0e34b8070580062920eb6a58e4cc8929b7b47c8cf56449f1ab736d9dc02a5ac2

Resubmissions

25/09/2026, 11:58

260925-n5a2ysvfnc7

25/09/2026, 11:51

260925-n1a66a1we17

Analysis

max time kernel
300s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Garden_Of_Eyes_Content_Manager_2.0.0.3.exe
Size 16.0MB
Sample260925-n5a2ysvfnc
SHA256 0e34b8070580062920eb6a58e4cc8929b7b47c8cf56449f1ab736d9dc02a5ac2
MD5 7041ee5edb91143c3ec49738a62ffeca
SHA1 af749e57feab08f51d06d0cfa85b9c116ec118fa
SHA512 a3f18bd422a53331362e62472d6fdf3ffbc2ab77b1bbed7d41a7149d2513401fe61146576791f4b196b16bdfbe6b44023c35456c8fefb8b89ffeb088639db04d
SSDEEP 393216:t9D9yb59t8E5WSeECy9j4OUxZJgtWvWHqqw:X4b3vF/LeZeddw
TLSH
T118073345EBC248F5EF83097C829AAB7F6E3566168331D9D3DBD05902F8E19D12D7828C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Garden_Of_Eyes_Content_Manager_2.0.0.3.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Garden_Of_Eyes_Content_Manager_2.0.0.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Garden_Of_Eyes_Content_Manager_2.0.0.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Garden_Of_Eyes_Content_Manager_2.0.0.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Garden_Of_Eyes_Content_Manager_2.0.0.3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5112	Garden_Of_Eyes_Content_Manager_2.0.0.3.exe

C:\Users\Admin\AppData\Local\Temp\Garden_Of_Eyes_Content_Manager_2.0.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\Garden_Of_Eyes_Content_Manager_2.0.0.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5112-0-0x00000000004ED000-0x00000000004EE000-memory.dmp

Download