545746b86519a50e751e282556b960ff29f24349f8e4597d118c2ff3390331b0

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Clan Spin/GDFwSvc.exe
Size 156KB
Sample260801-ph5hqaae38
SHA256 545746b86519a50e751e282556b960ff29f24349f8e4597d118c2ff3390331b0
MD5 fcee9a352ebb22690c31118380eba9a3
SHA1 c3ee5333ca9af231ec0336f1fd3962a0a767c808
SHA512 700f9a62e9d1f1a998b87c474f41822643b64f924b8e47e0ade56f271f4cf760a3ac4e84c40cac143582435ce5dedca67551ce9641ac6380709cd2836d88f59f
SSDEEP 3072:0qCeoT6FavAP6VC7lztvjdhG+nGBIyhJ:HCeoT6aAPb55RhG+abJ
TLSH
T142F39E2275E0E2F2D09585360865EB45AB39FD715F3986D373983F5E9E701C0AB3B288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDFwSvc.exe

C:\Users\Admin\AppData\Local\Temp\Clan Spin\GDFwSvc.exe
"C:\Users\Admin\AppData\Local\Temp\Clan Spin\GDFwSvc.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads