a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe
Size 1.7MB
Sample260511-gljresft8j
SHA256 a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056
MD5 6c19bc1330ab92852bdd1082c90b667f
SHA1 c0e84f8a355daf5440aa98e4cf62f29fa8d0bce2
SHA512 7ed518f780364d492efc571fcd1fe71ff10bab712fbd99848e500282eb1cb1a6b33ac85483badff040eded49a564fd76531f3729b5b0966b5fe6b846d688e57d
SSDEEP 24576:FqDEvCTbMWu7rQYlBQcBiT6rpFd+z1yWSGNtPa135o4AjRsStz9AR7F:FTvC/MTQYxsWPkz1YYaDhARm
TLSH
T15A85E1427385C02EFE97D3724B4AEE128A7D7A660127B61F23981D79BD70360067D7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2700-0-0x0000000000FB0000-0x000000000116D000-memory.dmp	autoit_exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\CIMV2	a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe

C:\Users\Admin\AppData\Local\Temp\a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe
"C:\Users\Admin\AppData\Local\Temp\a7e868c0c0275b75b0e3913b4273dae220e7ccd19f3ec410845c64566f5f5056.exe"
1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000000FB0000-0x000000000116D000-memory.dmp

Download