cbde9a1ee0dec433793898cbb585e417ba01e4f46c29d16977344558f8a68b21

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/10/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.exe
Size 84KB
Sample261028-jfv9dabs8p
SHA256 cbde9a1ee0dec433793898cbb585e417ba01e4f46c29d16977344558f8a68b21
MD5 e7dc93d755f55dd1487efc5154ee171a
SHA1 c93c84d79dd763910998d79690d41b1731df7140
SHA512 ec18baac6386c49c0c012d11aad48a598da13b904787070df5bf1d56f02a00a96a4bc74993976c797f5e3e4e1b3cd2f7ff1a98bdb4c5698b91c122ad1d3e9c68
SSDEEP 1536:KpNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/wLeILtVo8V:KpNEaiQl2qouiNdFFCiZcOz+TJ/meAt
TLSH
T11C83E707FE07C1F3E81202B21B553762AFBDEC231619A927C745C581EEB8C4AD4B567A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1260	3.exe

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads