Analysis
- max time kernel
98s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
injector.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target injector.exe
- Size 10KB
- Sample260712-k2vemsfs8k
- SHA256 f275c9fc108554794f176428983ad21fdd4bebcae6d294dbe80a4c053680dcfc
- MD5 31ae4c94456dfd036500dc465e46158b
- SHA1 69509a4c4a9b7a82518ce52ea1e5bbac7badbac4
- SHA512 7ebf7ef804e14a051e3da8598743f630490758613c618c68fc5692176ae85e9052b16d3fe88da193cad10ce30c69466fca8b4317a4e3cb20d2641063e7ef47a2
- SSDEEP 192:Sdak828jk4I6WMgJd9tw47Zq2bSibQm7E5pz6cS2a:SdF8jk4I6YJd9eSZJWibQm7N2
- TLSH T1E0222C83FFD05CF0EF6942380137D55EC7AE6A204A63BE176F94B8510976680F91A26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injector.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings injector.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe 3232 injector.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4992 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\injector.exe"C:\Users\Admin\AppData\Local\Temp\injector.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3232
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4992