Analysis
- user interaction
yes - max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
255.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
255.svg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
268.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 255.svg
- Size 321B
- Sample261024-cy6pha11cx
- SHA256 6b1a46e7fe504109ff49719e517d1e538ad26e264b7fce8512c3011a0b0a5391
- MD5 26560ba8bed4033362c761e09b945e1a
- SHA1 9d545f39a5d50ba6a821d9dd5c5743a55551743d
- SHA512 830f5e0b19b5f2ae5ea1664fe7265117e93df655a71969c9cae3d191a4c7e945e4b837f2f6b5d668f926d36c7c1d74f7b6d98a8767e406fa8102a5fbd7799364
- TLSH T140E0262A8F5D803DE618C600E3F87556C2AAB086B1C810ACDDDD3478B1195A5E11339C
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286111" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102cf6226863dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a1ff226863dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff13000000d5000000990400003a030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6bfff05030eec4a8a71250cdb1ec980000000000200000000001066000000010000200000007ab4eb755eea2bc0f174f8a5a46611ae947b4bcff74310f7b14d287a33b44c33000000000e8000000002000020000000dc31e291817111d653211e15fe565abeeeac4c2dba02fc21195757d2373f58b12000000024870ce5d886832553d6592553c49910e13a0b3147cad0d0e413af0227fdcace400000000f555b7c6ec64c41dcbe09a5284614fdb4a2006464d57034df529ebadba6e49518dc599251bced0526dab545625b7b7d838b2afcba066821518586aaa958ee51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3228923660" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6bfff05030eec4a8a71250cdb1ec98000000000020000000000106600000001000020000000434f3e8046959c1377c38e14a30bf60bebd8c7e66a869f7c1d05a247bab363d7000000000e8000000002000020000000aa90820c392bc5d89a97f2bd2ac66d4f5e6fc71f31c30bcdf804550511b2eeb420000000132ef4e3f79152fc7f7f58ad5e50f46ddc4b5e314837a5ad60703153b20de7a640000000ac7caf38ced916369968745d7eaf7d5ca871e05f2f2c35cbb5bc9867a553872b49765fbd61475ae00c2f9f49ad8cd0bd09b492855635834e20766280ca69d92f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EBEFEFA2-CF52-11F1-8D83-7AAFC66160C5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4564 iexplore.exe 4036 IEXPLORE.EXE 4036 IEXPLORE.EXE 4564 iexplore.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4036 IEXPLORE.EXE 4036 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4564 iexplore.exe 4564 iexplore.exe 4036 IEXPLORE.EXE 4036 IEXPLORE.EXE 4036 IEXPLORE.EXE 4036 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4564 wrote to memory of 4036 4564 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\255.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4564 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4036
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\~DF87CC916FE7EA9A76.TMP
- Size 16KB
- SHA256 a3ec8754d1131e7e3f9e35a5ea52257b5cae7686f3f4355da048ac16f4a30e98
- MD5 9ffcf967410609eab508f254e7ca6aa2
- SHA1 061671a355104728137c16cdec077b7312545f36
- SHA512 11d215e25afe2eb70c54c54c6b4e3125382c842324889ffc15e1b9f0e333c04473e9a8eed6fbda0c09478693811ef46efe97a16d08209ef00496b98afd6b6973
- SSDEEP 3:alFXEAUolllfltE3lX9/Dl/Oly3lgHl0llftRslkhlEkllM+lylhllAlFJejl+lE:a/vllsngF0/AlkxFIBGKjEW1
- TLSH T115724C1A82410A15CB66527385D507E83233F55537C64752573455792C013D1A704565
- MD5 SHA1 SHA512 SSDEEP TLSH