Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:34
Behavioral task
behavioral1
Sample
e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
- Size 410KB
- Sample260930-ml4pgszfkb
- SHA256 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a
- MD5 d351a9515a7e66990e7f74ecf1de86fc
- SHA1 a2df79c302a39cad897fa947fde57c56f5c8cf2a
- SHA512 43ea9bbb314378abbf494d5119e94490084034632a4af38995892095b9f8700ce63c080ed810ad1ecdaf1fd38cb9bd5dca2854c67711867df4593000b0f2df45
- SSDEEP 12288:hSrdZ+Xinr5yYKIbnZ+0QPqVdTZN36Tck3i8QM:hqdZ+SnrMY9Z+0VTZ0ck3i8QM
- TLSH T1AD9412879F241091CFF6237224A75D68BF13D522BFEA43A7340D740EBE323229985675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe -
resource yara_rule behavioral2/memory/1792-0-0x0000000000400000-0x0000000000518000-memory.dmp upx behavioral2/memory/1792-19-0x0000000000400000-0x0000000000518000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Colors e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - Modifies registry class 41 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\NotificationData e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f483accbfb42cdb4c42b0297fe99a87c6410000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe 1792 e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe"C:\Users\Admin\AppData\Local\Temp\e8f44053212fe178dde87854edade3583e09e6b36bc32a55dd06ca165dc33b6a.exe"1⤵
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\ScanResult 2026-09-30 11h35m.csv
- Size 25B
- SHA256 803dc9f5d8fd1329a3d36ee7eccbaf9b0c8ee104707f922d47d3f77e86fc097a
- MD5 6496ee64867fb770acf71f0a30bc590a
- SHA1 8bd6d16af57c8ce32b7fd5311f0257c09636fff0
- SHA512 da28aae228bbf90bee9b5bc17fb99c250932a369b5ace0e2f6a7a438fa1832aff25fd593986778fcb9f8cdfa558b0ac6628e80e251d75bc0d45f45a4016bfba1
- MD5 SHA1 SHA512