50902889a3bf17e8a23f7fcd7009fbf786b5c12ed8efd90e2e9c2e15ce8c96a9

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WiseRegCleaner-Pro-v11.3.3.735-x64.exe
Size 5.0MB
Sample260924-d5x7daycqa
SHA256 50902889a3bf17e8a23f7fcd7009fbf786b5c12ed8efd90e2e9c2e15ce8c96a9
MD5 8d7186331f27c736161f83c82503a79f
SHA1 467da6a6a8a2097116afd0659c5d5477677a94a6
SHA512 98a09706263dd3abfca32f534665a8f9e720ed024b30539abbc65fc7d514ddfe677c8bd811408aac525de802a167999ffab7cc99ea667c939e1463eddfd90eb3
SSDEEP 98304:CgwRaPuKZTzzUIGT2IYMviazRnuEY38gnHnCkldK1q5NNxn3UxAvgkP3LGhNkg:CgHWKFzcTDsSnPZgnHnCi75fJUKjPyMg
TLSH
T1FE3633117689EAF0DD19017625666FA12B3DDCE94F0486C3BED9360B3F34096F2BE249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5344	WiseRegCleaner.exe

Loads dropped DLL 2 IoCs

pid	Process
5344	WiseRegCleaner.exe
5344	WiseRegCleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WiseRegCleaner-Pro-v11.3.3.735-x64.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WiseRegCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	WiseRegCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	WiseRegCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	WiseRegCleaner.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5344	WiseRegCleaner.exe
5344	WiseRegCleaner.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5344	WiseRegCleaner.exe
Token: 33	5344	WiseRegCleaner.exe
Token: SeIncBasePriorityPrivilege	5344	WiseRegCleaner.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5344	WiseRegCleaner.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5344	4324	WiseRegCleaner-Pro-v11.3.3.735-x64.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner-Pro-v11.3.3.735-x64.exe
"C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner-Pro-v11.3.3.735-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\WiseRegCleaner.exe
  "C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\WiseRegCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chinese(Simplified).ini

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\Languages\Chinese(Simplified).ini
Size 26KB
SHA256 ee2f5348d19d18b3ad6c15edf523ff5d8a8b1389720114bdaba5a208b1ba1186
MD5 b2abf86a2608609a122958b65dd8e9d6
SHA1 9ace9df5b9285dde1d11cb0453fa0318fa5100d2
SHA512 cb6a773b44bc7bc1f37f70980079220cf0708677df895124eda788d5013ed3eec48ab42aad3f94ab56d30f3c49eeb63dfb27d192a8fb94e257ddcbbd16afaf5f
SSDEEP 384:fOpny2xDqL94dQ+lwdhWHpvA6B+vSEKIbSu486DL6hWCyMkM06KsMd1X:fOlyCDqLKdh2dYvB+GI+X8tMM5Kb1X
TLSH
T183C2CE413BFD1208F5F38B44FAF9A0644BBA7C56A92CC25D65C8454E0871E81DA63BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\Languages\English.ini
Size 47KB
SHA256 e30ff6d2890eecae08a6760ccd6b10e4dfd1397f45b32ef5e84a1ad5c423faff
MD5 66e557996d98f30e408d955772ddfce1
SHA1 9f914beec814ee09ea25660d67aca2d4ca2d56f2
SHA512 3edf0adb46d5b687eb7833bc27a64640f0e07a14a5b9178ec0e03da28329afb763c82f5026f4652d1f190774404984a3c93d5800410cfcd4a4bb785188dd0da3
SSDEEP 768:HCPzowKtv+myIm3/cn8QSou/QGx4qhPtlJjSmUj6az5:iJK1kcn8QSop4xAmUj6a1
TLSH
T11D23815267FD5208F6F37F54BEB994644E7ABC66AC39D25C2280004E49F1E80C972BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Russian.ini

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\Languages\Russian.ini
Size 47KB
SHA256 97dd2e37bc1b330d1c904f508973163db76cb3dced88e2cfe0710816645b9f4d
MD5 251ea717b9a5d156bd3b831bc6a61fff
SHA1 e2d6de51b8abac925322577bdf8ccd7f075a5f08
SHA512 85d1fe5f3e4eb5f62b7d19f94ebeb0c2a62fb8116ffacccefa603c20fc0e1511b5159ec3b06c2adfead0f71374018c2249182b01fc05017a8cc25d4e1b29de14
SSDEEP 768:fX3glgOdIaDSlCikQfXo+hKt92Nr0MwihDpzSmdwD:ZlC4o+hm0NgbiDzty
TLSH
T12223334FB7FC5204B4A6D750AF7684E201EABB146728D1CD928F2C5D50B8AB173227E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseRegCleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\WiseRegCleaner.exe
Size 14.2MB
SHA256 40366684667044f9fc2069615174b07d9da77d1cfcd82af2ba6c52284fb9e399
MD5 c029f525d89a791ad6b69a553114c30f
SHA1 7e4238b71b4572c79936ad93942ad3c9e3fe5a6e
SHA512 efa25c40fe8474d83f79f7245c15992c09a0d3871ff325764e068815eb547314aae5394ffb3d1bde18e2a57ec3930e35f8566c28c78fc1c0a5c9bae514f09844
SSDEEP 98304:orvZtup+f4ldAN5fuHUpEWN+1Ja7WphOdetOBTN9+TPXGSbrK:ec2uHUuWN7OoetONKTeSb2
TLSH
T165E64B3B36B8816CC15DC17DC0A74F90A933BCB51B36C6FB429422652F626D56E3FA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\config.ini
Size 175B
SHA256 1a859651cd2c738f5238d3ca0a34479010077ab17f979df625939642e7f3ade0
MD5 2e63f375287fed9f26fd4b8c7de116d1
SHA1 b3487c9c347e2a327d2312f3946be6ec6e6a254b
SHA512 b6b691446fa24a52f53dad9086be68d1c173bba5613a5758b612c7908fd4b9fd0d4ac8a8a6e1b8f713a344408283d86456bd3975d9662cb22af5214003e32df9
TLSH
T176C08C164211C23E2BEAF5907020015BA8FB27C52FF4A80FBD75D1ED1DE0D918B9E880
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\sqlite3.dll
Size 1.0MB
SHA256 e6fa730b38d30c891ab723e21b79111a416e4d0d8e5fd708214056abd22cfbdc
MD5 d69f968a0252675b4dafc3d07dd5fdc7
SHA1 ded8c92ff599aa333cb425df70bafd40d935cddf
SHA512 96e45886fba469da5619646f293fe9ce3fa2c3c5a7965bb6d591f5980b570aae281cc00a76544d1a99f05fa0d46e21ede6651d6a76ba230739c7f2e3ad3f9d2f
SSDEEP 12288:BcuqiHyeEhT5vk+NkSPd5VF8Nq1QhjYGyJlMM/3hjm3IQCiv9VTqa9U9kllNFJY3:BAiHwhymV+hjXulMMxmYQCifqWBFaMWd
TLSH
T19D359E47B3B8009CC197C1B989175707EBB2744513649BDB59E0CAAE7F23FE2267A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\WiseRegCleaner\vcruntime140.dll
Size 117KB
SHA256 da72e6677bd1bcd01c453c1998aaa19aeaf6659f4774cf6848409da8232a95b2
MD5 943fc74c2e39fe803d828ccfa7e62409
SHA1 4e55d591111316027ae4402dfdfcf8815d541727
SHA512 96e9f32e89aee6faea6e5a3edc411f467f13b35ee42dd6f071723daeba57f611dbd4ff2735be26bb94223b5ec4ee1dffedf8dc744b936c32a27d17b471e37dcf
SSDEEP 1536:R9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaWEoecbdhUoTtHez9FazR:REnsvReGsWyxLizXFCecbd1Tt+i1
TLSH
T168C37C8572A002FBD17AC274C1A36A17FB75B94487A0A7CF03B58A660F53BE09E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5344-29-0x0000000003F40000-0x0000000003F41000-memory.dmp

Download

memory/5344-34-0x0000000000400000-0x0000000001271000-memory.dmp

Download

memory/5344-35-0x0000000003F40000-0x0000000003F41000-memory.dmp

Download

memory/5344-36-0x0000000000400000-0x0000000001271000-memory.dmp

Download

memory/5344-37-0x0000000000400000-0x0000000001271000-memory.dmp

Download