620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe
Size 11.6MB
Sample260506-trfm6set2z
SHA256 620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11
MD5 7d33377156d7c5c27d8d96acb2cc8d91
SHA1 43f8163c0f0f562ea021d269ca05c2498fda48ad
SHA512 74f6f62c657f20ad2990441dbe5d4538a062890f04db3022273f8e21e4926cdae8fefd9ee3754663dfcdb04fc11bf181cf82284b276b89b37c725841ba52f752
SSDEEP 196608:vBDY7jLIZW9EdvJQO0G4NTx9Pe20/aVHYiu6E:vhY7oZFItGGdCahYie
TLSH
T1B6C6D096DB813129DD2E6A70213C3DAF9529ADC51B700BCBD7EE7C9415707C3183AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2648	620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe

C:\Users\Admin\AppData\Local\Temp\620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe
"C:\Users\Admin\AppData\Local\Temp\620f7aa8ab0cc963ada49ac59b5a0f23c67a0a80d666392afeb48d0694b57f11.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 8KB
SHA256 32c69c0ad93da43deb6d15dd050d07c78040c7fe116bd2fd6dac6c6bcb1688f4
MD5 f3dac0faa5dd384e0323c48b2c82703e
SHA1 55668fa0e43360c08313457d692118a88dc407c0
SHA512 02883c030ff11dff1ff1ae98d4414e43ad924b6258ea178afe48c5e342ad7ed800c85149ba33a4e9d746d6f8b66d3f03f62b8c8dbddcf7b20a26b284c9e077dd
SSDEEP 192:aruTlO611rApDrmynLkODh+nuSnLkOD5+nuk:SuTlO611rApDrxnLkODh+nuSnLkOD5+/
TLSH
T13D0259147CB2CE7A7A5A51D6E97E2E929CED30D81000C9D163CE16E42CE3620BF7F466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 fc45a71cb840fc117aa1ec743a9d5d408a6848e756039a25e72bef96da2d6f29
MD5 7d1ca91f20ed302a9e296b03eb1df8eb
SHA1 ecd4bf9873f31c1d86b8c6aabc86d5c4266025c2
SHA512 6fdaa50e861f5d0320de738668e1cf0653d24d07885d27c48077b5e739c68d8341e4076379e5ef88a3eaaf22e31a2c4a6e3b93d49102f2baf120350699af0340
MD5 SHA1 SHA512