959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
Size 7.3MB
Sample260731-ml4z9agg28
SHA256 959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44
MD5 3a5475913690dd399b9923154abd3874
SHA1 a131c523365e32fd8d1a44b2090969fe06a97e39
SHA512 7c7eb9c68d6a356274ed68888b6a003355cf048ca63afaa97e9a487c90f529674f1982409f85f7631d7d2608fe158c1efc9ff1fc8a1c77b3de96b306faff0e56
SSDEEP 98304:+ZK2o4tgR/vzcUPn3hXO6rNuKwyx3zza7T4LI0VP+K4Zg3PowIf7IUXkSniFgB:Z2o4tmbcUP3heWuK3+70L3VWJg3P
TLSH
T1F276BF11BA818472E56242709A1DBBBA41FDBD700B6085D7F79C3E5E5F308D29A36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
5420	959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe

C:\Users\Admin\AppData\Local\Temp\959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe
"C:\Users\Admin\AppData\Local\Temp\959320e8a50384771e072a5c4c78f0f70ff0cf6b7e8245865b60a69c82f6bd44.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads