41961394d46cc0418f4445c22f9784bf8a62cdec408c27777d64c0d21a98fca4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
51s
max time network
55s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OderSo Launcher.exe
Size 28.8MB
Sample261001-tpaddaxeja
SHA256 41961394d46cc0418f4445c22f9784bf8a62cdec408c27777d64c0d21a98fca4
MD5 c44c11458c10aceaf6de8224279205f0
SHA1 f033ededcd3b364f3047108260d788045625b3ea
SHA512 e6b905dc19c941b4b0cb85b01be5bd5e7f88883f069487e8ffeba52c51f29c6b6128b46af3d060e822df9a7fa8014ef98fe977150d1b582fe360ca8daa0541fa
SSDEEP 196608:vkJPYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPF4f:vkJPYFqAFLKnCTMGP2
TLSH
T1D3676C129BB44F2DCA8F5672F8B103754335C60B6B43929A685CC69C3E833760E55AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	OderSo Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	OderSo Launcher.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OderSo Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OderSo Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OderSo Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OderSo Launcher.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "50"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4780	OderSo Launcher.exe
5180	OderSo Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3524	7zG.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	OderSo Launcher.exe
Token: SeRestorePrivilege	3524	7zG.exe
Token: 35	3524	7zG.exe
Token: SeSecurityPrivilege	3524	7zG.exe
Token: SeDebugPrivilege	5180	OderSo Launcher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3524	7zG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1360	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\OderSo Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\OderSo Launcher.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4556

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap13092:88:7zEvent10895
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3524

C:\Users\Admin\Desktop\OderSo Launcher.exe
"C:\Users\Admin\Desktop\OderSo Launcher.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a3e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.txt

Path C:\Users\Admin\AppData\Local\OderSo\Logs\logs.txt
Size 1KB
SHA256 3cb79246317e539fde8e1b6d46608d905283a26e9b953bba034874c5a6673f9c
MD5 4e6059143a9449e5bd505ffa0e8e7e3e
SHA1 f58f728110b1f0adef6ae813fc7455209fbb1981
SHA512 8f59094b23b618c97f360153a28cb3761686ea7f82587b3a298c28ec4b749200b4db021faa3edfdd4998b7ed48458effa8277410e03ef8de01242f369613290d
TLSH
T17521CD54A10C825105F20425705E5C434DF522DD0A33E47976F5E682AF9EF10C77E295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.txt

Path C:\Users\Admin\AppData\Local\OderSo\settings.txt
Size 93B
SHA256 f3349434b12d3af66f1ccef926c548be156be91328ee069a728e3bf4426d5855
MD5 fe6eb4a3cce1bf0e99ea1d33952c14c8
SHA1 dd402332c36d1c7d016c9935ce26a000c8a4f30b
SHA512 dd0e0f0c91d85922244f6f93856ba7724695aea2174c56ecdb32e131038a551169076cc4c8b457449db142db9aa5313e6d93224a02ff143c81b37b124016f226
TLSH
T181B012FA61442804D4433418202066B3101B315B844835015E427D3200A0D3C0824097
MD5 SHA1 SHA512 TLSH

Submit Download