7f41d179a379c348d6ef76d772c59f50b6797177aca406d5b2db346c3615b970

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PEHIME.exe
Size 78KB
Sample261107-p2cxtab14v
SHA256 7f41d179a379c348d6ef76d772c59f50b6797177aca406d5b2db346c3615b970
MD5 b891a6bf61c7667e07edd2ddcc626ffb
SHA1 2f0bcdc247644579197cce4e227ebc2a9e3fd628
SHA512 a965b00e12e7bc9699b02861a405b624dd4f905417d7b9fe8d24ec2785297e311dbc062a808b3499825047088065ed28e3a01e3299e5e57fa39c0daabd848389
SSDEEP 1536:+o+gnnujDN8QxmO58xegiALZWe3tOTXzbfAK3C1oakK:R+gnu3N8Q8O58xegiAkRjboK3C1ZkK
TLSH
T1EA731945EA4360F1E94F04F44CC7F7FF5B616661883ACCA0EA8D9942BE1BB5121DA60B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PEHIME.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1276	PEHIME.exe
1276	PEHIME.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1276	PEHIME.exe
1276	PEHIME.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	PEHIME.exe

C:\Users\Admin\AppData\Local\Temp\PEHIME.exe
"C:\Users\Admin\AppData\Local\Temp\PEHIME.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000000D30000-0x0000000000E2F000-memory.dmp

Download