71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe
Size 10.9MB
Sample260814-jx239ayblb
SHA256 71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c
MD5 fa36f3562ba8f008d9c84d7e58c1f054
SHA1 159d31840468200d81188fe30e740ea01bfbf14d
SHA512 3f08855e6fe3c5fa95b0f6df3aeac2c73d88b84426f158d611bb46e7da77c485af3eed725c72073b96a9938b2ccefa01f93e9c7e0a12fe9c9de6860a6c949319
SSDEEP 98304:eeXSNLWW0kC1uAIn/dUNH7wZ2o1xTozZQ/s9id6l60oapbBdtH+:xglOwTozZ4sokoGbBdt
TLSH
T1E3B64A91F9DB50F2EA07197044AB627F63306D098B24CBC7EB847F6AF8736E10972159
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1364	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe
1364	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1364	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe
1364	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4668	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4668	1364	71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe	88

C:\Users\Admin\AppData\Local\Temp\71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe
"C:\Users\Admin\AppData\Local\Temp\71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe
  C:\Users\Admin\AppData\Local\Temp\71f5f9924f013b12c1321ef8f5ec3d598bced6ce59c0de9612dd13082020798c.exe --gui
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LanFast-Wzzok.json

Path C:\Users\Admin\AppData\Roaming\LanFast-Wzzok\LanFast-Wzzok.json
Size 354B
SHA256 d91a2ad1f86873405e9af402d95c13116cf5b1ddc7a169e4ba1033a5403dea83
MD5 ee2af1267dd37ec1001075f2c45e4ead
SHA1 d6745d247d201ee179cd9b2f9f441e9106ecdd84
SHA512 d6c6ebf01846ec10c831894353df6c512f8f45d1fb64ee57369e42c99e5674a691740882e7314c7a7c2b9000faa7f9d5f18dc596b3de8f7af0673ed2f53d6353
TLSH
T108E04F01805412BB56C462AC986ECA2737144D09405A7C58D9279A58B84E376F4F9AE8
MD5 SHA1 SHA512 TLSH

Submit Download