5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe
Size 2.0MB
Sample260910-ycy87aveqa
SHA256 5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366
MD5 8e130d15e952fa4d2d0f7d023e1a1438
SHA1 e73ac6ff1a0681c72f15600483a5860ac4e5cbf7
SHA512 7caafe7c68370a04106f814fdd7071001204e7d90d4f0ef1b63d1cc48d275c341dac06c6c72adfbdacd680be0db1cb36ec25f1a59dfc2be3e7bbc85fca6f8498
SSDEEP 49152:ovCggXJLrduEyztsR7OQzQzAmjqamm173f:oKggdd/yzt67OU7apv
TLSH
T14DA5137AF1908437D1236E7CCC5BA754A825BEE02D28608A7BEC1C4DDF39B8135262D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe

Executes dropped EXE 5 IoCs

pid	Process
4868	7D57AD13E21.exe
4040	Scegli_nome_allegato.exe
1872	7D57AD13E21.exe
3812	7D57AD13E21.exe
4732	7D57AD13E21.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4868 set thread context of 3812	4868	7D57AD13E21.exe	101
PID 1872 set thread context of 4732	1872	7D57AD13E21.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D57AD13E21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D57AD13E21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D57AD13E21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scegli_nome_allegato.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D57AD13E21.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	Scegli_nome_allegato.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Scegli_nome_allegato.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Scegli_nome_allegato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Scegli_nome_allegato.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2324	reg.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4040	Scegli_nome_allegato.exe
4040	Scegli_nome_allegato.exe
4040	Scegli_nome_allegato.exe
3812	7D57AD13E21.exe
4732	7D57AD13E21.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2324	4948	5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe	91
PID 4948 wrote to memory of 4868	4948	5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe	93
PID 4948 wrote to memory of 4040	4948	5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe	96
PID 4868 wrote to memory of 3812	4868	7D57AD13E21.exe	101
PID 4868 wrote to memory of 3812	4868	7D57AD13E21.exe	101
PID 1872 wrote to memory of 4732	1872	7D57AD13E21.exe	102
PID 1872 wrote to memory of 4732	1872	7D57AD13E21.exe	102

C:\Users\Admin\AppData\Local\Temp\5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe
"C:\Users\Admin\AppData\Local\Temp\5953f041f550c48c3b2a9b2e30450ad88be238d456c54d1e43917823b63fd366.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2324
- C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
  "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
    "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3812
- C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
  "C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4040

C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
  "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D57AD13E21.exe

Path C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
Size 2.0MB
SHA256 1d9f17586cb7e6561c51eee6d579e91c7ffbde7a5d6f8ea1a0654b6b81e82eb2
MD5 421d9c203bf1ac655432e94b4e4aa522
SHA1 cc9cd46ac8c5428a16413361d809c1ad7073b6ec
SHA512 df779248d454f96dc8e85a988453aea6e67052095f5d46f180cace8bc1166a3444ce0b01a648ee7e7eac040fedb7b2eb9da2a2c36f1a4699bb9d9a3fbb3807c7
SSDEEP 49152:ovCgCXJLrduEyztsR7OQzQzAmjqamm173f:oKgCdd/yzt67OU7apv
TLSH
T170A5137AF1908437D1236E7CCC5BA754A825BEE02D28608A7BEC1C4DDF39B9135262D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Scegli_nome_allegato.exe

Path C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
Size 1.0MB
SHA256 ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
MD5 a2f259ceb892d3b0d1d121997c8927e3
SHA1 6e0a7239822b8d365d690a314f231286355f6cc6
SHA512 5ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad
SSDEEP 24576:hIl4VPiOVmQsN5SqOoU3TcnqrqmCKkBTl0:hI+ippSx3urT
TLSH
T190259E22F2919833C03316789C1BD7B55926BE202928AD873BF93D4E7F7D64138292D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1872-38-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/1872-30-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/1872-50-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/1872-45-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/1872-37-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/3812-43-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/3812-40-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/3812-52-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4040-27-0x0000000000400000-0x00000000004FB000-memory.dmp

Download

memory/4040-28-0x0000000000400000-0x00000000004FB000-memory.dmp

Download

memory/4040-34-0x0000000000400000-0x00000000004FB000-memory.dmp

Download

memory/4732-53-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4868-14-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4868-35-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4868-33-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4868-39-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4868-42-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4948-26-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4948-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4948-4-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4948-3-0x0000000000400000-0x0000000000601000-memory.dmp

Download

memory/4948-2-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4948-1-0x0000000000453000-0x0000000000454000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads