0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe
Size 8.2MB
Sample260706-qxefhsbx2n
SHA256 0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c
MD5 6306c02697620b855aa25747231c9d91
SHA1 053234d5b36278657ea7ef03b4f212f218b99b1b
SHA512 ded0872e5bed9c9e0175af770eb54045211f99d6d2aad4f08cba2c9986fed7978141ea00acea5e6dc6890f7181ff8aa454926513d30f5981a1dc8df8dabdcb4e
SSDEEP 196608:+0j9uIquazcP7Mtzq5doaRs7oEqEUKd//gK:++9QcTMt6fs74EXC
TLSH
T14986B021B752C175CA8301B350678FBF94395D109B389DE7CBE82E39C4216D2673BA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2536	0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe
2536	0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2536	0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe

C:\Users\Admin\AppData\Local\Temp\0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe
"C:\Users\Admin\AppData\Local\Temp\0f9cb592d5e1fe49ec81881ac25256555b2e73d2217929befd8ffeb30d6ce83c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wow_bg.jpg

Path C:\Users\Admin\AppData\Local\WowLauncher\wow_bg.jpg
Size 141KB
SHA256 cb78a33e288c4b1121112694f2e87cb2dcf154f2d844bf689540e0655f61a869
MD5 f46f5a3de5c2ad44638214d6807190f5
SHA1 db3a18bb8fb0a43f2f67890c1e3f7cfc05e17b6e
SHA512 d0a857e2e01aa4fefe6acdea68b7c017685ebed5c91b67ee09ce9ceb73e55ae988cff72f746249e31336547576de20ab4f63ea70f3e22d2efa5f0f15c87cbc82
SSDEEP 3072:llYjR5zx59tZVTVUHw1KUli35IYrsI2OYkTL9+yt2:Ex59t+DI2sI2Qt2
TLSH
T130E312764A9A1BA3F36B6484F160D3C7702CA44EC620DDADFA9D9CD0F9554F2DE600B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download