28408f9f79c5f9fd8c7d6101fc30073ec5a0378bdcd76f680328113a2920fe0a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Regshot-x86-ANSI.exe
Size 116KB
Sample260424-kyaaases7p
SHA256 28408f9f79c5f9fd8c7d6101fc30073ec5a0378bdcd76f680328113a2920fe0a
MD5 aee0d0bc1a728f52b5c7a96087cb50b4
SHA1 1a8254af73ff1fe4b334e6339ed08f00b1398380
SHA512 02cad25b66a2d5eb4b9a6da66b158205965efb4cabb6cd7c6be4794b37f8bf05337882903704e14fcffd58c46270a05e8741e6884e4065f587cf79dd4d87f3b2
SSDEEP 1536:IfYz90xb97Us+tTiqPPZQL//k4npn4qlue4ojQTFVBD18vQLYpudZ3q9:IfYGjUs+t/BG9jQTovFAZU
TLSH
T1EFC38D50B2C1C036D051333911E5EFB2D73BE93647A995CB776816EA8E112E19E3A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Regshot-x86-ANSI.exe

C:\Users\Admin\AppData\Local\Temp\Regshot-x86-ANSI.exe
"C:\Users\Admin\AppData\Local\Temp\Regshot-x86-ANSI.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5612-0-0x0000000000840000-0x00000000008C7000-memory.dmp

Download