Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 08:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe
- Size 204KB
- Sample260802-kr464ayhmg
- SHA256 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21
- MD5 d304f0a0ade1ad4cb6b39ea4614fd496
- SHA1 3955f467b46628b6f33a98a389529bb79d49230c
- SHA512 187296ae9cfac25d9610b11d3ceef683ac7fad0afdaadf833d8955cb1d25cf2ac61354e385a2d3fe5daf17445abecd24326bfe11104fba0290f7459f4c250332
- SSDEEP 6144:0+7SMShROKARPHIoUcwylt5MrK8cQil5V:0RnROKa6cwGt52K8cQil5V
- TLSH T1D6142A13EB947212F2874570187A85B57E667C715A12DC27E384BF4838399E3EBB230B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeCreateTokenPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeAssignPrimaryTokenPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeLockMemoryPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeIncreaseQuotaPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeMachineAccountPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeTcbPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeSecurityPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeTakeOwnershipPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeLoadDriverPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeSystemProfilePrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeSystemtimePrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeProfSingleProcessPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeIncBasePriorityPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeCreatePagefilePrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeCreatePermanentPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeBackupPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeRestorePrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeShutdownPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeDebugPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeAuditPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeSystemEnvironmentPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeChangeNotifyPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeRemoteShutdownPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeUndockPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeSyncAgentPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeEnableDelegationPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeManageVolumePrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeImpersonatePrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: SeCreateGlobalPrivilege 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: 31 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: 32 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: 33 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: 34 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe Token: 35 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe 896 754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe"C:\Users\Admin\AppData\Local\Temp\754f1900beea293b38f87cb3e49a638fd8b58da668ea9fb13129603adfb18f21.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:896