74d300478ecf9baed1bacf37102a638c192f402e32e8ecf1aed50184b833d929

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tailscale-setup-1.104.4.exe
Size 1.3MB
Sample261029-w36d3sft5k
SHA256 74d300478ecf9baed1bacf37102a638c192f402e32e8ecf1aed50184b833d929
MD5 d164994234f13f828ed4c66b73c67d27
SHA1 29ec529b3114e4d3cb1d544923a7c6adf97b3d69
SHA512 a873118e661d1c1c0804ee605559b2b589e6cc9c7cc3b79d8adc81a0e4f7c6006fc393c090eebd48be3c47be67fa7bb21846530754250720bec98c3d65f0334e
SSDEEP 24576:eeoj/BTdRjCHLLfAEVGREU4uWWcf4EOAOv5trp:QfRELrbGuEWN4EOAc
TLSH
T169555B3165A55027E7F50533F910E330FE29F60C1B5889AAD6C4AC5C39789E96FFB20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
5764	wixstdba.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tailscale-setup-1.104.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 5764	1216	tailscale-setup-1.104.4.exe	89

C:\Users\Admin\AppData\Local\Temp\tailscale-setup-1.104.4.exe
"C:\Users\Admin\AppData\Local\Temp\tailscale-setup-1.104.4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\TEMP\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{D305B008-5611-4B82-AFA9-DCFADDAE73D4} {5390C180-A59D-4173-A934-D89904867AB5}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\BootstrapperApplicationData.xml
Size 6KB
SHA256 b75d18e25f816a0f5c27fd54320630c29aba62749203e00fc9b9d54777916f1f
MD5 2210a65f9d8ad0d37bd32dba899206d1
SHA1 680a09a8cf814978a65a1a4d31680531f35b6fe3
SHA512 9850c15e3154dcca62ebe18b599552adb8e24ba98fef0c320f8dcbcb6302d4a83769abbe5ab60923c0d7b3bbc67079ab183d552a30d6c7f623e26acc9e2a6fd4
SSDEEP 192:zv0WDaoZ6Fvo4PoZWvClejo7jssFjRsbjrsgsRsLU:dd0qbesRs4
TLSH
T19CD1B3516BFD1219F0F35E88FEFA65125A76BC522E38CD2D01151D0E4972E81C8B2FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\TEMP\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\logo.png
Size 3KB
SHA256 db6bba454a48ddfe440727a8fdfe0fd777bc95d0e8f597ff56f6f886bce76ca0
MD5 0005bdf4d4008128def29442c0de88c0
SHA1 94c5486fdf093c069bbdf65291f1ef8db8bc80d7
SHA512 be739646e95b385c3b99eeeb7f84ad2e56b46056e9b816f33a5da3e9711fc3cfaa4ce023331010df0f696ae5209bff62a3923fbc9d8b21259dc446c7285e9849
TLSH
T117816CBC0613A14FEB3607759B03979390217A1BB4019839E4C9EC7F369EC6C45802B5
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\thm.wxl
Size 5KB
SHA256 3a4fbb839544c4b4e80827fcb3aa91648bb73a1e84359f207264ec4bd468ee4f
MD5 f65abbbe0c427fb3bf79b893f02e5ad9
SHA1 f050535eb2f52e609afcd790d7dd884aee55e938
SHA512 d28cd76a0045a44f99f20d49d78a499f78fd1c055992c07c7837650c6a0b4457a682e7d91e57b7e1175a1e1f706f7007176911f1130de6482541b207e2b21982
SSDEEP 96:HL/vK0c0vMcivL5MQP1+XS/cEOYJA0SCwZQipCeyAC:rHEbdYuwYK0r
TLSH
T1CFC1D36B58CFEFE02A736654B5F3988A3518C1D6432B2CF1F86A454B876710163B3753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\thm.xml
Size 9KB
SHA256 90466c5e24effb000bc7c38a5a8d8b5c65442d8d16afac5a9938480846e50477
MD5 2b1ec08eef7ecfbe7bc2b4250a59f144
SHA1 1b6f9630d77ec0b4e911b55064f90857dd446dfe
SHA512 2f263b4a0c0d3f88ee14db8ee9896774fee43b651053e0620bfead1de579fda6021ab38cceb7f2d7b9073691c8568f1834a484f578fa414d1826cedf62ad750a
SSDEEP 96:8Lap45zHMLlh4HsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeTFpws4xM:hg4OB7UpyQP
TLSH
T14D12DBB546DDBC01C233E75267E325C2BF226972C1C46949B84E26BB0FF211079BB26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{C57FDC1A-3156-4D83-98F4-BEBD319DED4A}\.ba\wixstdba.exe
Size 426KB
SHA256 b09a838f5b1807af96937bbb46491bf8e129ede9d838bd3945f3d82ff85c791a
MD5 773ccb94ec7db9f315a6adec1f2a55ff
SHA1 8b643533a4b289262e090448caab2ab8e4a5c8f9
SHA512 97a13cddacae354345ad6a8eea9ed3bd71c8bb919a0eff7478b2be288213ab598eff48aff2726b25783ef42d68ca71f4b2240475c0b91938a2759eabc5646a3b
SSDEEP 6144:8y0PCf6d1hUucQJRj41loBIAsowmQ6BIxLf9xlJfoKr3HKUtrCiX:321DcCRj41l7o3Qtf9x/Jr9trD
TLSH
T1AE942C3164F44023DBF64572FD15FA31AF2AF208271095AB93C0DD293968ADA6BF7247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads