Overview

overview

5

Static

static

1

winzip77-pp.exe

windows10-2004-x64

5

winzip77-pp.exe

windows11-21h2-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/04/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winzip77-pp.exe
  • Size 2.8MB
  • Sample260418-phzbpsht51
  • SHA256 a608bb3ec5b09cfa4eeb3b93d1b0a9fae0fe32a4fea3c60be2fdf8000238dec6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winzip77-pp.exe
    "C:\Users\Admin\AppData\Local\Temp\winzip77-pp.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Users\Admin\AppData\Local\Temp\e584590\winzip77-pp.exe
      run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\winzip77-pp.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1876
        3⤵
        • Program crash
        PID:1876
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4480 -ip 4480
    1⤵
      PID:4292

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          winzip77-pp.exe
          • Path C:\Users\Admin\AppData\Local\Temp\e584590\winzip77-pp.exe
          • Size 2.8MB
          • SHA256 a608bb3ec5b09cfa4eeb3b93d1b0a9fae0fe32a4fea3c60be2fdf8000238dec6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Load.html
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\Load.html
          • Size 2KB
          • SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          common.js
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\common\js\common.js
          • Size 45KB
          • SHA256 38d94300f8b4a82899eaeb4b2e8583fdd8f8040c0e5d8c666af4270b74c13e34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          external.js
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\common\js\external.js
          • Size 36B
          • SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
          • MD5 SHA1 SHA512
          Submit Download

          jquery-1.11.2.min.js
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\common\js\jquery-1.11.2.min.js
          • Size 93KB
          • SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          config.js
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\config\config.js
          • Size 5KB
          • SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installparams.js
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\config\installparams.js
          • Size 564B
          • SHA256 b8105a6af2d317c7de21ff10a79a8599ab32d17022997b38704e2406e6e03b72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          stubparams.js
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\config\stubparams.js
          • Size 37KB
          • SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          page.html
          • Path C:\Users\Admin\AppData\Local\Temp\e5847e1\pages\Initialization\page.html
          • Size 2KB
          • SHA256 4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/4480-110-0x0000000000E30000-0x0000000000EAE000-memory.dmp
          Download