Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe
- Size 2.8MB
- Sample260925-yfvp6sysdw
- SHA256 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576
- MD5 9675b7008f93b0c2b81197ef46c197d3
- SHA1 882a3a9d428583b6dc63a8df619613e44a0aaa58
- SHA512 febee58c4a1c48fb315e410165f4e8e6ca200a4ebfbd995dc61c88481b6fd4ed8e790415ea7fa1f770af740f545973df6bcbd45b98f5799a9d7fbc16e607657d
- SSDEEP 49152:RlOF/9npqQUqQDVmFLhUvczqajco6h0uO9aGgV1t3zR8aS50BKCqY:zOF2UU0zzAlt18B50PqY
- TLSH T1CFD5BF0AE6A541E8CC76C135CC6E612AF87174DA873097F753915F7B2F227E1AA3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Colors fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c004346534616003100000000002b5d4e7c120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5d4e7c395d889d2e0000007d000000000002000000000000000000000000000000bece25004100700070004400610074006100000042000000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000395d889d100054656d7000003a0009000400efbe2b5d4e7c395d889d2e00000092000000000002000000000000000000000000000000d0c87d00540065006d007000000014000000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 50003100000000002b5dfc7e14004c6f63616c003c0009000400efbe2b5d4e7c395d889d2e00000091000000000002000000000000000000000000000000bacc48004c006f00630061006c00000014000000 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe Set value (int) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2" fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2876 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576.exe