Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 18:19
Behavioral task
behavioral1
Sample
test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target test.exe
- Size 55KB
- Sample260916-wya3dacb49
- SHA256 a0c1f0ee65b4ca97f8fec209d26efb20cb31769e7f07a1e5f5bd74e9e03ad48b
- MD5 b5575df59f50b2b5c7ecc4a970e4b6aa
- SHA1 8a103bb1f9cd77f00c997eb16e2ea8bc015b56da
- SHA512 fd2956b0dc13056a51d776480d25a023271f5a4ebead9ec05d7f07b03167d4089e6ed420c0cbb69ba325b47df120899709359290f40de8d5591d396ecb6424db
- SSDEEP 1536:zyLu8DnN8N1+S1Cl/BUDtwsNMD6XExI3pmJm:r8DnNGcXUDtwsNMD6XExI3pm
- TLSH T107432844BFEA4A01E2BD8F3468F555150634AA63F532EB1F48D668EB17327C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe 5284 test.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe Token: 33 5284 test.exe Token: SeIncBasePriorityPrivilege 5284 test.exe