Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe
- Size 2.8MB
- Sample260925-yfvp6sysdw
- SHA256 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576
- MD5 9675b7008f93b0c2b81197ef46c197d3
- SHA1 882a3a9d428583b6dc63a8df619613e44a0aaa58
- SHA512 febee58c4a1c48fb315e410165f4e8e6ca200a4ebfbd995dc61c88481b6fd4ed8e790415ea7fa1f770af740f545973df6bcbd45b98f5799a9d7fbc16e607657d
- SSDEEP 49152:RlOF/9npqQUqQDVmFLhUvczqajco6h0uO9aGgV1t3zR8aS50BKCqY:zOF2UU0zzAlt18B50PqY
- TLSH T1CFD5BF0AE6A541E8CC76C135CC6E612AF87174DA873097F753915F7B2F227E1AA3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000002b5dd778120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5dd778395d879d2e00000067e1010000000100000000000000000000000000000091d71e014100700070004400610074006100000042000000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000395d879d100054656d7000003a0009000400efbe2b5dd778395d879d2e0000007be1010000000100000000000000000000000000000058417d00540065006d007000000014000000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000002b5dad7b10004c6f63616c003c0009000400efbe2b5dd778395d879d2e0000007ae10100000001000000000000000000000000000000c94404014c006f00630061006c00000014000000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4148 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe