61d5a6f9d55b6490144fc30442dd524d5499b5b548f98c0f6aa0ae7382da9ad0

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tailscale-setup-1.102.3.exe
Size 1.3MB
Sample260825-y1frravxev
SHA256 61d5a6f9d55b6490144fc30442dd524d5499b5b548f98c0f6aa0ae7382da9ad0
MD5 d1ebb6c738efae866bfa02001fe72c3d
SHA1 280a35c494d595458a78d70104b839668b7c90e7
SHA512 e557cd0a59bdc0873bc7a48c95926dc8f9dce9cc7f07352d7eb3f250fc398343ab3c58dac6114ae92047e44e313fc9554f82a760737b32d4a0bd48dc60661687
SSDEEP 24576:Beoj/BTdRjCHLLfAEVGREJtuKWcf4EOAOv5trk:7fRELrbGuCKN4EOA5
TLSH
T109555B3165A55027E7F50533F910E730FE29F60C1B5889AAD6C0AC5C39789E96FFB20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
3452	wixstdba.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tailscale-setup-1.102.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3452	4260	tailscale-setup-1.102.3.exe	89

C:\Users\Admin\AppData\Local\Temp\tailscale-setup-1.102.3.exe
"C:\Users\Admin\AppData\Local\Temp\tailscale-setup-1.102.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\TEMP\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{42B311BE-60CB-4BAE-A768-0CE4E342C54F} {65F3AD4C-5194-4012-B01E-62D3AFF367C1}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\BootstrapperApplicationData.xml
Size 6KB
SHA256 c15df55b2bbc5ce5cbbca9d6a461e1b41b56d14f7855c882bcb1d1a3717fa184
MD5 4c470053ee3b01e2431c5feac256e301
SHA1 79b32716de9b7743e99619a72511c98e8b755839
SHA512 8a571f6ee7f8bb5b19998c3d50d6ade733213ba9e8167c7dd6f21d805fed412e7863c4774d0722a526dfb4c0a315fd1cae1f1e5865100651a2a81e824bec855c
SSDEEP 192:AvGWThZ6Fvn4dvhZWvFldh7jgsCjNs4jEspsRsLU:g0uCosRs4
TLSH
T1DED1D5552BFD1219F0F35E88FEFA65125A7ABC522D38CD2D01111D0E4972E81C8B2FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\TEMP\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\logo.png
Size 3KB
SHA256 db6bba454a48ddfe440727a8fdfe0fd777bc95d0e8f597ff56f6f886bce76ca0
MD5 0005bdf4d4008128def29442c0de88c0
SHA1 94c5486fdf093c069bbdf65291f1ef8db8bc80d7
SHA512 be739646e95b385c3b99eeeb7f84ad2e56b46056e9b816f33a5da3e9711fc3cfaa4ce023331010df0f696ae5209bff62a3923fbc9d8b21259dc446c7285e9849
TLSH
T117816CBC0613A14FEB3607759B03979390217A1BB4019839E4C9EC7F369EC6C45802B5
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\thm.wxl
Size 5KB
SHA256 3a4fbb839544c4b4e80827fcb3aa91648bb73a1e84359f207264ec4bd468ee4f
MD5 f65abbbe0c427fb3bf79b893f02e5ad9
SHA1 f050535eb2f52e609afcd790d7dd884aee55e938
SHA512 d28cd76a0045a44f99f20d49d78a499f78fd1c055992c07c7837650c6a0b4457a682e7d91e57b7e1175a1e1f706f7007176911f1130de6482541b207e2b21982
SSDEEP 96:HL/vK0c0vMcivL5MQP1+XS/cEOYJA0SCwZQipCeyAC:rHEbdYuwYK0r
TLSH
T1CFC1D36B58CFEFE02A736654B5F3988A3518C1D6432B2CF1F86A454B876710163B3753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\thm.xml
Size 9KB
SHA256 90466c5e24effb000bc7c38a5a8d8b5c65442d8d16afac5a9938480846e50477
MD5 2b1ec08eef7ecfbe7bc2b4250a59f144
SHA1 1b6f9630d77ec0b4e911b55064f90857dd446dfe
SHA512 2f263b4a0c0d3f88ee14db8ee9896774fee43b651053e0620bfead1de579fda6021ab38cceb7f2d7b9073691c8568f1834a484f578fa414d1826cedf62ad750a
SSDEEP 96:8Lap45zHMLlh4HsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeTFpws4xM:hg4OB7UpyQP
TLSH
T14D12DBB546DDBC01C233E75267E325C2BF226972C1C46949B84E26BB0FF211079BB26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{6CAD51E5-CFC6-4BAA-8D6F-8B4E1C2FEC64}\.ba\wixstdba.exe
Size 426KB
SHA256 b09a838f5b1807af96937bbb46491bf8e129ede9d838bd3945f3d82ff85c791a
MD5 773ccb94ec7db9f315a6adec1f2a55ff
SHA1 8b643533a4b289262e090448caab2ab8e4a5c8f9
SHA512 97a13cddacae354345ad6a8eea9ed3bd71c8bb919a0eff7478b2be288213ab598eff48aff2726b25783ef42d68ca71f4b2240475c0b91938a2759eabc5646a3b
SSDEEP 6144:8y0PCf6d1hUucQJRj41loBIAsowmQ6BIxLf9xlJfoKr3HKUtrCiX:321DcCRj41l7o3Qtf9x/Jr9trD
TLSH
T1AE942C3164F44023DBF64572FD15FA31AF2AF208271095AB93C0DD293968ADA6BF7247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads