3f0d87ad482c32f65a1f3f2723aee06c2ff501e7ff0ec09303aaff39f74e453e

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winusb.exe
Size 104KB
Sample261020-p585eshy7s
SHA256 3f0d87ad482c32f65a1f3f2723aee06c2ff501e7ff0ec09303aaff39f74e453e
MD5 78e21ddce357215e318e0553d6af0e9e
SHA1 86dc8103b34e0b833fbfca4b017b32bc5db89add
SHA512 afa808df16971601e04c13bbdf1c788a220d6c63467de39397dc83c3e6cec9618c8e36f4c7e8d89820403741d8119ec464ec46aaa72b5a87b3cb4355455ccd64
SSDEEP 3072:oFrFyam/6LG404HpXJxpcjX3p4xOtsjkdT:Yq6P04JZvcjXZ4xOt
TLSH
T18AA34B88FA83A0BEEE1344B1419BF33F9638963168709E23E344DD75DF76AE15500E96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winusb.exe

C:\Users\Admin\AppData\Local\Temp\winusb.exe
"C:\Users\Admin\AppData\Local\Temp\winusb.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download