4965cccdc73a8a8182aa70bf0387a86e3b6b215bb1db2118767c5da0821ed21f

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wooting.Background.Service_0.5.1_x64-setup.exe
Size 5.9MB
Sample261024-x1a1tswwfx
SHA256 4965cccdc73a8a8182aa70bf0387a86e3b6b215bb1db2118767c5da0821ed21f
MD5 58b210fad4571ab96cd6c3ac42d5d9b5
SHA1 1f8b8a9c486cc16b17dd951f1ca8fe4a51068da7
SHA512 9e3cc0e617589c32a612df0051697c2c35e7f663e0a5090b6fc6e20de2d8890162d1516052dcea2dcc137fce0dab6ea4922a53662aa3e30acb3c41bdfdb8942e
SSDEEP 98304:GPyhH3C450SMuGIcG+/EVkVue/golgMvW2XaSXWTvjEiNJ/QmfrBQnKS5:GWy4euKzcqgAZXaS2QsJVByKG
TLSH
T18D56339099B0DC26D2AB5DF88CBCE67C8532F8B3752CB12787D81985752B4CAD560B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 6 IoCs

pid	Process
3184	Wooting.Background.Service_0.5.1_x64-setup.exe
3184	Wooting.Background.Service_0.5.1_x64-setup.exe
3184	Wooting.Background.Service_0.5.1_x64-setup.exe
3184	Wooting.Background.Service_0.5.1_x64-setup.exe
3184	Wooting.Background.Service_0.5.1_x64-setup.exe
3184	Wooting.Background.Service_0.5.1_x64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wooting.Background.Service_0.5.1_x64-setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	Wooting.Background.Service_0.5.1_x64-setup.exe
3184	Wooting.Background.Service_0.5.1_x64-setup.exe

C:\Users\Admin\AppData\Local\Temp\Wooting.Background.Service_0.5.1_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Wooting.Background.Service_0.5.1_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6049.tmp\System.dll
Size 22KB
SHA256 4af4492118210b510271fafbd8a24affff9bbda04078aa6dfe986effb8c5476a
MD5 d33341fe75eff6b4667a2624d474ef9d
SHA1 84b12285434faca738116d69584dfb4017c2c51f
SHA512 d8d172dcf46315caca97ef0b89311d701cc3afcc96cffa696e49f027e49d0073b95c15c3e68831aaf50940d1dbda9e2abce6fad7fd0e4a02422f9e05c9e413f7
SSDEEP 384:l/Qlt7wiij/lMRv/9V4b4rlNyAmL4D6ki2NrA+LWlTiA2BSKUwT9:laeiijipN8Lz2NrA+s+3/
TLSH
T112A28F134B6048F3FB429D3460D8AE275FBEBA4626E444D3DBA781855E603C72EBD187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsh6049.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6049.tmp\nsDialogs.dll
Size 19KB
SHA256 88fe12b665c2bb5cae5fbba6e8fa0b89ffe1e0a58cd706fc0938e7d80c497c2a
MD5 40b5187402cbbe60f0143ad85b4d2eb2
SHA1 a0b12b84d91fb5f248eeb3e42c9fbe09267ddca5
SHA512 d4cf29b96befc5c3b16b5f30cecc7de127dbfbfbef94f3ac73a66ca767ee9c6e7c4efe5d75579ee05c6592ab29574d3c584b43c320d896e5b57af07b8cd592bf
SSDEEP 384:9A7k8985U30WAw0htIFcmNyAmL4D6ki2NrA+LWlTiA2NeKbR:mNi5U3/Aw0f1Lz2NrA+s+3NT
TLSH
T17E926D5394641873DB879A3A70D85A2FDEBD6342B1D05C82D227C6492A743E23F7C38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6049.tmp\nsis_tauri_utils.dll
Size 43KB
SHA256 cdb27369ca77d7ed080c23276f543a1a7319b095ffde1bab404e0b06db9d8fc5
MD5 16097772736a223277cb3e1b69ba16db
SHA1 a1a85619640a2cc645362239442e0bdba67195e4
SHA512 61a0c97f6d3be346f59bd50d3d335fb75adc6f9c837c9cd0f120a19169f70997edb0acc1e9027f54bd2a9e9c657fcc92857c7dfd87a3c7335e80020f3f8be31b
SSDEEP 768:J/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVGlLz2NrA+s+3JEs:RwODZzTrAV5Oevq4DtXHVGZh+Ks
TLSH
T1CB137B08FDC52E66E7CF09711488453F4A7FC9082750C9A7E3625E92C9A2332AFD925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wooting-bg-service.exe

Path C:\Users\Admin\AppData\Local\Wooting Background Service\wooting-bg-service.exe
Size 24.3MB
SHA256 87c33777d726b3f7f0866a81df536cc98f50de9c25fc6f8ea85ef568dedc4517
MD5 7557f3c9f8154d4123ff9816d719b159
SHA1 5bed5f0c913d838797236250ca343db00ee3f993
SHA512 b0516597c7521b70c201e31170feca66c88c6732dd8449fa2f46f9b6356a80c78bced4bcd2ab731b9ed2b1a8f04966a40bd0e2ac763f80ed3919da5cbbfa2e7a
SSDEEP 393216:jXYw0Q1An5F1R0czbS7rde1/M6FbUCC/4ASj8PkS:jXYw0Q1An5F1R0cvS7rdeZC/4JSkS
TLSH
T1554707247A5A9968D09BC47483478AB25A7130DB0B35B9FF44C496392F7EBF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download