Analysis
- max time kernel
149s - max time network
154s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-fr - resource tags
- submitted
06/09/2026, 23:54
General
- Target App/DriverEasy/Easeware.Driver.UI.Notification.exe
- Size 572KB
- Sample260906-3x6afssyet
- SHA256 3738efef7a9b8d732b59fa3a9910dd224dd99b0508a4a70333043e648155f73b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 18 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\App\DriverEasy\Easeware.Driver.UI.Notification.exe"C:\Users\Admin\AppData\Local\Temp\App\DriverEasy\Easeware.Driver.UI.Notification.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5868-0-0x0000000000690000-0x0000000000722000-memory.dmp
memory/5868-1-0x0000000002BD0000-0x0000000002BFC000-memory.dmp
memory/5868-2-0x0000000005080000-0x000000000508A000-memory.dmp
memory/5868-3-0x00000000050B0000-0x00000000050B8000-memory.dmp
memory/5868-4-0x00000000051E0000-0x0000000005206000-memory.dmp
memory/5868-5-0x0000000005420000-0x00000000054B2000-memory.dmp
memory/5868-6-0x00000000058D0000-0x00000000059D2000-memory.dmp
memory/5868-7-0x00000000051D0000-0x00000000051E0000-memory.dmp