f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1.exe
Size 337KB
Sample260916-massvas14p
SHA256 f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1
MD5 708dd21517aa1756fd8369335a77272c
SHA1 698ed491384955bf710a85366c512144ee55b65b
SHA512 ffd54e1d5ae1082b2dbad1feab49e1d07b2e1e4f50fd86bd9df7ffe9b023e2508a0edfc6f852f9e3bf1df32a43b9703a11fa48d1a58f65ff576910efe7fb7992
SSDEEP 3072:DjJaeaDkYTifjjCIDJ6Hp2nCY+vJpjURKzfUx1sckF6L47jetttvG5SmXf43k:XJaZDkVjjTnCnh1zfUL6Xf40
TLSH
T16474185BEECF6D26EEF567794A7717584A32FCA04931880F8705B03A01329974EE7722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 2100	5476	f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1.exe	87

C:\Users\Admin\AppData\Local\Temp\f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1.exe
"C:\Users\Admin\AppData\Local\Temp\f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5476-0-0x000000000040F000-0x0000000000410000-memory.dmp

Download

memory/5476-1-0x0000000000400000-0x000000000045E000-memory.dmp