Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 12:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
multi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
multi.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target multi.exe
- Size 682KB
- Sample260731-pnrh2sshqd
- SHA256 1058d140c7a270ef7b97fb82cb0e1a01ab3f399b2f45af51779280076fe34b90
- MD5 65ddeafcb9001712726d82a2bb684163
- SHA1 aa4f6204c7b779a3d4d03f789d2d69b1734501ca
- SHA512 776ae2db0fe4d0cb386886cecb20eb95b1fe9cd1402a3df2c51b6968bc4f92306f069653ac09f63c85e0de5b05f90e895bf4a5d192460b53481e5ebe4c06b587
- SSDEEP 12288:hhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a6N7O7v2Mp:vRmJkcoQricOIQxiZY1iaXvvp
- TLSH T11CE4AF22F5C68036C2B323B19E7EF76A963D69360336D19727C82D315EA05816B39773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language multi.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1968 multi.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe 1968 multi.exe