Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 10:34
Behavioral task
behavioral1
Sample
e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
- Size 410KB
- Sample260930-ml4pgszfkb
- SHA256 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a
- MD5 d351a9515a7e66990e7f74ecf1de86fc
- SHA1 a2df79c302a39cad897fa947fde57c56f5c8cf2a
- SHA512 43ea9bbb314378abbf494d5119e94490084034632a4af38995892095b9f8700ce63c080ed810ad1ecdaf1fd38cb9bd5dca2854c67711867df4593000b0f2df45
- SSDEEP 12288:hSrdZ+Xinr5yYKIbnZ+0QPqVdTZN36Tck3i8QM:hqdZ+SnrMY9Z+0VTZ0ck3i8QM
- TLSH T1AD9412879F241091CFF6237224A75D68BF13D522BFEA43A7340D740EBE323229985675
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe -
resource yara_rule behavioral1/memory/1444-0-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral1/memory/1444-16-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral1/memory/1444-17-0x0000000000400000-0x0000000000518000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1444 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe"C:\Users\Admin\AppData\Local\Temp\e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe"1⤵
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\ScanResult 2026-09-30 11h35m.csv
- Size 25B
- SHA256 803dc9f5d8fd1329a3d36ee7eccbaf9b0c8ee104707f922d47d3f77e86fc097a
- MD5 6496ee64867fb770acf71f0a30bc590a
- SHA1 8bd6d16af57c8ce32b7fd5311f0257c09636fff0
- SHA512 da28aae228bbf90bee9b5bc17fb99c250932a369b5ace0e2f6a7a438fa1832aff25fd593986778fcb9f8cdfa558b0ac6628e80e251d75bc0d45f45a4016bfba1
- MD5 SHA1 SHA512