4fffc35674f95beb4ead58154ef1d3371c131d3ed904902aa6cac83db0f364d1

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReceptorDesktop.exe
Size 36KB
Sample261102-3vgjbaf13k
SHA256 4fffc35674f95beb4ead58154ef1d3371c131d3ed904902aa6cac83db0f364d1
MD5 e4c13e010cd9540cba5dd17fe862d675
SHA1 2c2e0434c07b42e7d7cfef861ad7c8dc11e9deb3
SHA512 8d6b9306c76f6f02629a577fdf82853a95e268982d1a929de0d909092d60953c6eb20e23cda16910de8a81a83fe96b2eb009deb3ef2f858cbd05bac6ce7cf2ee
SSDEEP 768:hqED9oQxa+z2xKmHDH5KWUMQkF9FpVHOiK9:hqQx5sjHoWUMQkXFpVHI9
TLSH
T1D8F2E90877E84A1BF5FFABB8647006044B75BDAA9932D78D0D85509E1CB3F80CE91B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ReceptorDesktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ReceptorDesktop.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Colors	ReceptorDesktop.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ReceptorDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	ReceptorDesktop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ReceptorDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ReceptorDesktop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ReceptorDesktop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ReceptorDesktop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	ReceptorDesktop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	ReceptorDesktop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	ReceptorDesktop.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe
2732	ReceptorDesktop.exe

C:\Users\Admin\AppData\Local\Temp\ReceptorDesktop.exe
"C:\Users\Admin\AppData\Local\Temp\ReceptorDesktop.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pairing-v2.dat.receive

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive
Size 278B
SHA256 8160ff1ac19a941c60d59b24082828626acdddcd6dd1bb367689ade51d5cbb7b
MD5 04107bc95d1ebd1699a572aa947e3bb8
SHA1 95ae2a68715f3238b917192ca73f9fba97fd9d61
SHA512 6071398a4ad867bc09ecdbc733dc551742be4cb476fc08f7a0112fae181df991613ede0b23c78a01540f45aef2335bdb6ef3d55fea9baac26c184ee9143a8d15
TLSH
T127D02B43504A58C3EA4F3BFC1D434A27527B9DB522720580D3002250A615B419259D63
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.21fd29ed33be4c87aaeb61e75d29770d.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.21fd29ed33be4c87aaeb61e75d29770d.tmp
Size 278B
SHA256 dd891fad0810e125b4f679a804ea4c93a3728527ed6bdc57c485632910c3b454
MD5 af089b806ae9894a77247bcbeb762a87
SHA1 93f3c682198d84da519f33e8a83dfed9af549d20
SHA512 225455e2c2aa41f3a51d8ae24fa12ca6788dac2c114ba22c4dc4e01a8292939cbd924e3ca4b4fd66e67364fe0d756359f8cebabcb96943ec32cd75e2a7f3c94f
TLSH
T1CAD0EBC8632212DAD0400338AFE78AAC22F531731263120A8A2E3C734426F42821A1A1
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.26253ca6537a4f49b097ae85a55a31ce.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.26253ca6537a4f49b097ae85a55a31ce.tmp
Size 278B
SHA256 b594567bf900d99413b46a5cf0b94958ce538e4b5d7881dedbb170a421c7bf33
MD5 586a97536593f5387c1e33096c6429bd
SHA1 e096190508a86f1e4d9da20ff5462ca658140029
SHA512 3abb91b74b5b2725ca27efd088dd5c6b1447a99a988844ea9e9f2c65de5a7845e46f8cd882f8b38033cead0984fc78b3dae5a9dae7555efca86823f6f95f7e7d
TLSH
T1F1D0EB121842B5E1D110363F228B9DA46296889CA2FBF33DA822883208C62100B00B5B
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.2f20a57558cc4f45bf19dad9e70dcc84.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.2f20a57558cc4f45bf19dad9e70dcc84.tmp
Size 278B
SHA256 86bfad3805ea8fc440e0457e0dee93582403eebb39505c25cdd640787b499242
MD5 42e6518de7baa66a96cf1dd59d3e7d51
SHA1 0c56fc5d373bcc53da5676ba6c501f2b8d30a89b
SHA512 dd08032381fbb3a59a4dc5db3617ecc157f6416261697db56b305d1acca35e87184d9106d5cfbaed8a03be4e1cbcc8f9beb5b79f550a626a056212a8a00b56e7
TLSH
T18CD0EB83A41842E6F0180338B04783284AB0A968A23651C41E2BA03CB37B3E70006666
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.71f65b7ff7cd4f7483328a410fb90322.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.71f65b7ff7cd4f7483328a410fb90322.tmp
Size 278B
SHA256 27c71fe3d488446b9eb7cf9476de409a7338cf2f8751e8c6bb7af76384726944
MD5 7e78c033c626c0d7f715329e46a40f5a
SHA1 ebc0a3a842485d0ca84969a98572df8573638985
SHA512 9a6ff16b2006a1e01ec0dadf364b0422db5836e95aba30d86a313c3f046b644090d1f88259c17c440af684c1111464e361433d4ab0d7b295b3c02e3aa145bfce
TLSH
T15AD0EBEB020400D1E60C23310C4B8C272373E8AD72725B1906D0062E309E297410EAC3
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.96643e8163c84ed5a70e32d35fd708a8.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.96643e8163c84ed5a70e32d35fd708a8.tmp
Size 278B
SHA256 e291b657a717071113a5e792792761187883f42ecbe7541b538996ba9dc8766d
MD5 44d24b2c8ca9f83fea6ed201009ae88c
SHA1 0c7c427dc651800e9df65ad563d62c7f337c681c
SHA512 f770ff99a437aca74564b942e7e6d7bd997622ab21a8aed44addeb763a096cfbcdb4ea77a48860babdc98769133ec27e6895a0f7d7c9f19a41653835fe214641
TLSH
T15CD02B90367B56D3DC1D67741A0F7E5C03E645BC31B3855F55195360D4257004003A63
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.be547872ed83423ba7a438b02c6d8947.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.be547872ed83423ba7a438b02c6d8947.tmp
Size 278B
SHA256 2139517f13fd77d314eed62df1449f257a4503df8e1fd991ef6c59abdbed7ce6
MD5 d00a5cc8301a62f57c9b4867f2d7e6ff
SHA1 f551803da01b9d0b8f65de7e27ccb6af2b80580d
SHA512 cc2734ee1d0739e4a17710dbd444d3a552036984f70e3203596d01216b41e5dd4eb330514feed86f31b891e06f0c011b7f03b8ec276a16993cbc1533cc813f77
TLSH
T100D02B66ACA7E0E3C926237D150B642421D60429CBB3C904546829527C6A2D78836B9A
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.dbe91a9b067a4fd2b0454689f8893166.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.dbe91a9b067a4fd2b0454689f8893166.tmp
Size 278B
SHA256 37220ec8f564eab3ac3ea127555d5b5a7166c100c0f7fcd16729a4c4c838786c
MD5 cbfd4d0a0a9f483bf3da1c2fb26aa4a7
SHA1 c36f12baffd59d5063c4274e04ce31d0fb8665a2
SHA512 43dae666ce73559b601a1dd44e7788de3cb1b23c9e575e04da9da991e4e2edef5abf403b69a434b18f565ac8f122ed68246a4a806ff95370702019a7e980e43b
TLSH
T1A2D095D875135DC6F450037C85579E4942F410DD27535180522D519BA50F3350EB9F73
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.dc2dee20888b47a39632fa514698e1a1.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.dc2dee20888b47a39632fa514698e1a1.tmp
Size 278B
SHA256 e43457555f76eaa6294a9989cb023c54b07f42629d6d0d8e84f481d9ad04271d
MD5 d1478834ee0d71a93be6b6f43c878a41
SHA1 26d4e5311f1b9e57f28c06a04169262e528736cf
SHA512 2619b665a8bf59401c703c37043ed41a58735c7b90eaa9f21f2058d0082f05da93e63006ebc0dd9cc5127566fc0a24b2a988eafb5f00ee6c6a51764ced4b1af6
TLSH
T100D02B85041640FBC1059372E46F592007E17CB493E2561451B8A0619B06B8528B519B
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.dc7962cf18254c17a5cd92edf1e0ece5.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.dc7962cf18254c17a5cd92edf1e0ece5.tmp
Size 278B
SHA256 a4d76d8a9fff8ed86097eff766e0cac3c258681afe17e7b5e5a90791b4efb5ee
MD5 1e62daaa31046978acd453216e8896f2
SHA1 231be59c7f83bc810b4793924f81c06cbbf4f86e
SHA512 3dadcb30610a8397d3ac31e249fec73675c83100aee9debe719770fc44982d1ef897772008a0853040a7451c088dbac34785193c587509e1a3d0480458770ab0
TLSH
T13BD02BA4291D10E2E4182376679B8CF48BB288B752B695A951220273841A9478A2B4A6
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.e4f9ffb47b864be6b4eb157653180311.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.e4f9ffb47b864be6b4eb157653180311.tmp
Size 278B
SHA256 7955e3fbfde91b9205620b2e9f5a067b6b26adb32c6759cdd8530d70e878511f
MD5 8eb99bc0dbc5ea0a74488a98f040baad
SHA1 e0bfc1d91f39a332778aabec06623c8da1363edc
SHA512 8bd409b62729cc74d057ea44415dc002983c585c59d04464faed677ef99ae8f5e8d5a7228ff5cf6271c834180b49933ca732f818d96dba526283ee73ca836e73
TLSH
T1FDD02BF30141B587D50A1770997AE87015D269BB26635620A272A12A97B6710CE14B57
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.ea34b8ca958c459083cfa289e65e3221.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.ea34b8ca958c459083cfa289e65e3221.tmp
Size 278B
SHA256 e78a89b0f0012551cd4ba9719d061c68af449ec6e89d55c58462aa2055035d95
MD5 e9e681243809ba9969c8791d576d335d
SHA1 f03bd3f104402205c1c78c1750486551141c7ba3
SHA512 6a3b21f8c526676ca94f265ffd1b1dc42e8ead3b8685c69e3f17969ccf476cf7d5de388e5f87e14fec2ffe5c98f88ddee9f5f7156486bb37bc2e5ce8b798bb4e
TLSH
T14CD0EBEE240B11E9F08A13703F427DC013F60A67B3B282E92EB445A9D0C3232178C683
MD5 SHA1 SHA512 TLSH

Submit Download

pairing-v2.dat.receive.fced44b7c484495880dee45040df0292.tmp

Path C:\Users\Admin\AppData\Local\Receptor\pairing-v2.dat.receive.fced44b7c484495880dee45040df0292.tmp
Size 278B
SHA256 07694ffd11162e7861803d67a43b9bddd516b096c535b95b09878c16f142a6d5
MD5 1f252a8ae5f07d60081b2cf446650a48
SHA1 c92768a1685e2da7c9daf39dc4e339449ae3cf23
SHA512 918e276ae5d7731a38638311fcfbbd7e361cebaa8b69609cb3730a5b6f9e3b4ed7cb870431cdd942ff62f154e62d6acaa87a723b4a5160c7ba51adc4db2e050d
TLSH
T14CD0EB10400AA0E2E908037CA48BEC0D0CF3E8FC733721D0EB7600858573747C23454B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2732-8-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-10-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-12-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-28-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-29-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-30-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-11-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-39-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-40-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-13-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-9-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-0-0x00007FFF1072F000-0x00007FFF10730000-memory.dmp

Download

memory/2732-7-0x000000001E5F0000-0x000000001E640000-memory.dmp

Download

memory/2732-6-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-5-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-4-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-3-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-2-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp

Download

memory/2732-1-0x0000000000470000-0x0000000000480000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads