1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Size 492KB
Sample260903-sdb76azblb
SHA256 1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa
MD5 88bfdfac31f181ce4a59c5d6063a68f5
SHA1 cf36b916a5989cd1635deb6ecda57085d3a5919f
SHA512 7ad6617ec7f85a3275b98be54ed3097b9f591535d5efc4b8d5d0b327323f1b828b1d8241aa24a545e7806b650f004946cf484656e1fcd7331f56749505ea94ad
SSDEEP 6144:AWoATEjRROySO2/wOu160djacR3UI4inm6OmwWoATEjTuiFKYdq:AWoAITOySx/cWWoAIrU
TLSH
T1B1B48D56ABF54AB1EDA60B31987987380375FE30F7208ECF0718258E6B56AD00C75B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Colors	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2"	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000235d0978100054656d7000003a0009000400efbee95c2b72235d09782e000000740000000000020000000000000000000000000000009e2a7300540065006d007000000014000000	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\NotificationData	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000e95c4c7514004c6f63616c003c0009000400efbee95c2b72235d09782e00000073000000000002000000000000000000000000000000519316004c006f00630061006c00000014000000	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000e95c2b72120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbee95c2b72235d09782e0000005f000000000002000000000000000000000000000000eabce1004100700070004400610074006100000042000000	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe

C:\Users\Admin\AppData\Local\Temp\1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe
"C:\Users\Admin\AppData\Local\Temp\1e3ecfbad2744ee85d5c08fa54d7be9ed74c929c7fe3cf4ab5e2acb9285a0afa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads