0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127.exe
Size 32KB
Sample260722-sqffcaxfkc
SHA256 0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127
MD5 b7c6517a86162cc50df36002cb3d89dd
SHA1 2e2b6cfd0aaed4e26b91f37c01c76615cc265d42
SHA512 e0d8a16794e9f2a7c48ce6b0baaa7c5339b46716e61f902fc6e996577d92cda4c3a3216390ecfdb106dc8115ad6b30ebc3a7815f37a9904928a36497b0279efa
SSDEEP 384:mqvpUhkpoJkqKONl90ny6DKll2V+XfeOcJkLXcrygl:7hUGG9ksDGO2Wg
TLSH
T148E2A813EEE8C15AE6F69A721D3146F84A263C71A830DF4B28587A4D0F71A039EF4717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3524	0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127.exe

C:\Users\Admin\AppData\Local\Temp\0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127.exe
"C:\Users\Admin\AppData\Local\Temp\0bf532445e0d880e21107f4efee653232db78278dc76024633b2ce48db8ad127.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3524-3-0x0000000000400000-0x0000000000422000-memory.dmp