fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Size 320KB
Sample260830-1demaaak2s
SHA256 fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb
MD5 b2b26e7eb1c94744db8c8a0734c1f2d7
SHA1 4828f8c5326bd50cbc403875432570a5ca89d3ee
SHA512 67add74ed3008caa6549bc801187f03f661a736629122ca9613cd4d38b28ade7cf5c6247f059a0702883b972923a0e5c1832732c3e94ffd8eaac57aec8cbb88e
SSDEEP 6144:/dh9b44jnkByH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:FhyOnk62EB0NxDIBuOFe7/uT
TLSH
T16564E0360713B032CB621C754EB263BA5EDD1E3E1C38E307DAA05F5A359C596EA90396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\HideRevoke.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\ReceiveSplit.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{190C4DCE-2E95-D3CE-292F-ED444A611051}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "trrrjtzhhwkxnzck"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "sjvskshnkvverjlj"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "zlktcwckercsnhrh"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{190C4DCE-2E95-D3CE-292F-ED444A611051}\ = "njzrnnsntjlhwrjb"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "rbtbrkblbqettshk"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "hjstlejtvhjxzvsr"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "nwxkkqtwncjnvthv"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "sljkccjlqenctzsk"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "wbsezqxrsjlhtkhb"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "hjttbzknvhclbqtl"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "nthevlstwjskrtkn"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "hkezznxsnkjbrvbj"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "skezthcwcthevjsh"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "trsbbhsrwqnevnhs"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "kqssnhjerlnjhcrc"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{190C4DCE-2E95-D3CE-292F-ED444A611051}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{190C4DCE-2E95-D3CE-292F-ED444A611051}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "tsrqhjhwcxennhkt"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe

C:\Users\Admin\AppData\Local\Temp\fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe
"C:\Users\Admin\AppData\Local\Temp\fcf9decdacfe88a72385c0c18d1f5ffbee828647cadd0bce7d0ee952890af2eb.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3956-0-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3956-1-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-6-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-2-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-8-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-7-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-9-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-10-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-11-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-12-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-13-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-14-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-15-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-16-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-17-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-18-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-19-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-20-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-21-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-22-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-23-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-24-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-25-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-26-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-27-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-28-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-29-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-30-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-31-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-32-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-33-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-34-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-35-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-36-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-37-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-38-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-39-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-40-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-41-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-42-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-43-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-44-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-45-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-46-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-47-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-48-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-49-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-50-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-51-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-52-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-53-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-54-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-55-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-56-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-57-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-58-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-59-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-60-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-61-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-62-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-63-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-64-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-65-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-66-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-67-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-68-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/3956-529-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads