49515f6
SHA512 f1f94a5743dc7b00d26418200697b7002d6e423a724c23a398589712ad02e91a2883b16ab4061ff8a12b1c8f30d01b89cacc20bb0ed85984b72aad2ca294c531
SSDEEP 196608:lzAkcpD6NIWShgFf7MCireh3IQKKgzCpm3JdmrUtKjmmqM:lzA1D6TFfUQNgOmKUtAmmqM
TLSH
T170767C56B252843BD0274B38DD1B83E95929BB242F34968B7AE42C5C7FB934179383C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FSCapture.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe
Token: 33	372	FSCapture.exe
Token: SeIncBasePriorityPrivilege	372	FSCapture.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
372	FSCapture.exe
372	FSCapture.exe
372	FSCapture.exe

C:\Users\Admin\AppData\Local\Temp\FSCapture113\FSCapture.exe
"C:\Users\Admin\AppData\Local\Temp\FSCapture113\FSCapture.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-0-0x000000000109E000-0x000000000109F000-memory.dmp

Download

memory/372-1-0x0000000000B70000-0x00000000012DB000-memory.dmp

Download

memory/372-2-0x0000000007A70000-0x0000000007A8E000-memory.dmp

Download

memory/372-4-0x0000000000B70000-0x00000000012DB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads