1a66281d9610d171e34d8343e2cc65628e6f1053b0265902453be7a81c9dc25b

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mh72.exe
Size 29KB
Sample260913-alhqsshq91
SHA256 1a66281d9610d171e34d8343e2cc65628e6f1053b0265902453be7a81c9dc25b
MD5 b3a932346b26f14a3ec22db9c3393fc1
SHA1 1605fae93f0aba81902e47f5a22ba1bb297db9c1
SHA512 e6824c5cfaf94f1f02bcca307f7910aaff41b47ce5bfe3b5e45b99a971c07455780a36a7108ff4875933a68ea912c12bd1804a787de8bea2d20faa32b1d1935a
SSDEEP 768:p6yATy2uYzYgWfl4tKvNrQUlBG9TeAb7l3jx:kA2uYzYhlbF93G7vd
TLSH
T17BD24B6342D474BAD5581A3849477B32593CE461097B8EB33A6CECE91F332B1ED192CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mh72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe

Opens file in notepad (likely ransom note) 42 IoCs

ransomware

pid	Process
1728	NOTEPAD.exe
3384	NOTEPAD.exe
3344	NOTEPAD.exe
2324	NOTEPAD.exe
3792	NOTEPAD.exe
3596	NOTEPAD.exe
468	NOTEPAD.exe
3920	NOTEPAD.exe
3764	NOTEPAD.exe
1140	NOTEPAD.exe
3448	NOTEPAD.exe
2844	NOTEPAD.exe
3120	NOTEPAD.exe
1964	NOTEPAD.exe
2464	NOTEPAD.exe
1528	NOTEPAD.exe
2900	NOTEPAD.exe
2140	NOTEPAD.exe
1816	NOTEPAD.exe
1960	NOTEPAD.exe
3572	NOTEPAD.exe
4712	NOTEPAD.exe
2500	NOTEPAD.exe
924	NOTEPAD.exe
3944	NOTEPAD.exe
716	NOTEPAD.exe
3484	NOTEPAD.exe
3676	NOTEPAD.exe
1236	NOTEPAD.exe
4876	NOTEPAD.exe
2948	NOTEPAD.exe
5072	NOTEPAD.exe
548	NOTEPAD.exe
4700	NOTEPAD.exe
2004	NOTEPAD.exe
2944	NOTEPAD.exe
5000	NOTEPAD.exe
3568	NOTEPAD.exe
516	NOTEPAD.exe
3492	NOTEPAD.exe
3216	NOTEPAD.exe
3508	NOTEPAD.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4404	mh72.exe
Token: SeDebugPrivilege	4404	mh72.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1816	4404	mh72.exe	88
PID 4404 wrote to memory of 468	4404	mh72.exe	89
PID 4404 wrote to memory of 924	4404	mh72.exe	90
PID 4404 wrote to memory of 1960	4404	mh72.exe	91
PID 4404 wrote to memory of 5072	4404	mh72.exe	92
PID 4404 wrote to memory of 548	4404	mh72.exe	93
PID 4404 wrote to memory of 3508	4404	mh72.exe	94
PID 4404 wrote to memory of 1728	4404	mh72.exe	95
PID 4404 wrote to memory of 3920	4404	mh72.exe	96
PID 4404 wrote to memory of 3944	4404	mh72.exe	97
PID 4404 wrote to memory of 5000	4404	mh72.exe	98
PID 4404 wrote to memory of 2900	4404	mh72.exe	99
PID 4404 wrote to memory of 3764	4404	mh72.exe	100
PID 4404 wrote to memory of 716	4404	mh72.exe	101
PID 4404 wrote to memory of 2844	4404	mh72.exe	102
PID 4404 wrote to memory of 4700	4404	mh72.exe	103
PID 4404 wrote to memory of 3572	4404	mh72.exe	104
PID 4404 wrote to memory of 3384	4404	mh72.exe	105
PID 4404 wrote to memory of 3568	4404	mh72.exe	106
PID 4404 wrote to memory of 3120	4404	mh72.exe	107
PID 4404 wrote to memory of 3344	4404	mh72.exe	108
PID 4404 wrote to memory of 516	4404	mh72.exe	109
PID 4404 wrote to memory of 4712	4404	mh72.exe	110
PID 4404 wrote to memory of 1964	4404	mh72.exe	111
PID 4404 wrote to memory of 3484	4404	mh72.exe	112
PID 4404 wrote to memory of 3676	4404	mh72.exe	113
PID 4404 wrote to memory of 3216	4404	mh72.exe	114
PID 4404 wrote to memory of 1236	4404	mh72.exe	115
PID 4404 wrote to memory of 2004	4404	mh72.exe	116
PID 4404 wrote to memory of 4876	4404	mh72.exe	117
PID 4404 wrote to memory of 1140	4404	mh72.exe	118
PID 4404 wrote to memory of 2324	4404	mh72.exe	119
PID 4404 wrote to memory of 2500	4404	mh72.exe	120
PID 4404 wrote to memory of 3492	4404	mh72.exe	121
PID 4404 wrote to memory of 2140	4404	mh72.exe	122
PID 4404 wrote to memory of 2464	4404	mh72.exe	123
PID 4404 wrote to memory of 1528	4404	mh72.exe	124
PID 4404 wrote to memory of 3792	4404	mh72.exe	125
PID 4404 wrote to memory of 3596	4404	mh72.exe	126
PID 4404 wrote to memory of 3448	4404	mh72.exe	127
PID 4404 wrote to memory of 2944	4404	mh72.exe	128
PID 4404 wrote to memory of 2948	4404	mh72.exe	129

C:\Users\Admin\AppData\Local\Temp\mh72.exe
"C:\Users\Admin\AppData\Local\Temp\mh72.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1816
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:468
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:924
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1960
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5072
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:548
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3508
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1728
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3920
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3944
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5000
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2900
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3764
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:716
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2844
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4700
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3572
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3384
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3568
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3120
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3344
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:516
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4712
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1964
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3484
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3676
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3216
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1236
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2004
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4876
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1140
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2324
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2500
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3492
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2140
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2464
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1528
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3792
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3596
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3448
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\d2maphack.cfg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2944
- C:\Windows\SysWOW64\NOTEPAD.exe
  NOTEPAD "C:\Users\Admin\AppData\Local\Temp\D2MAPHACK.VCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4404-0-0x0000000000010000-0x0000000000022000-memory.dmp

Download