517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Size 5.5MB
Sample260801-tv5fps1ajf
SHA256 517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76
MD5 3e8e1ea8557d8500cf298d28914c2c2d
SHA1 e35d87286db218079767c2712dae210bc80cd87a
SHA512 87203efa42eecd994a6b813a4c89ed2e8f820bb46141b7698ebca213ecedf0bb0f6125da43c8cacaa3a12cf581ce07d35d877d36684aa5f4abd5db72f55223ed
SSDEEP 98304:HchHRVKFlQZmKZ2QS02X66haFYZmfwL31c90gOeJ32RyVVXfe:WYlY2j08fxbL3Q5O02RyW
TLSH
T15A460261F3C0C0B1D5A3417449EAAB6AD2AD6D6D3730CFB767D84B0E5BB04D69A3A103
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idno = "0"	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idno = "1"	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idex = "a1da4a89e7e84d3514d4dc07d46c471c"	517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe

C:\Users\Admin\AppData\Local\Temp\517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe
"C:\Users\Admin\AppData\Local\Temp\517a4d67e204772b6e9ddb7ace069f4b9dfa417c3b89ab7f4a10a917429e0e76.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4384-0-0x0000000000400000-0x00000000005BF000-memory.dmp

Download