Analysis
- user interaction
yes - max time kernel
120s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
thprac.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
General
- Target thprac.exe
- Size 2.7MB
- Sample260824-1evd5afb78
- SHA256 e02401ce8e203201208c5fa2bf8e6aa45a12e1d9f9f3be3e029b771ff00e0e9e
- MD5 49680c4a7a1580eda71385a67da9265c
- SHA1 e8ef56c492d1c410db8b5c87fbfb1c2753ca92c3
- SHA512 483ff4dafa3c63174e4581c5e5509f05306f516773764fd967b01f068808a48e7de5ac003713ed3a6b9368e65bfad6ad11811182e6acd3006fa8beacb05f22a1
- SSDEEP 49152:vt4QYa+kMxEDo0SYLqTmzwJbYc98iQ53y6yCvK8xG1xRxQWpFIloGRJShb+i6Mh:vt4pFk2EDrvFsJsc98VQ/
- TLSH T169D5BF15F79280F2C4460270702EA77F9B395DB44B2F56C3E3D469786A603E21A7BE27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thprac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\thprac.exe"C:\Users\Admin\AppData\Local\Temp\thprac.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3632
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3616