590664cbecf3a1e4f65505c55f3abfba39b5ee7a1cd66f55960a6252faf2a719

Analysis

max time kernel
149s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
makekeyfile.exe
Size 7KB
Sample260913-alhqsshq91
SHA256 590664cbecf3a1e4f65505c55f3abfba39b5ee7a1cd66f55960a6252faf2a719
MD5 6666b7b68c0e30fc63f33348a0ce10db
SHA1 7eafddeaf1d0a15932c07cf79638d44a884911a7
SHA512 290154f8693812f509b882c4bf4142dead6810972ead89c6749964ac22ae4f368f7f54b8f517cd7b9697f8a160d6f22e390d450be21b964e33aae25d4072f916
SSDEEP 192:M7PXfBrGh4Lg6TrEy7G/7RgGZ2VjgwZkSBs49:SPvByCPTAyi/7q8+i4
TLSH
T115F14B92F950F96BE41701722CD38661277CE9352ACE1F47EAC12B2E6C367D26E10B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	makekeyfile.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000002b5d467c10004c6f63616c003c0009000400efbe2b5df3782d5dd38b2e00000072e101000000010000000000000000000000000000007dee24004c006f00630061006c00000014000000	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002b5d8d82100054656d7000003a0009000400efbe2b5df3782b5d8d822e00000073e10100000001000000000000000000000000000000ae1e0500540065006d007000000014000000	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	makekeyfile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	makekeyfile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	makekeyfile.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000002b5df378120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5df3782d5dd38b2e0000005fe10100000001000000000000000000000000000000fd9ee9004100700070004400610074006100000042000000	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	makekeyfile.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	makekeyfile.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	makekeyfile.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	makekeyfile.exe
2128	makekeyfile.exe
2128	makekeyfile.exe
2128	makekeyfile.exe
2128	makekeyfile.exe
2128	makekeyfile.exe

C:\Users\Admin\AppData\Local\Temp\makekeyfile.exe
"C:\Users\Admin\AppData\Local\Temp\makekeyfile.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d2maphack.key

Path C:\Users\Admin\AppData\Local\Temp\d2maphack.key
Size 256B
SHA256 217e9aacc4d26ed98dfd6f58150c9cb397db0d7bcadb7342c662606aa299a0d7
MD5 eee9b8d383e85fc8b9ac3eeca6bdae14
SHA1 eefe18f75f5c4e8db71b95fd4a85bfec381c1179
SHA512 2cfcbf82960146c71e24dcfb87cf345d90f0bb951123d498ad259bc60e528b9ee9fd87e4ee0846a27bee409a9801727bfcb0a731974f4ac3619ece1d333fc81e
TLSH
T151D02EAEC726AEE889020E00D09227A87DECCB5B41604BDB5B225EAD0A890C649021A8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2128-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2128-1-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2128-3-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2128-4-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2128-6-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads