Analysis

  • user interaction
    yes
  • max time kernel
    50s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/10/2026, 22:23

General

  • Target
    OpenSCAD-2021.01-x86-64-Installer.exe
  • Size 20.9MB
  • Sample261018-2a1wsawsfx
  • SHA256 fbe1e590e1af2af863f5d92bd263eb4644d0ee29352e3ab566366e87a8f6ed12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OpenSCAD-2021.01-x86-64-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\OpenSCAD-2021.01-x86-64-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2320
  • C:\Program Files\OpenSCAD\openscad.exe
    "C:\Program Files\OpenSCAD\openscad.exe"
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2008

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dark-background.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\dark-background.json
        • Size 1KB
        • SHA256 b3089eb3eccf117aa18988b5fa92fe16fdd1f67fd5fe23dde877e443940020ae
        • MD5 SHA1 SHA512 TLSH

        light-background.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\light-background.json
        • Size 1KB
        • SHA256 acbe5f259273320754a71787515d0b93f9ce0c9f0e14614dc20054b60232a7cc
        • MD5 SHA1 SHA512 TLSH

        monokai.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\monokai.json
        • Size 1KB
        • SHA256 1642d6d81e77903a9bda3b3998efbca4cee7af8fd27ad117156e559529995fbe
        • MD5 SHA1 SHA512 TLSH

        solarized-dark.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\solarized-dark.json
        • Size 1KB
        • SHA256 91f7085775d33f38c987e647fdc4b52bd29fcd8e8d152f0e179eb023fe9ace04
        • MD5 SHA1 SHA512 TLSH

        solarized-light.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\solarized-light.json
        • Size 1KB
        • SHA256 df24eeb89942fb8352705e91c262f3ed0891dde82502bcdd7ac85db211662a58
        • MD5 SHA1 SHA512 TLSH

        tomorrow-night.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\tomorrow-night.json
        • Size 1KB
        • SHA256 4305d407fc7c012336cbfc1a8338817f767c1b78ccc4cf2164cbd9e95107b3cc
        • MD5 SHA1 SHA512 TLSH

        tomorrow.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\tomorrow.json
        • Size 1KB
        • SHA256 cd15d19fb6edca2f3e95e7120bb1ef1a43ee26d26b9a2350b263429052cb1d93
        • MD5 SHA1 SHA512 TLSH

        visualstudio.json

        • Path C:\Program Files\OpenSCAD\color-schemes\editor\visualstudio.json
        • Size 1KB
        • SHA256 a3a62f67198ab876e1de290d29b243881d7a40e4cb4de6ae74fc4eb06a73fe1f
        • MD5 SHA1 SHA512 TLSH

        beforedawn.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\beforedawn.json
        • Size 562B
        • SHA256 59f7ee1ac0c1a3c9ef3382f98d8d3cfd418f1a34305ced8d5b5ae2c69f01fc0f
        • MD5 SHA1 SHA512 TLSH

        deepocean.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\deepocean.json
        • Size 561B
        • SHA256 d93aaa85ff402bc2bc706c9493746d5103178fbdc46a89782cd0c06f624d8b44
        • MD5 SHA1 SHA512 TLSH

        metallic.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\metallic.json
        • Size 560B
        • SHA256 86d017122ddc1d962e8c5b9c5b47eb3cd83319e75942845242467d5bcdc4e7c0
        • MD5 SHA1 SHA512 TLSH

        monotone.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\monotone.json
        • Size 653B
        • SHA256 12a4fb3bc19d4b05f1480d139c14253d1fb7335b57cdb84a771ec2642d3665bd
        • MD5 SHA1 SHA512 TLSH

        nature.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\nature.json
        • Size 558B
        • SHA256 d95f4662cf062b4482fc7cb217743f0c6edcd4127ca07f45cb545037c261a0a3
        • MD5 SHA1 SHA512 TLSH

        solarized.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\solarized.json
        • Size 561B
        • SHA256 24263003aa27946d5972d895858d6dd5d12153e31c69c6caf57579aba4a5610f
        • MD5 SHA1 SHA512 TLSH

        starnight.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\starnight.json
        • Size 561B
        • SHA256 158c517695b109cd16661f1592eb81191bf7835db9ad739d2f3577e6c56d4c9c
        • MD5 SHA1 SHA512 TLSH

        sunset.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\sunset.json
        • Size 558B
        • SHA256 69c1ab1420b541973aa244a24c85baa39727c1cf9a8508a844ecc042ac82ae62
        • MD5 SHA1 SHA512 TLSH

        tomorrow-night.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\tomorrow-night.json
        • Size 566B
        • SHA256 2b3d53b1556f7e2ae28c67ca0cd27ce6352df2770ffc1165b08f845f76e2891a
        • MD5 SHA1 SHA512 TLSH

        tomorrow.json

        • Path C:\Program Files\OpenSCAD\color-schemes\render\tomorrow.json
        • Size 560B
        • SHA256 0da19cebd21f1f41f8f4b30f0cd342cb15bf5b096b92a9a4208b46e7057b314a
        • MD5 SHA1 SHA512 TLSH

        examples.json

        • Path C:\Program Files\OpenSCAD\examples\examples.json
        • Size 1KB
        • SHA256 10b43ddbf09ebddbf0aaae4e4f4436365394e80565f840aa4d1d0f5895232ce9
        • MD5 SHA1 SHA512 TLSH

        openscad.exe

        • Path C:\Program Files\OpenSCAD\openscad.exe
        • Size 41.9MB
        • SHA256 c6b741fc0907e4d571b8a91097a1a5e1e426f5c422385c77b788ebca76e369d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        difference.json

        • Path C:\Program Files\OpenSCAD\templates\difference.json
        • Size 93B
        • SHA256 450162963efbc9624d8ff9aa596cd0691e4250e458ef04320c4fe60c3c6d8ba9
        • MD5 SHA1 SHA512 TLSH

        for.json

        • Path C:\Program Files\OpenSCAD\templates\for.json
        • Size 71B
        • SHA256 98ad6961d85bacf6e03beb2ad2572394b38007a3d2af2be7da0e1ccf6dd1edc9
        • MD5 SHA1 SHA512 TLSH

        function.json

        • Path C:\Program Files\OpenSCAD\templates\function.json
        • Size 68B
        • SHA256 f46b4d42d5f0c5c9d7a7d6ff4327761bb9232ee375ead614c956db315fcfce29
        • MD5 SHA1 SHA512 TLSH

        module.json

        • Path C:\Program Files\OpenSCAD\templates\module.json
        • Size 66B
        • SHA256 0c1845cb7dbc241c9f8d926e85437a69497da8ca3da656425aa8af24e97e3868
        • MD5 SHA1 SHA512 TLSH

        rotate.json

        • Path C:\Program Files\OpenSCAD\templates\rotate.json
        • Size 58B
        • SHA256 f314634ccc884832c188a0f1162d73e9956fbf60929511013bdd04ee75253cdf
        • MD5 SHA1 SHA512 TLSH

        translate.json

        • Path C:\Program Files\OpenSCAD\templates\translate.json
        • Size 64B
        • SHA256 bfdb3e48f905a1f3689b721e9aa04b15b8ebb4f3756c0663596ebd2e77567422
        • MD5 SHA1 SHA512 TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsdC000.tmp\System.dll
        • Size 23KB
        • SHA256 4177e765eed3bba3794cd21b50779c097e8a943bc92c3621f2f51a85cef46def
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2008-211-0x0000000000400000-0x0000000002E0F000-memory.dmp

        memory/2008-228-0x0000000000400000-0x0000000002E0F000-memory.dmp

        memory/2008-227-0x0000000000400000-0x0000000002E0F000-memory.dmp

        memory/2008-226-0x0000000000400000-0x0000000002E0F000-memory.dmp

        memory/2008-209-0x0000000000400000-0x0000000002E0F000-memory.dmp

        memory/2320-192-0x0000000000400000-0x0000000000444000-memory.dmp

        memory/2320-0-0x0000000000438000-0x0000000000439000-memory.dmp

        memory/2320-6-0x0000000000400000-0x0000000000444000-memory.dmp

        memory/2320-196-0x0000000000400000-0x0000000000444000-memory.dmp

        memory/2320-194-0x0000000000400000-0x0000000000444000-memory.dmp

        memory/2320-193-0x000000006E5C0000-0x000000006E5CD000-memory.dmp