Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/04/2026, 15:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe
- Size 902KB
- Sample260426-syhknshy21
- SHA256 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231
- MD5 881da56f385ffc35ebb81d44a66aa8f4
- SHA1 389508fdc5ec04124b6876297ac808fae541dd77
- SHA512 0c31f0835c58de32dc8fa650539cadb37a2218e7b377b83d8f2064928a030593d181b18c11816324ac2314040f4335d467c14e112e1fb0c90584b04309961137
- SSDEEP 24576:zAHnh+eWsN3skA4RV1Hom2KXMmHa5bafjr5:+h+ZkldoPK8Ya5+h
- TLSH T19D158B02B3D6D036FFAB92739B6AB20156BC79250133852F13981DB9BD701B1277E663
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe 4964 0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe"C:\Users\Admin\AppData\Local\Temp\0f1463bcbaaecc1f7302e6dab4f68856daa17fca2e07a6adecd2754b229a7231.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
- Size 285B
- SHA256 3cf754ff98f73e21aceb66f566e0858c555d82d27aefa863d51131eadbaccd63
- MD5 af70c1ce9732d2e7b0c5a2e3a474abb5
- SHA1 d64b9f9807c9d8072ef38cb35dfecc83b72d7e8d
- SHA512 1f4f596b42117ca904397376130c95014f2b97cf69be62b6f6e10a1146402e2053643b2b3a7d58e928ba5e62c7fb2d842da32165968d04e5a33d77421d690451
- TLSH T1C4D0EB9009102881A065E188EC971FC0F11FA08A408151A2FB204AED29AC52C47DC107
- MD5 SHA1 SHA512 TLSH