2bbc8234685fe2f6324040af6ea20123cf00c4a56882ce0d9074f0beefac67bc

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PINBALL.exe
Size 274KB
Sample260621-tsb2daez4v
SHA256 2bbc8234685fe2f6324040af6ea20123cf00c4a56882ce0d9074f0beefac67bc
MD5 faa1fde004b3c60b5a8068a7c3aab151
SHA1 2a5b525e0f631bb6107639e2a69df15986fb0d05
SHA512 26eebad605cdf0ec99ef2f07355b887ad956faf271e8869e5ef623153262ba80b80bdb11eb6cb15c508b8ad331634d4c5938bb550663932913419fc8ae650119
SSDEEP 6144:aqKFh6MBn1++g0UIgqVwTREJ7EAE2xyS:anFhr1+h0UjqVwyx/
TLSH
T102542A21C201C172EABF627456E93392623856319B23DFB307D7D9EEE971783652C386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PINBALL.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6768	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6768	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\PINBALL.exe
"C:\Users\Admin\AppData\Local\Temp\PINBALL.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads