ae7e15c42ebb9bd5fdc5eafcbd63288b3781e0582a53289f9fd44fe58645b632

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_CLICK/winplan.exe
Size 64KB
Sample260801-ph5hqaae37
SHA256 ae7e15c42ebb9bd5fdc5eafcbd63288b3781e0582a53289f9fd44fe58645b632
MD5 8503ee5caf64dc4159bf3650e9bafd3a
SHA1 46a6a11f7500991a3e5eb144f732065525d019df
SHA512 64c55828186a40a360486a64a82065347685d2b235c12af319201807a8c58f871281b9c31374e6b3a5efc419a959386c8943392844975758e4f4ea234b1a7b8a
SSDEEP 1536:2V+F1F+o2JD1/tIKnFAneDcLf4fN250j5Nu0JzvjPqU8xbboZa+RDVMfj8NxkcE9:W+Rk4KFL2f4fN250j5Nu0Jzv7qU8xbbN
TLSH
T11E53F912714148F2DCB205F19DCB7FFFCA21D61C94268B2AE350CD66EABB560766E342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winplan.exe

C:\Users\Admin\AppData\Local\Temp\$_CLICK\winplan.exe
"C:\Users\Admin\AppData\Local\Temp\$_CLICK\winplan.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3156-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download