e26b92e0eab6219451057db543b5d0da78f3f166f76faf822a5e5c173dc2070c

Analysis

max time kernel
910s
max time network
589s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SisterLocation.exe
Size 780.8MB
Sample260916-ssydyazzew
SHA256 e26b92e0eab6219451057db543b5d0da78f3f166f76faf822a5e5c173dc2070c
MD5 68c5a728de04ce4ee7400a21e2a8d339
SHA1 346abce011bbc56255605bcc46ebf37fa18546b2
SHA512 bbb80675c23edb1586be8c1c80705ac276e7f21b9d41e91c096e583f4524ba010cd756113e0ccca736c0fb23e49ccbc2ad4fbadc7f989cc7507289ab82f96a7f
SSDEEP 25165824:WQzVfEoEi71Cimdgsp/r+S/XSAMI3ie8A9Q:TztEop7cimdgsdr+SQ3A6
TLSH
T13389338CE6E7D842DCAB5033C6AA3E30A7BE0027436244DB527579442E965FD0F76A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe
4328	SisterLocation.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3308	GameBarPresenceWriter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SisterLocation.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{CD472CBC-F63C-44B2-B690-C7672C656A97}	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4328	SisterLocation.exe
1596	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\SisterLocation.exe
"C:\Users\Admin\AppData\Local\Temp\SisterLocation.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4328

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4244

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Perspective.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\Perspective.mfx
Size 15KB
SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
MD5 9f064bdcb066daa428db0ed9e33e785d
SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
TLSH
T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcclock.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\kcclock.mfx
Size 108KB
SHA256 f2319a7359fbcb8860f1c468aad602383c49effb7c110de01ff13acdcf3a5ab9
MD5 991da0ff2087993bba15ed149dd71b04
SHA1 13451a755644095621baefe3a8a9db9c7c550ab1
SHA512 5ee26153f82ac5ae6845b413271942b76a8d7ec50d3e484a7fe1656ee45e34260f73f47fb003b27ce913e6e7216d99a6e8765a431330a76423fedca9db5e85aa
SSDEEP 1536:dxbZlOorghPqU0lfjH4hC0ciB2TjsWjcdcpL1D:VsneHvsB2TMcpL1D
TLSH
T157B35B00B6918374F8BF06B546BA9BD20EBDBE22477489DB1790409E4DB47D0BB31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\kcini.mfx
Size 28KB
SHA256 52cdd0d5265dbe45966a787d0082e01ada41553c898f02347840aded98d6332f
MD5 ef2cad7570f3d4cfb8dc7915a92e03af
SHA1 e75063b93d22a45c19b14e93a4030a267faaccab
SHA512 34f202712b3ff0e9bc68c71108f8edd0d61a387a396bfc710af8da26f7d35c0505ba57bfa91ff524c7c43cdc05e09730ca3755e170f65850390fc0a65b8da630
SSDEEP 192:YD16eSCgELGu7FhwhdjMFNGJpjz9tFIwiWTg4x:Y1Hgp7dYFNGJp9wGT
TLSH
T1BAD2F70B76B49432D51F9D7A893F163B7E399A82C57BED138120D41C2C22B42587AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 fce87bf918787de7e8be0419941033dd98285eba51c79cfe16295f06e7b7cbc8
MD5 5e5ffd2560da7af01ad1d49357d0fe96
SHA1 c32ac6a0fca8a662b2e6303f45dc2a0b92848277
SHA512 f51daa8793d640201f1fa428c5c90c77b577188ba774bf2a1a0f418f8463760085e5b1c22cd70672023cbdee9c835633f5973b3c58a806b822721e77bc2a3dfe
SSDEEP 24576:20WIxnHHiaNehdEUXcH/s8vofCHgyQMmhF:6wheh7GjQ5F
TLSH
T1BF35BF10F1928131C4A733350A67A37972BABF2509B585CB1BC83E7A3E745E1973939B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\mmfs2.dll
Size 459KB
SHA256 1cb098cfa35e4692cc2759a1b23100a1f6ccdc6da4dc2bd5abb586e207eeb0e5
MD5 6ab37e080b4cc2466f9039ca42d61c48
SHA1 5fe216adb6867ebfb3bed1eb26da0b48e30822e1
SHA512 c3b5eb68cefbb1756a166751d26d7869617679f27fd95648fa8946bbcac60ea1ed9a3163f2b8081d52285df2fde7e77bea7b0de8e48b5c9ed9c79dc4d514722a
SSDEEP 12288:7FoDewjvfMOLkoAVEz2jeWKaCpzGYRHVfLA2fPTgcoe7:7FoDewjvf6hVEonGzhRHPPTJo
TLSH
T155A4AE11F982C232E9FA12728ABCBE6A257D7A70477445E397844DBD1D701E21F327A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp3flt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\mp3flt.sft
Size 24KB
SHA256 cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
MD5 7beafd3ec0c36a1422387c43c49f68ff
SHA1 240e7d8534ed25dffb902a969826f4300a88dde6
SHA512 44101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
SSDEEP 96:24yW7bMnfxKgUEDGDaq5E9my5F3MM+YuU0UNESZpMS07oQCcw95bcPw5IqQ+5lyc:24y+MCQiaOC3j9dJlfMSkI5wPPzElt
TLSH
T18CB22C12B3E10CF5E15A5F311D9B023BAE75FB9917B862575F91C2391C33901A81B537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt152F.tmp\waveflt.sft
Size 8KB
SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
MD5 f76739536860a0bdb4a7e3bbb0c06d08
SHA1 b21581aa36eda87db8845caf58c668749e26b29f
SHA512 6e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
SSDEEP 96:v2or1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6B/8cKH+ewp:vp6Dj9t2ubTVdGJgOMGvw
TLSH
T181F11C12A7A500F5F8DD0B7134B7627BE875FA295725C14FC544DE6C0C302E2D928BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\MMFApplications\sl
Size 26B
SHA256 6a67732756457b348a7d46b388b904183a58babc67553a2979427ac4eaa5e17b
MD5 7ac53e04475265a57bec8f38ef696d4e
SHA1 bb05df5fe1047cb027113bd2393cd864177360e9
SHA512 95de2c1a5fdcf1f2ac08566a7bd0f22482b29a4965b8c0eb8dbd2dee0f1ec3c60f8348109803915d79400b1ae7c157ed8b5888c69882b711fc5dd69c8b6aef4c
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads