7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe
Size 3.5MB
Sample260707-wth77ab16m
SHA256 7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665
MD5 44a01071e9929079e6b981f99c96ec68
SHA1 50fe15f287f19538c57d58779e7b30b9319d4f87
SHA512 656039fd57af30305ee308bc8f862e0de597cefdf4f79009011ac8cce6bb77a63aa93f3c6ae1e71cceed00df6c88901879093372678fbfb581eb374e1c732ab5
SSDEEP 98304:6Bcm5l4jEGfvnZED6bWR8eWpQn679oFsCchQYDcW65AKCSg:6em5lYMRK+Io0hQYDD6CT
TLSH
T15AF5CF61F740E0BFC23625328A58A378E3AEE8709B7246477A543E3DD9710D35D28B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3496	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe
3496	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3496	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe
3496	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe
3496	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe
3496	7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe

C:\Users\Admin\AppData\Local\Temp\7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe
"C:\Users\Admin\AppData\Local\Temp\7da3a450b3e3bee54f11cdae7f2a4e4ef858c87aa46ed40219f866c50cde8665.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Game.exe

Path C:\Users\Admin\AppData\Local\Temp\Game.exe
Size 5.3MB
SHA256 ea153046166a0dd556ec4920304c204031dbf989e496c25678c26caaf12c8f32
MD5 f0cdecd12bd814211a4acfadefe63ba5
SHA1 c67d6e3afb65d6d5f24dfb86ceb6d6640f89831f
SHA512 9eb5dd5f65d53f43a51ff1ec6251f1b87926824a9ed83c531aa6050dcefb6996c3f1836d41b8cae1412287fdde6c81dd247446aea5a93a4f3014832d4a17fb9e
SSDEEP 98304:q7xfpd/B84OKWC28HtNLUbXlSo9VZIwqt:KfldgCQb1So9D1qt
TLSH
T1EB467C41E6525031D68770B0B5AD7B6FC83D99A41F2821D3EBF42E989DB01E1B9F3227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client_trace.ini

Path C:\Users\Admin\AppData\Local\Temp\client_trace.ini
Size 319B
SHA256 a580730c7e994ed573063c3a38a246e0295217f2cb10e196bc32fe518ebcf719
MD5 9eb559c7a6dc5c4fbdbbd12515ab539c
SHA1 70ea64d766ebaff0dd0546897138814feb1514db
SHA512 b6d3b2b12908ed3b197c11ed93351b9439aef718cb528d294d2da6df0acb4883eb240eec0aa79ee086611ff364d498db44f62d55ca2e3f2182876ff264f3c72f
TLSH
T19EE08C3640643A192D68C0B94369CE59C3E0625A4CC176761A2D4A7C264F1EE16EFC78
MD5 SHA1 SHA512 TLSH

Submit Download