c24889946003338e4eea7d1a04c3799fbe1afa0b2c937a25d77ebd5e4325dccd

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/11/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Imageprocessor/BuildStudio.bat
Size 1KB
Sample261104-3yrtfset3t
SHA256 c24889946003338e4eea7d1a04c3799fbe1afa0b2c937a25d77ebd5e4325dccd
MD5 3ce1a06ceda4f9ff5d1f494a20d2dd09
SHA1 709300e57a7f4b871a8629d2d3bfc50442a03d1e
SHA512 a1a0d4dcb37bc7fb497110306ec1a80b568fc301067019c82930693a5c52d33489df1dd922e86dc18d190e6e9e471ea38eefee66b9e62c08bd516a1f834256d5
TLSH
T176211F9C521E9960D0BD50D17520625BFA8B80972A138F2C7001F41AEFB0B80C9FAB95
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2144	ImageProcessor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1536	taskkill.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	ImageProcessor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	ImageProcessor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	ImageProcessor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ImageProcessor.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ImageProcessor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	ImageProcessor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ImageProcessor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	ImageProcessor.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2144	ImageProcessor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1536	4656	cmd.exe	84
PID 4656 wrote to memory of 3976	4656	cmd.exe	86
PID 3976 wrote to memory of 1932	3976	csc.exe	88
PID 4656 wrote to memory of 2144	4656	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Imageprocessor\BuildStudio.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\taskkill.exe
  taskkill /f /im ImageProcessor.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:winexe /r:System.Windows.Forms.dll /r:System.Drawing.dll /r:System.dll /out:"C:\Users\Admin\AppData\Local\Temp\Imageprocessor\ImageProcessor.exe" "C:\Users\Admin\AppData\Local\Temp\Imageprocessor\ImageProcessor.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCF0.tmp" "c:\Users\Admin\AppData\Local\Temp\Imageprocessor\CSCA7BC31282B4143CBB5539C72BA4624D.TMP"
    3⤵
    PID:1932
- C:\Users\Admin\AppData\Local\Temp\Imageprocessor\ImageProcessor.exe
  "C:\Users\Admin\AppData\Local\Temp\Imageprocessor\ImageProcessor.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ImageProcessor.exe

Path C:\Users\Admin\AppData\Local\Temp\Imageprocessor\ImageProcessor.exe
Size 8KB
SHA256 599a075aa01bca5ac527125d0dc2a9fc39a307ba6c41b28f588ca887aab60590
MD5 7a0886e74cb2be8d9ed1a64a30ba3cbe
SHA1 fb03622dac70a39ea276ea8fd323c8c2789bc0c5
SHA512 bfca7e61df836eeb5e4c129f1e69922c204989d8e8ac4fc0fee9dd3d4446475269f31149d0f8fc1b2d8061db87a7bbc3fb2ebaae55bfc0cdc8fdba45e2b7314a
SSDEEP 192:Iv2bfR/49fQ3QhZXd2WeBLt5EUp9wb62OIc:ISg9fisZXdg5EUpeu2OI
TLSH
T1AF02A602A3F8CA1BE8FE577529F3531153B5B29246A3DB8F2D8921DE9F2171485123D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCCF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCCF0.tmp
Size 1KB
SHA256 fd28b511098a792a353d6652017264e83bc2d8470c89921bf68e8fa92a2e1186
MD5 2e0d07c9c542813097c0e68d0546312e
SHA1 f018ca402428e38c782c1257e81750e9057fd025
SHA512 ee336e2cc9d4d62e4c26f123d6ab0402d08476bac7f9ebe157bf644243faa7ed1a690baa2a7a28963a2a50a914ab162a6b5cf50a4b02a30f9e3f911911d7888f
TLSH
T109414140D3E84B1EF172473128F65716A6B8BE55AF5A476EB184523E1F12780CE837B2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA7BC31282B4143CBB5539C72BA4624D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\Imageprocessor\CSCA7BC31282B4143CBB5539C72BA4624D.TMP
Size 1KB
SHA256 bfbeeec8eb8bcae071db4f15c8babaf8faaf10a21d34b39055c6419fafd50467
MD5 8ac3816b0237aed280ee6fb821264310
SHA1 aff06922eab5947bc42b56f5bf3d02a1298341f0
SHA512 b438aa1db375cee7375d93b546b87056ae755200c998778c57642414862a666ec413e801ff23b20ba9de0b83a8523b8d151657a23e09765075fc3e12e91501ec
TLSH
T1DE21EF40A3F8421EF2B34B3039F6836291B8BE129D7A43EC3488175F1F25540C5937B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2144-9-0x00000000005B0000-0x00000000005B8000-memory.dmp

Download

memory/2144-10-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Download

memory/2144-11-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Download

memory/2144-12-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Download

memory/2144-13-0x000000001F950000-0x000000001FAFE000-memory.dmp

Download

memory/2144-14-0x000000001FB10000-0x000000001FBA5000-memory.dmp

Download

memory/2144-15-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Download

memory/2144-17-0x000000001FB10000-0x000000001FBA5000-memory.dmp

Download

memory/2144-16-0x000000001F950000-0x000000001FAFE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads