7fa7e956d45119eb5910b67cfd4ece16d7e7c8ef40e176502cf791ec1e0880fe

Resubmissions

27/04/2026, 01:56

260427-cctg2sbs3s3

27/04/2026, 01:51

260427-b91f7abs2t3

Analysis

user interaction
yes
max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HeavenMS-localhost-WINDOW.exe
Size 9.5MB
Sample260427-b91f7abs2t
SHA256 7fa7e956d45119eb5910b67cfd4ece16d7e7c8ef40e176502cf791ec1e0880fe
MD5 5554c65b42acd0da3c382a38da109d2a
SHA1 ee82c10ae8653b64cb2c2286144b7930210963d3
SHA512 58879077bcc6144ec3e39551b59c117b2e664174b424eba11254caffd4ea99747b961ff671845787397368389efc36e73f08ab3f52400d0998f4dcad0a9b7366
SSDEEP 98304:vMeDRBamHwHrDtBLSdOstjwa2ge4z/R6yLgNDmkRNSoQBrkqWews7MFGO:+mQHr8ea2QV6eEBR3QB4qWen7TO
TLSH
T1BBA6D65C2590964FEF2ED333D38B394091E6B2E5993097628BF9E6C869FECC41285C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HeavenMS-localhost-WINDOW.exe

C:\Users\Admin\AppData\Local\Temp\HeavenMS-localhost-WINDOW.exe
"C:\Users\Admin\AppData\Local\Temp\HeavenMS-localhost-WINDOW.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000000400000-0x0000000000E95000-memory.dmp

Download

memory/2268-1-0x0000000000400000-0x0000000000E95000-memory.dmp