Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 04:35
Behavioral task
behavioral1
Sample
shellter.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
shellter.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target shellter.exe
- Size 12.3MB
- Sample260912-e77n9sdd24
- SHA256 fa03c2c6c46ec159d210bdf7d25bcceac44906ac773766db11621e581e2d1458
- MD5 ab6f046c69e782d452bce8733936eab7
- SHA1 dfb5680165c9f390b603f83a3b155426429aed66
- SHA512 efb874a3f63d397ce43eec728a2336e59cb4dd589217d8321995bd124d4017b9e9eedcad4e82adfeb5af1eaffd3ef473dad61a1a1f202e37e0a7906c6fef7cad
- SSDEEP 393216:5YeVUHfzPzMD8CrhKSFW9z7krQi/nCr6lgT3n+:5YeqHfzD7pGgTX
- TLSH T148D68D63A24244B1D45330BEC836DAAE5068AE65477414CB62D87D1BB273FC3A93D78F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 4668 540 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shellter.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 shellter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz shellter.exe - Modifies registry class 43 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe\" %1" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe\" %1" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe,-608" shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe,-203" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe\" %1" shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.f4a shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe\" %1" shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe,-202" shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe\" %1" shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.f4a\ = "FlashPlayer.AudioForFlashPlayer" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.f4p\ = "FlashPlayer.ProtectedMediaForFlashPlayer" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.swf shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe,-204" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shellter.exe,-205" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.f4p shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.spl shellter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash" shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open shellter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command shellter.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 540 shellter.exe 540 shellter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shellter.exe"C:\Users\Admin\AppData\Local\Temp\shellter.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13442⤵
- Program crash
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 540 -ip 5401⤵PID:5492