Analysis
- max time kernel
151s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 15:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe
- Size 32.9MB
- Sample260810-sp5nvaxtb1
- SHA256 535eb88d35afcd8050dd928944ea5a7edaea2662d1333b76e49aaac42882c9d9
- MD5 092273b7140ec66aa391ded63742dc79
- SHA1 b3c719a3117c30b58d5e43ae495d2858d3db5b61
- SHA512 44829c0494d97daaf212be9026ec929eab64079d0f9e75c62d2a4220140d4159d12343ba1869bb7c4bd28080cf18b32515252c61890c8ef1f65f4b4ec5bc49f5
- SSDEEP 393216:C90YhxQX+0YCghOJf5rIPKk8XgSueAjR2sASt39W/yJsv6tWKFdu9C:/9X+01f5a/M34R2Wt3U
- TLSH T11E77AEA3B252C473F5C250BA54ADE63B1728BD300B1516D7B3DC3A1A95706E27E3BA43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe 4080 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe"C:\Users\Admin\AppData\Local\Temp\ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini
- Size 362B
- SHA256 5bf4d703a533ad27ce9b75ac4f0605f5330e6947dea1352db8777e0d37fd31d8
- MD5 a21777e8bde345fc8507c1c9ff2008e4
- SHA1 9c64cdfb51888da266230252b277f83b9e9aa2e6
- SHA512 4a15f91985ef274855c524a05c19963e25bfdfbddcda0ececd9239f5bf4eac80b1d52ab2f25c526b8492ea4213e2cc35b1acdcc63914a9cf8d762dbd4325538f
- TLSH T1F7E08C30000AE48071DC0478E30C0970D2A7516041FF070CF10880C41406B78C4770BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini.lock
- Size 22B
- SHA256 54d1a9a38147f7d62fa1036fdf2217f480dbfbffa6378793bebafc714fc2748f
- MD5 9fd6b93fdd0132072ea033d13207f213
- SHA1 466b3be1716883079eaf2c6fefc6d81d29a6db9e
- SHA512 dca3666d1c53271e7ad82d56ea61136d48a2e75e4df92d7ced9741041b8f4d6ecb583c6e26a7b5988d9e69d0d63957d47cc01717f66eab772173d16358a06822
- MD5 SHA1 SHA512