7b3db46866bb968a944ffda3fe9a64affb9255b12302bbeffb00dc012a882ea1

Analysis

max time kernel
149s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/NPJPI150_22.dll
Size 73KB
Sample260608-pepcbsdz3v
SHA256 7b3db46866bb968a944ffda3fe9a64affb9255b12302bbeffb00dc012a882ea1
MD5 98f0a310b4bc0b514f0b5031a8d02ac8
SHA1 427984b655e042cb62996bbf7d8402e482d2532b
SHA512 b965fddf3fa170957d8167bb81326679bb8144d4f3636b4df5218487ea3b89bf97b57e2f2af4b132c42d7fa61733b9ea0f76772b92aaf8a62d178b97b46560b0
SSDEEP 768:Nu2Z7Bu5EZ3wV4yIbR6/aO1pd+Mb9ANvxqaPOFY0ACR7e7MvlLh:U2x45EZFRQpd78xqzYlA7Fld
TLSH
T15673061223F6D555F6F37B30993C56582F2BBEC66E7D914E0710024D9E30A68C9A8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_22"	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4368	1344	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bin\NPJPI150_22.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bin\NPJPI150_22.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads