539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Size 119KB
Sample260825-v8detaab93
SHA256 539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330
MD5 a0ec071db9a7579f7aed6c8ff28e6a5b
SHA1 47f5851607ad81b57675734175f65d3863554400
SHA512 7e8a1439d735409bfe53569be6790b283531a8441d25c64f63498494dbf5116d50efb8a529e4b8de69a96fcec01fe9d0f161c713a08f2ce2b88a60641448b2ab
SSDEEP 1536:eKKy1T8WjZqFs+Xtb+n5S4HvOE4nhuBBzpjVrs2ryrd1vUQuqSSqK5tnCvv:erjGss+d65VvP4YHs2qxnC
TLSH
T174C3E1EEF1549CD6E8EB293D7914B0AAF7642D5931E36440889C0AC8F4E5437326C5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\AssertGroup.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "rlwektwxebszthxv"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "tkbzcqlkbxjjznbk"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7177502-10AB-F59A-383C-731EB20DF073}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "lbslwthzsexwcrlk"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "whkjzbrctcbhjtlz"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "ehkztnxhrsrtkrjt"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "lrwlxthrqxtwxews"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "shnthlslwecrccch"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "jlqbkttjqjjlssbv"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "khkewecnvnhnzwlq"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7177502-10AB-F59A-383C-731EB20DF073}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7177502-10AB-F59A-383C-731EB20DF073}\ = "ehzkrtjqrlqhqjte"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7177502-10AB-F59A-383C-731EB20DF073}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "ljcevsnrxsbechwn"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "hekvrbekbvqjlzre"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "hwkstqkklnslcxkj"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe

C:\Users\Admin\AppData\Local\Temp\539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe
"C:\Users\Admin\AppData\Local\Temp\539d7626789b878feebb9ab0a71843e203abcccf5a40debee6d533358adfc330.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2288-1-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-2-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-6-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-7-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-8-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-9-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-10-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-11-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-12-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-13-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-14-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-15-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-16-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-17-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-18-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-19-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-20-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-21-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-22-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-23-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-24-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-25-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-26-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-27-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-28-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-29-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-32-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-33-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-34-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-35-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-36-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-37-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-38-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-39-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-40-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-41-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-42-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-43-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-44-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-45-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-46-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-47-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-48-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-49-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-50-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-51-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-52-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-53-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-54-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-55-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-56-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-57-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-58-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-59-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-60-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-61-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-62-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-63-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-64-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-65-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-66-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-67-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-68-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-69-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-70-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-530-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/2288-5045-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads