ab672937ddc53624e59eacc42e830d2674b0d2e21e12df87e88581b7fd153156

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/04/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Core_Invoice_France_7477.hta
Size 137KB
Sample260407-2a1wsaez9s
SHA256 ab672937ddc53624e59eacc42e830d2674b0d2e21e12df87e88581b7fd153156
MD5 1d83f9818d438ab781224aef75eaaec3
SHA1 d53a224a0231f28599634a89cb4cf82a14a23213
SHA512 373dbadbb7e0e9c4f51405839f2e8570d5014331832a4916f06221dc5390cdc2392fe83d6e662f3999582a96a24337e133a9176d45e3bd51663c9b8ece4f68c4
SSDEEP 768:ME8WEoeMxhtxk85goneU0/3RAN5Br8DOVTeDNDka5hrY+PHnwOJOQT1e/rsZ06LD:ME8WE0x+5JfrRwOgQT1ejKMgHYK
TLSH
T15CD3DF889A4F57E49B432C30C11B5407D7B859233607DE90F76F8D917F0A8AD4ABF9A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1528	mshta.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Core_Invoice_France_7477.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-0-0x0000000001880000-0x0000000001A2C000-memory.dmp

Download