Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe
- Size 432KB
- Sample260722-bc12fstvbx
- SHA256 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2
- MD5 11eea6dd4b31da138fc7f989982c4ee5
- SHA1 8e167ae487ec8f56927d3e32e5f59808aa05896e
- SHA512 b6d91e8a86f0f04f0646fe3fe84ad4019e0fa9da2c409688d8821fd3991167ffd867e0b247df95549326b03a6f8023e54ddc89a18a22cd1d18ab188e1a557b97
- SSDEEP 6144:HUio9KB67THYfEKjYnkoDPXDjXTxcsVDSeavDiHXQEyUdTPm:HUVi1YnHLxc0DyvgXQ8dTPm
- TLSH T1B6942C2331C0C121F4625533697689A9E5397DB88F2089CBA38C7D9E6DB53C17736B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3704 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe 3704 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe 3704 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3704 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe 3704 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe 3704 7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe"C:\Users\Admin\AppData\Local\Temp\7bc9aa4ac4f3433ec062203de9274ffe28b3dc2171e2d3d5c6a9af95163b0cc2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3704