Analysis
- max time kernel
10s - max time network
143s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
16/10/2026, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Y F T.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Y F T.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
Y F T.exe
Resource
win11-20260911-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
Y F T.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Y F T.exe
- Size 11KB
- Sample261016-3kvcessxdx
- SHA256 6d02c02dd43057d4403332011b2b873a7005adf9cc15fbdb74d71e4c5e4223e4
- MD5 5150267e653c2091c414c0e84d2e4325
- SHA1 a84e99844e6bc1b2c3eff35ba3c64fc7a879809f
- SHA512 fbc8ba36c867c21fd2f8e49ebf07310143072f1800e7792b93837798d178664413a683b9321b86efab24b9c344e4407c505d8fada40dabe0059439a11c209552
- SSDEEP 192:ndwuCj4884yA7xzrHhfRLNHFd4Dqr9ozaWxFl:df64J4yuxz7dBRFCDQ9ozaKF
- TLSH T1FF32F90AFBC54420C9DC0BB874B75796A570E80E4F27DF9B2CDE04A66EBAB410ED52D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation Y F T.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies system executable filetype association 2 TTPs 47 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\lnkfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell reg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2288 cmd.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002442F-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493496-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9DC6AC40-EDFA-3E34-9AD1-B7A0A9E3A40A} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A786FB55-CDBD-30FB-BA05-82D15A6FD58C}\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell\Open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F04F-0000-0000-C000-000000000046}\Control reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{885735DA-EFA7-4042-B9BC-195BDFA8B7E7}\InProcServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0044-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CompressedFolder\Shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002091B-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\ShellEx\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\shell\PlayWithVLC\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020833-0000-0000-C000-000000000046}\Conversion reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0190-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0297-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0215-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024454-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Schemas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset\x-euc-jp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2069DBD8-4345-56CB-91CC-CC81F866BAB3} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0100-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetMacroEnabled.12\shell\Open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024473-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30510709-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{c1e9bc6d-1dae-421a-9369-cc7ff0d6e359}\Shell\Windows.BthMtpAutoConnect reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Slide.8\shell\Open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A3DD708-20D3-4C5C-A470-44FFBB24A72D}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp2v\shell\Open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{507171A9-0D7B-47CA-8DF5-56B23ACDC623}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C093CB63-5EF5-4585-AF8E-4D5637487B57}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.System.Update.1\CurVer reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EABCECDB-CC1C-4A6F-B4E3-7F888A5ADFC8}\Conversion\Readable\Main reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0317-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D3F5A756-4BAC-4D3D-9BAF-90935121AAA6}\15.0.0.0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0094-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A77-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.SlideMacroEnabled.12\Protocol\StdFileEditing\RequestDataFormats reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0184-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECE71064-011D-45b7-AEF2-3B626985E937}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000209B3-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.art\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020832-0000-0000-C000-000000000046}\Insertable reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0081-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002030B-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244F3-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF99B70A-941C-51D7-9CE0-9B3FBC9A5F89} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6F36A648-0453-4516-932F-BB8663DED71F}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.lst reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51973C23-CB0C-11D0-B5C9-00A0244A0E7A} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.OlkSenderPhoto.1 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5E6EB731-46BB-34EB-9BA2-94137C0DF177} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA7BAE71-FB3B-11CD-A903-00AA00510EA3} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3580A828-07FE-4B94-AC1A-757D9D2D3056}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AutoProxyTypes reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C282417B-2662-44B8-8A94-3BFF61C50900}\DataFormats reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0160-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SplashScreen\MicrosoftWindows.Client.CBS_cw5n1h2txyewy!PackageMeta reg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1052 wrote to memory of 2288 1052 Y F T.exe 86 PID 2288 wrote to memory of 4952 2288 cmd.exe 88 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Y F T.exe"C:\Users\Admin\AppData\Local\Temp\Y F T.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\reg.exereg delete HKCR /f3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4952
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x32c 0x16c1⤵PID:1772