16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0.exe
Size 513KB
Sample261109-kcktxabs41
SHA256 16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0
MD5 e1fea067150ff919e5f01125044bddd0
SHA1 8c52a5a729c71b55cedef5d86e2e1fc1b732c4c7
SHA512 13a85ce824fcd51b67dcb38ce751c46fa887c7f5c7b881a97bd186fb16117841cb6c66872f9737083dbc00999c9748d166a82ebb0bc35dd554144a57a757482c
SSDEEP 12288:5miMZvN43+u85Bpw+YMRkc9LpEAmDGv6qt/:MnvS+55BpfRX9LpTvxJ
TLSH
T145B47B59E7A508F8E0A3E6B4CD534912E7727C4D47A1E68F03A479672F333909D3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	mspaint.exe
1896	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1896	mspaint.exe
1896	mspaint.exe
1896	mspaint.exe
1896	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 52 wrote to memory of 1896	52	16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0.exe	89

C:\Users\Admin\AppData\Local\Temp\16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0.exe
"C:\Users\Admin\AppData\Local\Temp\16004e12202be880187c7aadb8bd07fc117f6bbba5a36b892ab962244d8bfeb0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:52
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\orderpdf.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

orderpdf.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\orderpdf.jpg
Size 5KB
SHA256 99eefbc25a6783b5a45651c7108852cd680d5836a177fc5551d6a7ec1c6075d8
MD5 a8739dc602917f788a1bbd5c6d00813d
SHA1 c8a96e2c825fbfab0fd3d7ba96b68e4c9158c6d9
SHA512 29fcdca28c091d5273dbb5291364858d124eccc03bf34b570e8a112282ffed5ffdcab4c44457f573fa2c119cda5d414f400c2d386cc9dce33351687f45a08fbd
SSDEEP 96:Ry/tHu5u6bhKZIaf6ao8i/SRgqNqnv6XMHFDCbuDEpyuGCmcXy4PUaFwTT4:RyVHWFKZ1fx3KFDCb8EpyOmciYUXTT4
TLSH
T139B16B19141D09ABDCB953B509ABCB629B88A3CAE81DC767CF2841CB4993454ACBD3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download