Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 14:43
General
- Target cf47bc7f2d26638f02832defceedf72a09d3189e9e9755f669e149e43cbb00b6.exe
- Size 1.7MB
- Sample261003-r32zfa1blb
- SHA256 cf47bc7f2d26638f02832defceedf72a09d3189e9e9755f669e149e43cbb00b6
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf47bc7f2d26638f02832defceedf72a09d3189e9e9755f669e149e43cbb00b6.exe"C:\Users\Admin\AppData\Local\Temp\cf47bc7f2d26638f02832defceedf72a09d3189e9e9755f669e149e43cbb00b6.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7kaa.txt
7zip.txt
Bizhawk.txt
abiword.txt
abiword26.txt
abyss.txt
ac97forvirtualbox.txt
agatemulator.txt
agwak.txt
aim.txt
air.txt
akelpad.txt
alex4.txt
alreader.txt
anki.txt
ant-renamer.txt
antitwin.txt
api-monitor.txt
arduino-ide.txt
armagetron.txt
arpl-uming.txt
assaultcube.txt
audacious.txt
audacity.txt
audiograbber.txt
autoruns.txt
avidemux.txt
azulopenjdk8.txt
balloonfight.txt
blender.txt
bochs.txt
boinc.txt
boswars.txt
boundaround.txt
busybox.txt
calibre2.txt
cavestory.txt
ccleaner.txt
ccleste.txt
celestia.txt
ch341.txt
cheatengine.txt
chickeninvaders.txt
christmasbound.txt
chrome.txt
chromium-XP_49_0_2623_113-R2_VS2015_SSE2.txt
chromium-XP_49_0_2623_113_VS2013_SSE3.txt
chromiumbsu.txt
cjkfont.txt
clamwin.txt
clementine.txt
cmake.txt
cnt.txt
codeblocks.txt
codeblocks_gcc.txt
comctl32ocx.txt
coretemp.txt
cpuz.txt
crimsonfields.txt
cstalin.txt
curl.txt
cygne.txt
davegnukem.txt
deathrally.txt
deluge.txt
dependencywalker.txt
desmume.txt
detectiteasy.txt
devcpp_tdm_gcc_x64.txt
diablo2.txt
dilinuxreader.txt
directx.txt
directxfeb2010.txt
diskview.txt
dolphin.txt
dosblaster.txt
dosbox.txt
dosboxx.txt
doublecommander.txt
dplus.txt
dvdwritenow.txt
efsearch.txt
emule.txt
epsxe.txt
everedit.txt
everythingse.txt
excelview.txt
exeproperties.txt
explorerpp.txt
extremetuxracer.txt
fall.txt
famitracker.txt
fap.txt
farmanager.txt
fbide.txt
fceux.txt
ffmpeg-shared.txt
ffmpeg-xp_frei0r.txt
ffmpeg-xp_libfdk-aac.txt
ffmpeg.txt
filemon.txt
fileoptimizer.txt
finalburnneo.txt
fira.txt
firefox-esr.txt
firefox.txt
firefox28.txt
firefox36.txt
flashplayer32.txt
folder2iso.txt
foldermarker.txt
foobar2000.txt
fopnu.txt
fotografix.txt
foxit.txt
fpnpapi.txt
fpppapi.txt
freebasic.txt
freemat.txt
freepascal.txt
freestopwatch.txt
ftdi-driver.txt
gecko.txt
gensemulator.txt
ghostscript.txt
ghostview.txt
gimp.txt
git.txt
glidewrapzbag.txt
globulation2.txt
gnucash.txt
gog_galaxy.txt
gpuz.txt
grafx2.txt
gvd.txt
hashcheck.txt
hedgewars.txt
hexedit.txt
hiawatha.txt
hover.txt
hwmonitor.txt
hxd.txt
hydra.txt
icofx.txt
cstalin.ico
ffmpeg.ico
firefox_new.ico
genericdriver.ico
jdk8.ico
lang.ico
newwinsetup.ico
oldwinsetup.ico
opera.ico
themes.ico
wallpaper.ico
icytower.txt
ideasemu.txt
idm.txt
indiftpd.txt
inkscape.txt
iqpuzzle.txt
irfanview.txt
irfanviewplugins.txt
ironfield.txt
jet40.txt
jetAudio.txt
jpn-package.txt
jre.txt
jre6.txt
jre8.txt
kindlepc.txt
kmeleon.txt
kompozer.txt
krita.txt
kvirc.txt
kyodai.txt
lazaruside.txt
lbreakout2.txt
lgeneral.txt
librecad.txt
libreoffice.txt
libreofficehelp.txt
lmarbles.txt
lmms.txt
longhorn5048.txt
lun3r.txt
luna-beta.txt
luna.txt
lzdoom.txt
maelstorm.txt
mari0.txt
mario-luigi.txt
mcwin32.txt
md5summer.txt
mdac28.txt
mesagallium.txt
mfc40.txt
mfc42_msvbm60.txt
miktex.txt
mirandaim.txt
mirc.txt
mirc6.txt
mkvtoolnix.txt
mono2.txt
mpc.txt
mpxplay.txt
msnmessenger3.txt
mswallfluidtex.txt
mswallwin11waves.txt
msxml3.txt
msxml4.txt
msxml6.txt
multimc.txt
multires.txt
musescore.txt
mushclient.txt
mypal.txt
mysql.txt
mzimeja.txt
nano-win.txt
neko98.txt
nemobar.txt
net11.txt
net20.txt
net20sp2.txt
net40.txt
neverball.txt
nginx.txt
nirlauncher.txt
nodejs.txt
nogba.txt
notepad2e.txt
npackd.txt
npp.txt
nvda.txt
nvdisp.txt
nvidiaforceware.txt
ocenaudio.txt
officeformatpack.txt
ohrrpgce.txt
ollydbg1.txt
ollydbg2.txt
onlyoffice.txt
openarena.txt
openboard.txt
opencodecs.txt
openoffice.txt
openttd.txt
opera.txt
opera36.txt
opera9.txt
oswan.txt
otter.txt
pcsx2-xp.txt
pcsxr.txt
pdfsam.txt
peazip.txt
pengupop.txt
photivo.txt
photofiltre.txt
pidgin.txt
pingus.txt
plex.txt
pnotepad.txt
podcasteasy.txt
porrasturvat.txt
pptview.txt
precisecalc.txt
processexplorer.txt
processhacker.txt
project64.txt
pspad.txt
ptanks.txt
pulseaudio.txt
putty.txt
python.txt
python2.txt
qb64sdl.txt
qbitorrent.txt
qemu.txt
qemumanager.txt
qlcplus.txt
qmmp.txt
qtemu.txt
rainlendar.txt
rainmeter.txt
realtek-ac97.txt
realtek-hd.txt
remood.txt
renpy.txt
reshack.txt
restoration.txt
revo.txt
rfstools.txt
risoheditor.txt
rocks.txt
rom-properties.txt
rosbe.txt
roswallp.txt
royalenoirtheme.txt
royaletheme.txt
samba.txt
sambatng.txt
sbforvmware.txt
scilab.txt
scite.txt
scratch.txt
screen2exe.txt
scribus.txt
scummvm.txt
sdelete.txt
sdi-tool.txt
shed.txt
siv.txt
slashem.txt
slate.txt
slickrun.txt
smplayer.txt
snes9x.txt
snoopy.txt
sopwith3.txt
speccy.txt
stackandconquer.txt
stamina.txt
stellarium.txt
sublime_text.txt
sumatrapdf.txt
summerbound.txt
sunbird.txt
supercars3.txt
superdxb.txt
superfinder.txt
supertux.txt
supertuxkart.txt
swiftshader.txt
sylpheed.txt
tcc.txt
tcpview.txt
tdm-gcc.txt
terragen.txt
tgit.txt
thepowdertoy.txt
thunderbird.txt
thunderbird3.txt
tightvnc.txt
tileworld.txt
tinysnake.txt
tixati.txt
totalcommander.txt
transmission.txt
tsvn.txt
tuxpaint.txt
tweakui.txt
tweakui1.txt
twsynth.txt
ultraiso.txt
ultravnc.txt
unrealtournament.txt
unxutils.txt
usbdeview.txt
vb5run.txt
vb6run.txt
vbam.txt
vbasdl.txt
vbox.txt
vc2005sp1run.txt
vc2008sp1run.txt
vc2010sp1run.txt
vc2012run.txt
vc2013run.txt
vc2015run.txt
vc2015to2019run.txt
vc2017run.txt
vc6run.txt
vectoriangiotto.txt
verifier.txt
vim.txt
virtualMIDIsynth.txt
vlc.txt
vmmap.txt
vmpk.txt
watercolor.txt
watercolorlite.txt
watomic.txt
waveshop.txt
wglgears.txt
winamp.txt
winboard.txt
windbg.txt
windirstat.txt
winemono.txt
winevdm.txt
winfile.txt
winhier.txt
winmerge.txt
winnt3.txt
winobj.txt
winrar.txt
winscp.txt
winspypp.txt
wme9.txt
wordview.txt
wxmedit.txt
x64dbg.txt
xbgpack1.txt
xna40.txt
xrick.txt
zaz.txt
zerobrane.txt
zeth.txt
zinjaI.txt
zoomit.txt
zunetheme.txt
memory/3236-3506-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-3505-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-3135-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-3136-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-3137-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-3138-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-3134-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-1-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3236-0-0x0000000000489000-0x000000000048A000-memory.dmp