Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 11:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bocchi_the_share.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bocchi_the_share.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target bocchi_the_share.exe
- Size 6.1MB
- Sample260925-nbbfmavaqf
- SHA256 226281d4189567e24e3e5db7251910509c5d5651cfcfbb83118b9274b58c7245
- MD5 bc9fcad35da24823445e8db1a793ceeb
- SHA1 2be1e65938bfa4b3c4f5516457a961254263c5ae
- SHA512 dc5b571bd1495f5f253c84453ff78f69760bda5afe6820658448869c2812f7a227d5e91c9c7268cb262bc56df32031ce17cdac5b70a70bc823e122a26774a65b
- SSDEEP 49152:ghqXfS/l28GuDpoLV2oRc3nyHd+gpLbYWfmupkQCCoMwFX0UQXV6QXVqQXVTEHdP:PfYlSOezGGLZiMw107EbE7WVJkbs
- TLSH T1A2568D92F366A2EFC556C43082697237E672784F03347AE747D0AA712F51BD01E79B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts bocchi_the_share.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\URL Protocol bocchi_the_share.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\shell\open bocchi_the_share.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\ = "URL:bocchi the share" bocchi_the_share.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\DefaultIcon bocchi_the_share.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bocchi_the_share.exe\",0" bocchi_the_share.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\shell\open\command bocchi_the_share.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\shell bocchi_the_share.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\bts\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bocchi_the_share.exe\" \"%1\"" bocchi_the_share.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3392 bocchi_the_share.exe 3392 bocchi_the_share.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3392 bocchi_the_share.exe 3392 bocchi_the_share.exe