Analysis
- user interaction
yes - max time kernel
32s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 23:18
2 signatures
150 seconds
General
- Target [email protected]
- Size 248KB
- Sample261107-298exawset
- SHA256 3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d
- MD5 20d2c71d6d9daf4499ffc4a5d164f1c3
- SHA1 38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8
- SHA512 8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704
- SSDEEP 6144:0rSA7Pb4pz1EZiID9FqpRsAez4akK00Yl2JkZohSi87DK:/2D9YRsrp1a2JAiCK
- TLSH T18A4413264398CFFFF0C5A83672D76BA4FB7ED414922282096314687D3746B3EAA4D174
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5008 [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:5008