158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Size 63KB
Sample261011-v21a1ax18l
SHA256 158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7
MD5 5ac0232ae6cd6380c135ebcb607de9e3
SHA1 44e7ee71128c2f1948490016d50175ffb45acb35
SHA512 9b7002830d70c74176afe292673fff18856843c79ea1eb5278f19a16301c8e2e542f6b772730a7db0a0405910c351baeb85fc157fc737fba48f96bebcc7aaa5b
SSDEEP 768:cMm3L4o3g/vXNbINb0ZX+pKIzLDwUzc80gmq3oP/oDI:cMm0Ec/NRur/0O8/oM
TLSH
T1005396295173C92DC42C82B815EB2FBC27B0AF166450C76E4A79E6AC3F273B78D10756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe\""	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	discord.com
11	discord.com
18	discord.com
24	discord.com
27	discord.com
53	discord.com

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
6	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png"	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2760	WMIC.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
1696	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe
Token: SeSecurityPrivilege	2760	WMIC.exe
Token: SeTakeOwnershipPrivilege	2760	WMIC.exe
Token: SeLoadDriverPrivilege	2760	WMIC.exe
Token: SeSystemProfilePrivilege	2760	WMIC.exe
Token: SeSystemtimePrivilege	2760	WMIC.exe
Token: SeProfSingleProcessPrivilege	2760	WMIC.exe
Token: SeIncBasePriorityPrivilege	2760	WMIC.exe
Token: SeCreatePagefilePrivilege	2760	WMIC.exe
Token: SeBackupPrivilege	2760	WMIC.exe
Token: SeRestorePrivilege	2760	WMIC.exe
Token: SeShutdownPrivilege	2760	WMIC.exe
Token: SeDebugPrivilege	2760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2760	WMIC.exe
Token: SeRemoteShutdownPrivilege	2760	WMIC.exe
Token: SeUndockPrivilege	2760	WMIC.exe
Token: SeManageVolumePrivilege	2760	WMIC.exe
Token: 33	2760	WMIC.exe
Token: 34	2760	WMIC.exe
Token: 35	2760	WMIC.exe
Token: 36	2760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe
Token: SeSecurityPrivilege	2760	WMIC.exe
Token: SeTakeOwnershipPrivilege	2760	WMIC.exe
Token: SeLoadDriverPrivilege	2760	WMIC.exe
Token: SeSystemProfilePrivilege	2760	WMIC.exe
Token: SeSystemtimePrivilege	2760	WMIC.exe
Token: SeProfSingleProcessPrivilege	2760	WMIC.exe
Token: SeIncBasePriorityPrivilege	2760	WMIC.exe
Token: SeCreatePagefilePrivilege	2760	WMIC.exe
Token: SeBackupPrivilege	2760	WMIC.exe
Token: SeRestorePrivilege	2760	WMIC.exe
Token: SeShutdownPrivilege	2760	WMIC.exe
Token: SeDebugPrivilege	2760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2760	WMIC.exe
Token: SeRemoteShutdownPrivilege	2760	WMIC.exe
Token: SeUndockPrivilege	2760	WMIC.exe
Token: SeManageVolumePrivilege	2760	WMIC.exe
Token: 33	2760	WMIC.exe
Token: 34	2760	WMIC.exe
Token: 35	2760	WMIC.exe
Token: 36	2760	WMIC.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2360	1696	158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe	88
PID 2360 wrote to memory of 2760	2360	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
"C:\Users\Admin\AppData\Local\Temp\158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760

C:\Users\Admin\AppData\Local\Temp\158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
"C:\Users\Admin\AppData\Local\Temp\158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4224