3b9223e571c4724e8ccf42c3c72df15a83c5ca6936ae88cff8b2286dac466836

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Latitude-Engine-Setup-1.17.0.exe
Size 299KB
Sample261107-25pr1awsbs
SHA256 3b9223e571c4724e8ccf42c3c72df15a83c5ca6936ae88cff8b2286dac466836
MD5 18b00f15e67e61c8cbb22bb5f801f60a
SHA1 13d0a3994116a417d6c291566668c4bdf6de44af
SHA512 066fd5eda2603873e5ef53140a304a7b8ac8dfc35ced65ce28ad688f18157f1ba7e92335148bb958f475e9f6fdf3a3c5dc411c579189b4d2e8a00df58c235f5d
SSDEEP 6144:tlnhrwtzVYR0ZJvywE0AlJualTfiYTM0tsfg8C5GrwqdRGl:tln2VYyZJb7cY0tv8C5Grwuq
TLSH
T15964128063E1C8A3EA534F76DEF2A687BD3AD6210894270F335093D87D42781ED1DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1708	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\PCAP\PCAPColorEngine.aex	Latitude-Engine-Setup-1.17.0.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\PCAP\Uninstall Latitude Engine.exe	Latitude-Engine-Setup-1.17.0.exe

Loads dropped DLL 2 IoCs

pid	Process
1588	Latitude-Engine-Setup-1.17.0.exe
1588	Latitude-Engine-Setup-1.17.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Latitude-Engine-Setup-1.17.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	tasklist.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 3520	1588	Latitude-Engine-Setup-1.17.0.exe	86
PID 3520 wrote to memory of 1708	3520	cmd.exe	88
PID 3520 wrote to memory of 4088	3520	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Latitude-Engine-Setup-1.17.0.exe
"C:\Users\Admin\AppData\Local\Temp\Latitude-Engine-Setup-1.17.0.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "IMAGENAME eq Adobe Premiere Pro.exe" /NH | find /I "Adobe Premiere Pro.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Adobe Premiere Pro.exe" /NH
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- - C:\Windows\SysWOW64\find.exe
    find /I "Adobe Premiere Pro.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7193.tmp\System.dll
Size 12KB
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7193.tmp\nsExec.dll
Size 7KB
SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
MD5 879b0aab93b11228a27d6b2e498b95be
SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
TLSH
T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
MD5 SHA1 SHA512 SSDEEP TLSH