ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Size 320KB
Sample260825-k64twazblc
SHA256 ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050
MD5 34c21a29ad167dbe4763580c14f705c1
SHA1 dc1a38c99a735caea3f239d4280201476ff8a1ce
SHA512 93a96dafed8e72e8701a8c88f5bc1d132dcd0b650fa465cc33ea42033e37bb83162b2ca27779d25c393db053167f30013ccbf4c6f3505b1bb4be7942b1b4d043
SSDEEP 3072:Lk8biKCkKhSbbwEa1TBZDmhUmcU1qBGaI+suh27clPu0uoMEwo9/vLAH:Q8bJtbbwEWG7uh2o4BEwo9/vLW
TLSH
T19964B540BA996883DD37967D05DA973E273CFBA0C3A38F07D9446B176D13AD02D9231A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe

C:\Users\Admin\AppData\Local\Temp\ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe
"C:\Users\Admin\AppData\Local\Temp\ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000000600000-0x000000000062C000-memory.dmp

Download