f4a18555a77746bcd5453c3f0aea3f46b5cfb7f035087fe884496b1d94c667af

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinShell.exe
Size 32KB
Sample260825-snbpda1vbx
SHA256 f4a18555a77746bcd5453c3f0aea3f46b5cfb7f035087fe884496b1d94c667af
MD5 c1a649083ac064746818b6f7ca4c5e4d
SHA1 a33bcc95b4bcba381ee1ba170630c68efb3a2121
SHA512 b48cd7f9eee81c8073dff028d2415ca2bc4b641dd55733d13ce3ddbc1fbf220f9a46c10dbc90e6b6117acf9d5eca5c6a72486f03fe6b8bfdf11b43fdedcc3292
SSDEEP 384:mgMKR7o3011D/91Icsp9rbkeVSfNbU+vPTLYWjAeuibChNo8k4F2oZGuvrzQC84H:m/KFnsFV23l4a8k8Przr84VtnWeWQ/G
TLSH
T10EE23B237A9B8032C15253B1582ADBE543BFBEB10B71A2C7B7C45A5E0A341D1ADF6707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinShell.exe

C:\Users\Admin\AppData\Local\Temp\WinShell.exe
"C:\Users\Admin\AppData\Local\Temp\WinShell.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads