970fde28edb741dca6f838f55ad56fb4d614f6f7dd6beab25137f5f6535ad81c

Analysis

user interaction
yes
max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cain20[1].exe
Size 660KB
Sample260623-e65taaas8k
SHA256 970fde28edb741dca6f838f55ad56fb4d614f6f7dd6beab25137f5f6535ad81c
MD5 a14185fafc1a0a433752a75c0b8ce15d
SHA1 8f310d3becc4d18803af31575e8035b44fe37418
SHA512 27876676353b609f37ad0c5775786adb69007c5c0579d380151d9e6fd39293e3781be91e812d58e1a6c8fc4af4d5679a8d9c20eb541bd86725f9926cbaab57b6
SSDEEP 12288:iBSOEvY6xJk2GcHCuXFb7pDdBaKFJKa1xZ+sOY2mDCE5ktP/wPwr9UlaE4N:ZvY6xrGciqbdjaKFJKaHZ2YZDCES/frT
TLSH
T1DCE4231096D484BFD5340F3EB77D5FA69CC747E63BAA88CF00854A64DA738D6623D02A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
5956	cain20[1].exe
5956	cain20[1].exe
5956	cain20[1].exe
5956	cain20[1].exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	cain20[1].exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\~GLH0001.TMP	cain20[1].exe
File created	C:\Windows\~GLC0000.TMP	cain20[1].exe
File opened for modification	C:\Windows\~GLC0000.TMP	cain20[1].exe
File created	C:\Windows\~GLH0000.TMP	cain20[1].exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cain20[1].exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\cain20[1].exe
"C:\Users\Admin\AppData\Local\Temp\cain20[1].exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5484

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GLF5840.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLF5840.tmp
Size 7KB
SHA256 6715d0c3a7eaed2bc951f0210eb10df011d7ceced0d38b53256de5a2ec7efffa
MD5 28ac8613a0154fc49a52a6678dc0e984
SHA1 c954e7b6e155f150ac4999ab29706f3b726ff705
SHA512 24b3e0a65041284fcc1c7887477341ead51a3e6bddd836786d2f60ef8f3ffefae72c56f30de491e3ae74634cd9b87389c0584500aaa9b553dd10be955f2d8c02
SSDEEP 96:KcFxYC+uq+O5idO/apQecZcZKBxOaiVrphq6TZnpDH2aW:nLPO5i4lZcZKBxOrrph7ZsaW
TLSH
T100E122277E478DE1C1880A30E0E9A73773759C78131561139B87923BBCB06A6FE26706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~GLC0000.TMP

Path C:\Windows\~GLC0000.TMP
Size 137KB
SHA256 03ec012efe8eccf8ed8ace2ec182f65984a94185fe997b797db132dd25c805b1
MD5 7b867dded03a7ed1fc03b0f9f40bd954
SHA1 e8322384156350abbd67293f9c435926192d929c
SHA512 dcc4970f729caebf7787f9c045f0758b4603fbc432d9ca26099b26259a710e5f87cd3bef2884afdfaddcbd3637b1517e204542843646e146c4afe8377471bac3
SSDEEP 3072:yTp/to0kk2GrlCIfsTXLIrGXXyBIZJaVLhXtXFt1+V7Zg8qdV/:y9/+fkLrsIc7jZJKJreVK7
TLSH
T15DD34D13B19490B2D0D7817920DBAB77E7B858316FE265C7C710DE6468B16D3AA3870F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~GLH0000.TMP

Path C:\Windows\~GLH0000.TMP
Size 26KB
SHA256 94ef91b4c7864bd1ecc0db099e58298708bc5d22da40132ebb1c17feb4675964
MD5 89cf6af0a2a1cfebc82851c20852c121
SHA1 9106f4ade6a696d5f98968bce895333ad5dbd9ae
SHA512 af4a484b9bb8850c29fbfee1784b3cd3f78e6cbb419ad49262c28be16b31b5e1b43328c3088ae83f202ad2941062fa94325d77078f5c8e07a11a3fea1b56d627
SSDEEP 384:S2p4jGewJXucxt8U7fAETozP7vTn3BTgcMBevbNE/srnCLV1x01JXS+vSpHWPJFn:S2p43iecxtloHvb3BUrkTDuLuy+vRJF
TLSH
T178C21805C76494F2D4BEAB3F43B26B0FB13E6EDA4344D9D300E025749DA36C5AB39296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5956-4-0x0000000010021000-0x0000000010022000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads