a61ec0eb9f45be520cc1e86fa88125b95370f244f9a38fe35b0940c1bdf2edeb

Analysis

user interaction
yes
max time kernel
32s
max time network
25s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AnyBurn(32-bit)/AnyBurn.exe
Size 5.3MB
Sample260531-spxm8sbs21
SHA256 a61ec0eb9f45be520cc1e86fa88125b95370f244f9a38fe35b0940c1bdf2edeb
MD5 8d8cc594929f4ce9f33eafb4a88193f8
SHA1 8544d8fdc4c73ca61ee21367930d81469c0a07c0
SHA512 5a95e971da6a73ce898963ceee3e1816bd162495ac8e37b122e67e5e960623e5f079a1110c88e15dd9ad6aff6d3ade40921985c6a0054d9c1a2c3b667bc34df7
SSDEEP 49152:dUKxRyoXVxY4x/bBTKfeQofFkGNz+Xq/xU63mQdPbwJjHNLzR/uY:d7Vl3/bpKDSGex/xU63ldPkHL1/n
TLSH
T14446F611B3FD5069F2F36A7A6AB55375893BBDA65A22D16F11F0B40E0931BA08D31333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnyBurn.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1696	AnyBurn.exe
1696	AnyBurn.exe
1696	AnyBurn.exe

C:\Users\Admin\AppData\Local\Temp\AnyBurn(32-bit)\AnyBurn.exe
"C:\Users\Admin\AppData\Local\Temp\AnyBurn(32-bit)\AnyBurn.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F05B.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\$AnyBurn$\F05B.tmp.ico
Size 2KB
SHA256 b4d6704aabfcc8b7cb8f4ee58b162dd124e2d0e4dce20ecf13eebd262dd1e76e
MD5 4198afdeb9ace242c575ee572af22e1f
SHA1 32784594ec69ca459878010401c3931be8e5e15e
SHA512 d4288466d9a669c7735dc788f81fd5581876048644c48a58df5e2f8c70d468464d9de2bcbd295cdfe8510fd77a9a3cc26e3de0a1cf985622fec00baefda7f4cc
TLSH
T12E4120DF5550C28EC4E5E372D181CB3DB16D0AEE90882E4418517427BAB86DFEA17292
MD5 SHA1 SHA512 TLSH

Submit Download