9ba173864436d686b57ea5b4631a7478d6982e62d1934a2ebd857063a55555e4

Analysis

max time kernel
18s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vyron.exe
Size 229KB
Sample260905-a2bmesz1dv
SHA256 9ba173864436d686b57ea5b4631a7478d6982e62d1934a2ebd857063a55555e4
MD5 8d4d21c930f4373c2df6added0f52012
SHA1 28a2f23b8e0e6c4e78ddfcf3b34c418c05193de3
SHA512 91aa6457a743934bb113889054fc2fe96a723d0202ff47c0988ccf1f45e9e529784b58a15f37623a95070f8aa1b1ef7a3bbf20e15cb0a8b012018937a6a33f16
SSDEEP 3072:p6a7dNNPBxehgEfYzPGpw+hcRjYJ5r92phU+2WoGKrSJs+9rYBwah0FIUGy3SzFi:p6aE+KV9WNJoFrSJsgrYe0cIK26m
TLSH
T1F7346B11BB928C32EA66073445A49F76B93BAD214B71BCC767903EA9483C1C35F36E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vyron.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	800	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	800	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Vyron.exe
"C:\Users\Admin\AppData\Local\Temp\Vyron.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads