662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde.exe
Size 6.6MB
Sample261102-mhh9dagy81
SHA256 662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde
MD5 d2c6ba55a6e602d276b93aef1abe9244
SHA1 05850fefe62a6225808f49cb90babed8ff186f61
SHA512 d924414cad97b8c99f1b2760e70b4d3142e92a665d595899ec7ed503396898e9c03efffec7cc5af7ce268740369c07f5fd7439688bd3b04be6084ecb6c5d9012
SSDEEP 196608:QCdMTLJyea34iTQJDS2PyQJ9bgP4NQRI8lTYzUN6wvO:QkM3J6IisJW2PyGbgP4F8ZYzUXvO
TLSH
T14C6633417CE6C4B6D55B1E312EE46BF1E6BAAB854F380DC393D42E585F78610D233A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde.exe

C:\Users\Admin\AppData\Local\Temp\662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde.exe
"C:\Users\Admin\AppData\Local\Temp\662e13eeaa490438a297d5317558dd894866e8efe1a181d47685e3a089461fde.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data6.dat

Path C:\Users\Admin\AppData\Local\Temp\优效日历\data6.dat
Size 17KB
SHA256 2643bfa0a442ab353340d37c23c541d4e96fff8a6ff3db6ecbaff2362b5cafeb
MD5 56bff46f5f0ffbea816c9525851976f5
SHA1 c9a419e9ac1fcfcd6d91c82678e2f2d6477e1fc1
SHA512 f0541dd688ec8927580df84702dc6aac42d84e5ef98ea2cf428dfa339b4d6d43ea0ad6bd7855a74ac7548a30777f6670cab165f10857a708eec5af64d8031ccd
SSDEEP 192:C7D8KY2mXD8KY24tjuen7+B+tsRAiAVlHyxpRCbdIOHhpDTJWc3Mmj5Kvz3/:YhY2mzhY2mSehsmiAV5HXn33j5O3/
TLSH
T14E72C6A3B46E571BC2C046B63E04838B1C02362EE37D418E6DD9B3BC54F59A5B60D87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download