Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 16:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe
- Size 699KB
- Sample261014-vhtdcaf15y
- SHA256 f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f
- MD5 a1d5007fe43224b06481e800c56e1b5c
- SHA1 c36c415e65de52a1c307963d8fad2a0d2855c2a7
- SHA512 f7aece46f973789d927f4c4c375cb3000a186496738513bf39056eff882d8d569497822ff7230e7d4f643bb4a409a05e5b6b1a577054a30de0871bf26a40ec56
- SSDEEP 12288:7ksyz+7afQnUoSz5d6NkZmRxt8f4Tc879Jx/jdHmpd98SxsFvLdnbbv7ZHLz:7ksyy7afQnUoSD8CQt8QTc879JBsr98V
- TLSH T154E42A41A69B4CB1DC922BB864DFA37F6B38FE708966CBA3F048C5325D135D16D5A302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\K: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\O: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\T: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\B: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\L: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\M: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\S: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\U: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\V: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\X: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\G: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\H: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\J: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\N: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\Q: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\W: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\Y: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\Z: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\A: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\P: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\R: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File opened (read-only) \??\D: f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\INF\c_fssecurityenhancer.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fscopyprotection.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_barcodescanner.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_primitive.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_camera.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\miradisp.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fscontentscreener.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsantivirus.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_i3c.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_processor.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_monitor.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_proximity.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_swcomponent.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\rdcameradriver.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_linedisplay.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fssystem.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\xusb22.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_extension.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\wsdprint.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\remoteposdrv.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\digitalmediadevice.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\oposdrv.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsencryption.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fscompression.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fssystemrecovery.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_media.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_smrvolume.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_nvmedisk.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_netdriver.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsundelete.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsreplication.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_scmvolume.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsquotamgmt.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_ucm.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fshsm.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_generic.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_mcx.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_scmdisk.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_ramdisk.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_firmware.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\dc1-controller.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_display.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_cashdrawer.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\rawsilo.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_receiptprinter.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_sslaccel.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_magneticstripereader.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_apo.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_computeaccelerator.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_smrdisk.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsvirtualization.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_fsinfrastructure.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_volume.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\c_diskdrive.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\ts_generic.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe File created C:\Windows\INF\eyegazeioctl.PNF f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5956 f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe"C:\Users\Admin\AppData\Local\Temp\f100e659b35097511a67642b0f4ddcd202909161ed75df5dfdf9588c92db8b4f.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:5956