7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d.exe
Size 1.9MB
Sample260901-1t3daastdv
SHA256 7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d
MD5 1eb03e357071dea06208c19ce72de834
SHA1 d96e0a48bc089db687447155138565401bdb6b48
SHA512 b4c663e675529f22b4eac98e2865e685575c889d60d3004fc4a1e2b594eb59ce325c86c32dad5c52fc6a0317ead46fffd715fedbaee9e6acbe2ab3322aad4703
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkp:KIEeQfoR/IuOFVjUu
TLSH
T139957D127AD98432F1B316315DB9C2595670B8AA863689AFB2CC521E4F709C1CF37F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3452	7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d.exe
3452	7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d.exe

C:\Users\Admin\AppData\Local\Temp\7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d.exe
"C:\Users\Admin\AppData\Local\Temp\7cef6001ddde6377fb0faf670ecb490aa70ed149138b6439edd754551e55613d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2e880b1e5da5c1b92dff5e87c5b420991232b57bb2f63ba55b73f9a99a08c4c6
MD5 314db5515a543c50714f2da2a192add7
SHA1 1487c752bda539c1701e6bbae8175e8c05622f63
SHA512 0f7a37680d2fbac990bb3efe5bf3ff74c49072e48dfa47a172ae6874bf375f07f93dba70100be9a22fcdbf9c3e58ec0b92e7c98a92913d1c698b5783fe30f378
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBr:qosY
TLSH
T18FF343CA956FC5BA30234F83C77A6C754592355A835E0A1C62CFC2AF76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download