Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 19:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IME_Switcher.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
IME_Switcher.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target IME_Switcher.exe
- Size 3.0MB
- Sample261107-yj2b5aey2x
- SHA256 3e597387ed5af9f9fd39604c8b0827f6251e1a2eda83e756a73e65980eb6391e
- MD5 9a2c288192c3285b3ec1704c87989bea
- SHA1 9e81518eed123dddd3a69e4f4115075942f7bf71
- SHA512 1e5513d15aa6d8eb106aaae34238020b8d5e65f55f4b2d708a76449e7f009328c8ef26fa79f1d14353e375795b2caa4b847a8e94b2b44b1903fca7782f5808a6
- SSDEEP 49152:UziOubzfSxc06VGmttWtA7H2ahAOeC5SV2v1bdma5CzP2y1e:XVGm6Aizdl
- TLSH T105E58D06E3E941A5D427DB34CA659332D6707C569731D24F0A98FA1A3F33EA08B3B725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5600 IME_Switcher.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5600 IME_Switcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5600 IME_Switcher.exe 5600 IME_Switcher.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\run.log
- Size 169B
- SHA256 9209cd8343d9168bd5b4e2cfee63eecd08e4723d8bc1488a74d7148591182861
- MD5 b5ee63becd058311ebeff604c2aec41f
- SHA1 93aad596717b876f173fba528abec5c5109eeaed
- SHA512 2300071ff88043ae8b9cfa9eb953b5af9a65fbfeaebbef1a281d0f6b4b5d1d9b0635121da1c74e711ecf66ac375645fccdc752583024d6717dd706298690374b
- TLSH T145C08092C8600454C34466F2537DD09691E0CC0CD58449E54C35677ED41D73517C4735
- MD5 SHA1 SHA512 TLSH