fda20fa2de27af1baa38cc23b7d5d1748025c38ffe66b1ecc44814d7adfb0f0c

Analysis

user interaction
yes
max time kernel
149s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Build.zip
Size 1.9MB
Sample260429-l2j5caev3m
SHA256 fda20fa2de27af1baa38cc23b7d5d1748025c38ffe66b1ecc44814d7adfb0f0c
MD5 6378a9b92ec6d2e37e14a36913e1eb02
SHA1 fad69ed868e0dcaa6a4cc71f01a9f1d59abf3e93
SHA512 05533f07a17f067aff19443813e70e949adf1a47ccaed67fbd2cd93169c390b5a8d6aff3cb925bfdb49b574951089b9dfacd827a34a45fd23baa2cbea1e526da
SSDEEP 24576:W8A5Wjfto0WZBihvCwn57ncjuaVeRE3uwELvssZWnOXT28+vWoLpNnNKNPTWBwzC:WS2Wn57n4Fe53tj2nvzpNnNKNwodG8pc
TLSH
T182953305DA466B69D4075FB4D166A200AD20C78CBBE380432739DFE18F45CBB5E26EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	mm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	mm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	mm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	mm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5924	WMIC.exe
Token: SeSecurityPrivilege	5924	WMIC.exe
Token: SeTakeOwnershipPrivilege	5924	WMIC.exe
Token: SeLoadDriverPrivilege	5924	WMIC.exe
Token: SeSystemProfilePrivilege	5924	WMIC.exe
Token: SeSystemtimePrivilege	5924	WMIC.exe
Token: SeProfSingleProcessPrivilege	5924	WMIC.exe
Token: SeIncBasePriorityPrivilege	5924	WMIC.exe
Token: SeCreatePagefilePrivilege	5924	WMIC.exe
Token: SeBackupPrivilege	5924	WMIC.exe
Token: SeRestorePrivilege	5924	WMIC.exe
Token: SeShutdownPrivilege	5924	WMIC.exe
Token: SeDebugPrivilege	5924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5924	WMIC.exe
Token: SeRemoteShutdownPrivilege	5924	WMIC.exe
Token: SeUndockPrivilege	5924	WMIC.exe
Token: SeManageVolumePrivilege	5924	WMIC.exe
Token: 33	5924	WMIC.exe
Token: 34	5924	WMIC.exe
Token: 35	5924	WMIC.exe
Token: 36	5924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5924	WMIC.exe
Token: SeSecurityPrivilege	5924	WMIC.exe
Token: SeTakeOwnershipPrivilege	5924	WMIC.exe
Token: SeLoadDriverPrivilege	5924	WMIC.exe
Token: SeSystemProfilePrivilege	5924	WMIC.exe
Token: SeSystemtimePrivilege	5924	WMIC.exe
Token: SeProfSingleProcessPrivilege	5924	WMIC.exe
Token: SeIncBasePriorityPrivilege	5924	WMIC.exe
Token: SeCreatePagefilePrivilege	5924	WMIC.exe
Token: SeBackupPrivilege	5924	WMIC.exe
Token: SeRestorePrivilege	5924	WMIC.exe
Token: SeShutdownPrivilege	5924	WMIC.exe
Token: SeDebugPrivilege	5924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5924	WMIC.exe
Token: SeRemoteShutdownPrivilege	5924	WMIC.exe
Token: SeUndockPrivilege	5924	WMIC.exe
Token: SeManageVolumePrivilege	5924	WMIC.exe
Token: 33	5924	WMIC.exe
Token: 34	5924	WMIC.exe
Token: 35	5924	WMIC.exe
Token: 36	5924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1572	WMIC.exe
Token: SeSecurityPrivilege	1572	WMIC.exe
Token: SeTakeOwnershipPrivilege	1572	WMIC.exe
Token: SeLoadDriverPrivilege	1572	WMIC.exe
Token: SeSystemProfilePrivilege	1572	WMIC.exe
Token: SeSystemtimePrivilege	1572	WMIC.exe
Token: SeProfSingleProcessPrivilege	1572	WMIC.exe
Token: SeIncBasePriorityPrivilege	1572	WMIC.exe
Token: SeCreatePagefilePrivilege	1572	WMIC.exe
Token: SeBackupPrivilege	1572	WMIC.exe
Token: SeRestorePrivilege	1572	WMIC.exe
Token: SeShutdownPrivilege	1572	WMIC.exe
Token: SeDebugPrivilege	1572	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1572	WMIC.exe
Token: SeRemoteShutdownPrivilege	1572	WMIC.exe
Token: SeUndockPrivilege	1572	WMIC.exe
Token: SeManageVolumePrivilege	1572	WMIC.exe
Token: 33	1572	WMIC.exe
Token: 34	1572	WMIC.exe
Token: 35	1572	WMIC.exe
Token: 36	1572	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1572	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2156	mm.exe
4904	mm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1144	2156	mm.exe	85
PID 1144 wrote to memory of 5924	1144	cmd.exe	87
PID 2156 wrote to memory of 2252	2156	mm.exe	89
PID 2252 wrote to memory of 1572	2252	cmd.exe	91
PID 2156 wrote to memory of 4536	2156	mm.exe	92
PID 4536 wrote to memory of 948	4536	cmd.exe	94
PID 2156 wrote to memory of 2276	2156	mm.exe	95
PID 2276 wrote to memory of 616	2276	cmd.exe	97
PID 4904 wrote to memory of 6012	4904	mm.exe	100
PID 6012 wrote to memory of 1832	6012	cmd.exe	102
PID 4904 wrote to memory of 1692	4904	mm.exe	103
PID 1692 wrote to memory of 5992	1692	cmd.exe	105
PID 4904 wrote to memory of 1528	4904	mm.exe	106
PID 1528 wrote to memory of 1684	1528	cmd.exe	108
PID 4904 wrote to memory of 3956	4904	mm.exe	109
PID 3956 wrote to memory of 104	3956	cmd.exe	111

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Build.zip
1⤵
PID:4676

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4008

C:\Users\Admin\Desktop\Build\Build\mm.exe
"C:\Users\Admin\Desktop\Build\Build\mm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic cpu get ProcessorId /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get ProcessorId /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic baseboard get SerialNumber /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic baseboard get SerialNumber /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic bios get SerialNumber /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic bios get SerialNumber /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic diskdrive get SerialNumber /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616

C:\Users\Admin\Desktop\Build\Build\mm.exe
"C:\Users\Admin\Desktop\Build\Build\mm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic cpu get ProcessorId /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get ProcessorId /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic baseboard get SerialNumber /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic baseboard get SerialNumber /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic bios get SerialNumber /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic bios get SerialNumber /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic diskdrive get SerialNumber /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic diskdrive get SerialNumber /format:list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.license

Path C:\Users\Admin\Desktop\Build\Build\.license
Size 132B
SHA256 5976c5537a5142fbc6d4ed1fb54e10480b434e6ffab3253d6ff0b8110a1eef34
MD5 4d5d69905f869fa070c6a4404da7c864
SHA1 f3cfaf3df162ef31ae5f574b00ecb8f45129c200
SHA512 a7c82254a1ed58a8e11756c622009bae5d09dc0a23b1e8a0b33242f4f652024f61005f7d7817132532abda41bef8edfb2c9fd05283908f92d7bc6b27ddd5079a
TLSH
T179C02BE2080146270465003070B32E7085123131A88680FB1353B81732944C104B8176
MD5 SHA1 SHA512 TLSH

Submit Download

auth.dat

Path C:\Users\Admin\Desktop\Build\Build\auth.dat
Size 8B
SHA256 f673f802d3328eac24398fdc0462f912a1063dc524dc3a205b375502e4811325
MD5 1fb10e6f212971487979cd5f91a242f7
SHA1 bb3f29baf55a4a66117242df15cdf90e3509c105
SHA512 94ee5534f22ec4395accdee53cabe046eb96e9f5895d0c31593bdc05d83c28066e72c280eef5529c145d1e0a8dd9cd6918a37934e23342f544aa57058e49f206
MD5 SHA1 SHA512

Submit Download

memory/2156-11-0x00000000751D0000-0x000000007544A000-memory.dmp

Download

memory/2156-8-0x0000000000C50000-0x0000000000CCA000-memory.dmp

Download

memory/2156-9-0x0000000075470000-0x00000000754A9000-memory.dmp

Download

memory/2156-12-0x0000000074F90000-0x00000000751C9000-memory.dmp

Download

memory/2156-13-0x0000000001490000-0x00000000014F4000-memory.dmp

Download

memory/2156-10-0x0000000075450000-0x0000000075469000-memory.dmp

Download

memory/4904-24-0x0000000000C50000-0x0000000000CCA000-memory.dmp

Download

memory/4904-27-0x0000000075210000-0x0000000075449000-memory.dmp

Download

memory/4904-26-0x0000000075450000-0x0000000075469000-memory.dmp

Download

memory/4904-28-0x0000000074F90000-0x000000007520A000-memory.dmp

Download

memory/4904-25-0x0000000075470000-0x00000000754A9000-memory.dmp

Download

memory/4904-29-0x00000000013D0000-0x0000000001434000-memory.dmp

Download

memory/4904-33-0x0000000075210000-0x0000000075449000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads