f81e453f86a90d7f2528946d9fb9409f82c46cac5b3fb687d43edcff52b3ed0b

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kid Pix 4/Data/Players/SwFlsh32.exe
Size 144KB
Sample260415-ythb1abz7v
SHA256 f81e453f86a90d7f2528946d9fb9409f82c46cac5b3fb687d43edcff52b3ed0b
MD5 62b49f75ac78ddf6e76786cad3e21005
SHA1 b209971699c631e67ad57fbeb7da30effa9c9ba2
SHA512 7ec42327f422ad3fd31b48c2468b8e7b6d2f7d561e15a2d4bea946df386c444ad27f5259ae953c5274185010a1a7695c52c09da8512d5f284973b1b463e221c3
SSDEEP 3072:+rwugfGLbjXtDMv6XoOBbZa+L3WqX9qxawBKzuwvW8z1e0I:MbJ4vuHa+LLqM
TLSH
T114E38D3271A04079E0B343719D5BAFA43B797F2247349ADB5B903D2A2F31946DD223A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwFlsh32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command	SwFlsh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	SwFlsh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kid Pix 4\\Data\\Players\\SwFlsh32.exe %1"	SwFlsh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon	SwFlsh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	SwFlsh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell	SwFlsh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open	SwFlsh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kid Pix 4\\Data\\Players\\SwFlsh32.exe,1"	SwFlsh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash"	SwFlsh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl	SwFlsh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	SwFlsh32.exe

C:\Users\Admin\AppData\Local\Temp\Kid Pix 4\Data\Players\SwFlsh32.exe
"C:\Users\Admin\AppData\Local\Temp\Kid Pix 4\Data\Players\SwFlsh32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-0-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/2120-1-0x00000000009A0000-0x0000000000A7F000-memory.dmp