5713ee15bb253c0dd03f63974f84bfdb9e1d9474126337cc37babb2073c3e9a9

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
First United Bank/file/lolo - Shortcut.lnk
Size 1KB
Sample261001-w23a2avamd
SHA256 5713ee15bb253c0dd03f63974f84bfdb9e1d9474126337cc37babb2073c3e9a9
MD5 fdd3c34d5c7f98982ea95438b229d483
SHA1 8f678f8367d01cb942753ff894fa4eaa3c1d5748
SHA512 064f0fc067097a31d47b622faa77cfaedb511e902e918c49daa0c626d8aaa7f5db9ebadc3881d9e8d6892680e79a05935e6ce62d82af524f90790c24ff66fcd4
TLSH
T19631320603E246D6F7FB02F91EBB65C18331BC108E69828DD4C9408C6CA2B34D0E5B33
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2932	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	mspaint.exe
2084	mspaint.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	mspaint.exe
3068	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2084	2932	cmd.exe	87

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\First United Bank\file\lolo - Shortcut.lnk"
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\First United Bank\file\lolo.png" /ForceBootstrapPaint3D
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:6060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DSS.log

Path C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log
Size 64KB
SHA256 3198f62f6754f868f4c58284c8f178b522e027c867af0bc1732637503f142c72
MD5 e910f8d34167c25394986f93866f2b2d
SHA1 915473b77e2cfce12c1a4b25df8ca4063c112406
SHA512 11f28b8e92ffdb36712682a42ebe5e117167043b585e7151d8dbc1df4d07a716767df876418afbf6941ff271a13af72b56ad17c010bbda58d18f30c96e04ab7f
SSDEEP 6:V9Ms0WQD/LDWAhYDhP5c23qC59hYDhP5c23qC5FotUilO+B:V9Ms0Ws3WA6Ph6CX6Ph6CwVlOW
TLSH
T1CE539707822605B2CC398C3D888763104736F40131C94301498862DDEEC12213FB0EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6060-6-0x00000144338A0000-0x00000144338B0000-memory.dmp

Download

memory/6060-2-0x0000014433860000-0x0000014433870000-memory.dmp

Download

memory/6060-14-0x0000014443B60000-0x0000014443B61000-memory.dmp

Download

memory/6060-18-0x0000014443BE0000-0x0000014443BE1000-memory.dmp

Download

memory/6060-16-0x0000014443BE0000-0x0000014443BE1000-memory.dmp

Download

memory/6060-19-0x0000014443C70000-0x0000014443C71000-memory.dmp

Download

memory/6060-20-0x0000014443C70000-0x0000014443C71000-memory.dmp

Download

memory/6060-21-0x0000014443C80000-0x0000014443C81000-memory.dmp

Download

memory/6060-24-0x0000014443C80000-0x0000014443C81000-memory.dmp

Download