26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Size 275KB
Sample260824-qf4dbayblh
SHA256 26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9
MD5 a1a83ce4dc1838ef177368d564be7f4c
SHA1 47d940c7af3b2b85c1cedb4f8822d74a0ed9fa95
SHA512 4e4315f4004cdb79234b588c84049104872df7038ecb0dbf40dec7e73f1e1763fa32bfa5c1595a5d49f4ae160c603d9881f2113d37dfbbd87507c81a4907d0a2
SSDEEP 6144:ElAnzSfiV/wguJpVopIM/eiG3cE9bAxsfW7q8:ykSfjjJ7oaz33O6eP
TLSH
T1E35401CE6088C9B4F9F780366481DC2BBAE15F3DA185441F3AF6FB64F496220C61D8D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Contacts a large (624) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\RedoHide.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{604DA3B4-2875-8ACC-E8C4-E493D2731E78}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "bctvthqrwerlejlw"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "rkjbnrbjktnwrthb"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "heklkllqjhjzwhnl"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "erjvvncnelnlhssk"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "wrwcbkcnncwtvhle"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{604DA3B4-2875-8ACC-E8C4-E493D2731E78}\ = "xncbqkvrnhbnnjhh"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "tzvwjjtrbwqqtljh"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "nhnkjbrxlzcstqsx"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{604DA3B4-2875-8ACC-E8C4-E493D2731E78}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "cjjnwhhjjbjenltb"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "nezeewqtkswjtlhh"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "whscjrsezxtlzwbt"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "kbrjllrksclkcnkw"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "hhenlhjtsnkrlvtk"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "ceexelkqjreerwwh"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "ltberssbrhrqetjt"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "sjbhcentzknllejv"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe

C:\Users\Admin\AppData\Local\Temp\26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe
"C:\Users\Admin\AppData\Local\Temp\26b9a160e94140ef353e8bb6572b192416145284f269fd743e20069637ae0ad9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1672-1-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-6-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-2-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-7-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-8-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-9-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-10-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-11-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-12-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-13-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-14-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-15-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-16-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-17-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-18-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-19-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-20-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-21-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-22-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-23-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-24-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-25-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-26-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-27-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-28-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-29-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-30-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-31-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-32-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-33-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-34-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-35-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-36-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-37-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-38-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-39-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-40-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-41-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-42-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-43-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-44-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-45-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-46-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-47-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-48-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-49-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-50-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-51-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-52-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-53-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-54-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-55-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-56-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-57-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-58-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-59-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-60-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-61-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-62-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-63-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-64-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-65-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-66-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-67-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-68-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1672-347-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads