7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe
Size 10.4MB
Sample260817-dc3ldshb86
SHA256 7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145
MD5 252054038d1008a41d2cb459ca24fa13
SHA1 9f2268ae217795c5a14fb5a758a675abd419cd36
SHA512 dd6541972e79b7ca27e4639d5a6b43d8ef477418f72861d722dabb0925b2061c6b4535ecf91a2a5a41cc2a5ab238e6ff42f667bf4b4b6c588de5e64b31462c53
SSDEEP 196608:XZGmuvsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoS3:XZGnvsREJLODBWlX3d+NpvdHIoU
TLSH
T1A5B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe
5496	7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe

C:\Users\Admin\AppData\Local\Temp\7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe
"C:\Users\Admin\AppData\Local\Temp\7921a3af502d3d72c47a0a1958ea4423c5f43bda2649134eadf154fcdbc95145.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5496-0-0x0000000002C00000-0x0000000002C01000-memory.dmp

Download

memory/5496-1-0x0000000000400000-0x0000000000E90000-memory.dmp

Download