b912bc5fc6cc6984abb9cd18f1f9fe1901c2b8942839d491904cc0a80c1d789c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b912bc5fc6cc6984abb9cd18f1f9fe1901c2b8942839d491904cc0a80c1d789c.exe
Size 117KB
Sample260929-ysngmaxbrd
SHA256 b912bc5fc6cc6984abb9cd18f1f9fe1901c2b8942839d491904cc0a80c1d789c
MD5 bdd3d052b01b3c3eaf3a09cb266ed43d
SHA1 78c778d0afa6cd3d928d26407f0eaf6ebbd950b3
SHA512 f0127493bc5a35225c06c6c5f95f70e723c864806d67b423baf69513d99decc1c05a5a17832a42d1f67e93eb594d1bca0933dc502f0d420500cda978185a9bf2
SSDEEP 768:IcAerDX05pBMgJNOqfqOhRe7Fw30zvy9UCeWYks2zQmKRH5y:cQDXgBRLfqOq7Fk0joUCeA0RH5y
TLSH
T166C32D9077ED5095F6F32B3D79BA42601B3EBE908E75DB0F524865180E73A80ACE1736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b912bc5fc6cc6984abb9cd18f1f9fe1901c2b8942839d491904cc0a80c1d789c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4620	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4620	explorer.exe

C:\Users\Admin\AppData\Local\Temp\b912bc5fc6cc6984abb9cd18f1f9fe1901c2b8942839d491904cc0a80c1d789c.exe
"C:\Users\Admin\AppData\Local\Temp\b912bc5fc6cc6984abb9cd18f1f9fe1901c2b8942839d491904cc0a80c1d789c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2364

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x0000000000CB0000-0x0000000000CC6000-memory.dmp

Download