cf7ada1486b499700a84846b342ca2b1defdb4db622843f812151f255f2ad63c

Analysis

user interaction
yes
max time kernel
28s
max time network
4s
platform
windows11-21h2_x64
resource
win11-20260911-fr
resource tags

arch:x64arch:x86image:win11-20260911-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
22/09/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dlssnr_on_amd_setup.exe
Size 7.2MB
Sample260922-mv271scd37
SHA256 cf7ada1486b499700a84846b342ca2b1defdb4db622843f812151f255f2ad63c
MD5 1793177fd95be6d203e2764aeb860525
SHA1 967b5c947c3d22bd757e1a54e2a2ea9310c21711
SHA512 918c784fb78d12d026bc6f1d7e441dd90e87e947d9f1f02ac03d7ad6acc19d1876eee6722ca05c20b94e7fb10f16a5545a2a37dd20434e51f4ce702571b82ced
SSDEEP 49152:2/OCcfChreWkJtdRCL3dWTKnlSSsJtdRCybszkbszG:HzdRCL3deKnl3szdRCnzRzG
TLSH
T121763A057B6E4C83E1E1ECB9490393A93B76A97D2F36070786B1512FBED36B104D6728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000002b5d389310004c6f63616c003c0009000400efbe2b5d9890365d09562e00000057570200000001000000000000000000000000000000006d84004c006f00630061006c00000014000000	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	dlssnr_on_amd_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	dlssnr_on_amd_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	dlssnr_on_amd_setup.exe
Key created	\Registry\User\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\NotificationData	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	dlssnr_on_amd_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000365d0956100054656d7000003a0009000400efbe2b5d9890365d09562e00000058570200000001000000000000000000000000000000833c8d00540065006d007000000014000000	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dlssnr_on_amd_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	dlssnr_on_amd_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000002b5d9890120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5d9890365d09562e00000043570200000001000000000000000000000000000000b98a5e004100700070004400610074006100000042000000	dlssnr_on_amd_setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4276	dlssnr_on_amd_setup.exe

C:\Users\Admin\AppData\Local\Temp\dlssnr_on_amd_setup.exe
"C:\Users\Admin\AppData\Local\Temp\dlssnr_on_amd_setup.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads