bafd3d712a32b884001dccd7f6f77fd9aa515b254352310e20f67026364c7884

Analysis

max time kernel
12s
max time network
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
salinewin1.5-safety.exe
Size 245KB
Sample260928-ymkhsasdpc
SHA256 bafd3d712a32b884001dccd7f6f77fd9aa515b254352310e20f67026364c7884
MD5 e69d64dfc3d809dc8dbdda9c367b0afc
SHA1 dc61951ccd463291bb2e2758fc8afebaa8ffadcc
SHA512 d5e644ab734168d5f42028a6196aba091a60b8536e0101e15254ecc154f564b495f4d66d948399cd4de42f19423cb500a8f8b90d59652fb31e68f1375e28def5
SSDEEP 3072:3WiJUpGuEy1AXy4e5II5CoTbLYiBZP5pHQpYR95WPNp/H:GBpduiPRZPPHQpY35WPNpf
TLSH
T127347D21B5C1C4F1F97945356836C9910E6AFC36AF501EAF3298332F0E751E2453AEAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5-safety.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5824	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\salinewin1.5-safety.exe
"C:\Users\Admin\AppData\Local\Temp\salinewin1.5-safety.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x0000000000000500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads