Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/04/2026, 22:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe
- Size 946KB
- Sample260427-2g543set2q
- SHA256 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10
- MD5 b766d3980ca0b94102683723bb2e0eb2
- SHA1 c7f1f08f3107fb40724eafe6fe3fdeb0e8390b9a
- SHA512 6c03d1a511f9784fce1ba8156d1951a9cd4294b0f511322299546b698010675e6ce1e92d6f18546cc2da9764170f72be3e7bb4bd322f2f27f49d965008490571
- SSDEEP 24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaZwuOPH5:Vh+ZkldoPK8YaZEB
- TLSH T116258C02B3D5D036FFAB92739B6AF20256BD79250123852F13981DB9BD701B1277E263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe 4952 3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe"C:\Users\Admin\AppData\Local\Temp\3bd96dd7305e0f01e426ef52b567fd955b41ab801d04beb507be5a6837818e10.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
- Size 345B
- SHA256 48b0098fb8d9305b751bc9f6facdc02f2c62597fceeafec390356788d777b135
- MD5 4cbbdd739e2e4a7fb05177e2cf94bb06
- SHA1 e2e1efede55bb9236e04b0a33e6f90c2855b71da
- SHA512 6157f0fdf2b3ef3eeb72be3a6018bd943e6ddd603761db7d33a2bac465186ad260c6b90bf50bffc4e4976b057689fc4fd924b3964a4ffd01fa55c0899c15ab1d
- TLSH T1FAE02DC00E102882F076F4ACE8971BC0E0AAB04A488140B6FF2886DE5EAD42C12E8A03
- MD5 SHA1 SHA512 TLSH