Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 10:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe
- Size 3.1MB
- Sample260702-mvb1tsgs8v
- SHA256 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4
- MD5 f3f406f14dd8c8f5ad9a36d574af9868
- SHA1 17f4bf112199e2fcccad8d07c2f5657ca13553d1
- SHA512 edb981f29655363461b1c06a2b6445fb271644a9077351e7c5be74240d86312e182b49a82096c62a07d130bc8d39f10200878895d2f1b787c486967bd89ddefd
- SSDEEP 98304:8jTQYxsWRU4pp6nSdE/KyNZAnfXpl9kbABW1:83dxfCq6nSh+GfXzEuW1
- TLSH T1F2E51212B392D022FF5794374B5AE26086BC6D760023A61F93993D79F9701B0663E7B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe - Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe - Suspicious use of SendNotifyMessage 14 IoCs
pid Process 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe 1340 7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe"C:\Users\Admin\AppData\Local\Temp\7a58104b45b335fd7186e36b105c83cf5d17746f2eec3030c459e41d05daa0e4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1340