cffff415f10d015313663d56ca1f7cee68f6d82ed31649b7a2d8fceb513f0f53

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FruitXPSetup15.exe
Size 10.4MB
Sample261003-ph23layarg
SHA256 cffff415f10d015313663d56ca1f7cee68f6d82ed31649b7a2d8fceb513f0f53
MD5 83989c953d7ac2313663b09cd76cabf2
SHA1 a1efa1fd90d6ac823d822a193dedcacc5857fd12
SHA512 96abc68ca9988c98429a654de253e5696056b94823a531f2e0299b40e51978917d21b45783c0ee91bac60a66e769101443a7d7cc1c7babac6caa22f0ec5e5281
SSDEEP 196608:cjWYeUTiyhQt2ttI8cYLhYRqbKSd1Zb9iSm1hvC8r5XEemTKn:VUTiyqtlkNt3dZipS1TKn
TLSH
T1CCB63340E7918E8CCDB9F073C9A47A7EFE322C05D24A8F7143653D5464AB1B9C92A379
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2780	FruitXPSetup15.exe
2780	FruitXPSetup15.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FruitXPSetup15.exe

C:\Users\Admin\AppData\Local\Temp\FruitXPSetup15.exe
"C:\Users\Admin\AppData\Local\Temp\FruitXPSetup15.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7C99.tmp\StartMenu.dll
Size 6KB
SHA256 9eac058e1fa59b34fc036562b03ce8249cbb0c588964b497b30ca1ae4eeac3a8
MD5 b065142aa786d8867b6ead6a90b9836c
SHA1 749c4a7547c4932d45124af0888100e14166dca1
SHA512 d9992a95811da79023b47941ecd38f22e313cff0b0d8ddafb15fe43c46c9699e946c141e89250ededd662f158f4d8cb227e74a523e4d54dd7fd6e0e12699c887
SSDEEP 192:5fnyqBcnWOyrJ42M0p3YK4ox4yGrhKR1:NnyqBcuF5Ko2yGrhKR
TLSH
T187D1C8B5B1D809B3DBA856303DE337724B27A2252B62901787B729CCB950A52ED38653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advsplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7C99.tmp\advsplash.dll
Size 6KB
SHA256 9104a91037ca7fbf0965dd7191ab5e945291275c0f0d27ac42d3b3c61021dc02
MD5 0de5df3c9d2452bf3ab3f5f4f33b4234
SHA1 ec3e045db9d32074e374e1811a9ce6cc0940c1c9
SHA512 9aa5c589910356cb7b50cc67a3cd92f103d3de0dc1524a85fe5163e0efb31252d0b99831ddbcfa887645ddf9c9a508ac94377371e890ea5f980ac893dc53f621
SSDEEP 48:q6uZufGPVZQlzWcaeAp5EOO21sgLCtf5XtdsocIu9gRFAShy07QjA7zzZhD:LfGwlzPahp5E9gLCtfxt6oosAShEOv
TLSH
T191C1B6BA77C096F3D09A00BD0C077A63CBB5D02173912038A82363C96BE6E5BDE20753
MD5 SHA1 SHA512 SSDEEP TLSH