3a74f69b838484e036e7fe64ebaf2ecce077d7d3e6b2449a20a92350a18e6fe6

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/03/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
Size 1.8MB
Sample260320-gr5abaay8k
SHA256 3a74f69b838484e036e7fe64ebaf2ecce077d7d3e6b2449a20a92350a18e6fe6
MD5 2d0ceabc9e8e215dc7cb2f1098f3fdce
SHA1 0a02c32be66dcf038993e53c6b115827bb122e7f
SHA512 594850e805af085c7747e39a4b4e4d2b97e3b5c881d701962718e0a7ffea1088b9657bb51b10cf80bd3fa52bcdb23fd86857dd3b9ae29b7d59abdb813264200c
SSDEEP 24576:xCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrnoqAas1cNUtwLID0Lpu8XcWJ8Y9iva:21H4jR2TYrQbDTrnoyO4FcmZMlp
TLSH
T10285CF0573E442EDFEABE1768A13C507C7B17C450677861F06A0AA766F33B716A2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe

Executes dropped EXE 1 IoCs

pid	Process
3508	InformationCheck.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InformationCheck.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3508	8	OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe	86

C:\Users\Admin\AppData\Local\Temp\OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\InformationCheck.exe
  "C:\Users\Admin\AppData\Local\Temp\InformationCheck.exe" "C:\Users\Admin\AppData\Local\Temp\Details.html"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Details.html

Path C:\Users\Admin\AppData\Local\Temp\Details.html
Size 11KB
SHA256 292847f649efd46a46e281249e46225fea0e614c43c225945654020ebaa432a5
MD5 1bd985ac4bea481f0312348ce7b7ffbf
SHA1 eb690b965192089b433bbd7c369587cd08f139ec
SHA512 feb431030722ff68f6cd230d664982ebe953a53ad884b1064b83c9d5f53467c77e71a380273c84bbca3a2364649d980203098a444f93adcd6327479dff964fd9
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz6KpET3rdbTFgtrOO:sXX+/DV7k/36KpQ3pbTFgH
TLSH
T12932084CAE9161B0F71387EEB7AF291A032475932404C940F74DADE0BF0A68D95C3B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InformationCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\InformationCheck.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
TLSH
T1C0157C1373E18022FFABA1739B5EF31646BC6D290323A52F139C1E79A970171166E772
MD5 SHA1 SHA512 SSDEEP TLSH