89487994c9832147aa35cba9d82457ddb6119742a95637b75ca86cf45d4e0c8e

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$R0.exe
Size 909KB
Sample260910-rh6rwsdk5v
SHA256 89487994c9832147aa35cba9d82457ddb6119742a95637b75ca86cf45d4e0c8e
MD5 7c5829ad7b063872d799ebf2f233ec93
SHA1 8f5a559f06e11cc99c78eac8e7e2b30614f474f0
SHA512 e3a7b54f5bd1110462488503b291cf2903a751b9c033d94e6200938e727bc3432b3f4b1f3a00f5c6835ee5d8cb79a164ff09ed541ad8995a08b1ba0229cce65f
SSDEEP 24576:kdVMjtnRR2KnLP3a+pcnlE/JnNJufNFdMh:FVnLCV+tNJufNFdMh
TLSH
T19F158D10FBD991B3CB47017345B5971FA236E6862B1069C7F7D42B2FAD222D26D3A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$R0.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9265A09B-A9C1-44ba-B65B-FEEC1FCA4C05}\ = d6aaaa94a5260000	$R0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC40FFCF-BD8B-423d-882A-DEE82FE3315B}	$R0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC40FFCF-BD8B-423d-882A-DEE82FE3315B}\ = 2e3728e8f45e0c479a0115cc62a86011b551ab079dfe7444b7988cf59da556d6	$R0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9265A09B-A9C1-44ba-B65B-FEEC1FCA4C05}	$R0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4968	$R0.exe
Token: SeDebugPrivilege	4968	$R0.exe

C:\Users\Admin\AppData\Local\Temp\$R0.exe
"C:\Users\Admin\AppData\Local\Temp\$R0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4968-0-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/4968-1-0x0000000002400000-0x0000000002401000-memory.dmp