d702a0e95cfd9f78c9bb70a29a399d277bcff87b5ca29301bfe3ac0a8ca056a3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-fr
resource tags

arch:x64arch:x86image:win10v2004-20260130-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer Automatiquement.exe
Size 171KB
Sample260511-ym477ac14q
SHA256 d702a0e95cfd9f78c9bb70a29a399d277bcff87b5ca29301bfe3ac0a8ca056a3
MD5 3e7069e6617bd5d3f8f47ec48345d672
SHA1 cf964e38aede86f89cb508aa4baf3e55106ea9a4
SHA512 93e58e637c6d22a1ccb42579f85b0fc96583b63f509e3feeb07e1cdb45bbc125f9e4deab0f185c7fb6a044ce9f54030b020ccdd97152ed8533e15e0e1f4d112e
SSDEEP 3072:eV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPOdkk+5G7oflL/0eYx:Lt5hBPi0BW69hd1MMdxPe9N9uA069TBy
TLSH
T139047B6AB2E41198EBF581F2D5520746EB7074321B11A3DB5B7863B71B2B8C58F7C3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	Installer Automatiquement.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4264	4556	Installer Automatiquement.exe	84
PID 4264 wrote to memory of 3972	4264	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Installer Automatiquement.exe
"C:\Users\Admin\AppData\Local\Temp\Installer Automatiquement.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\25F2.tmp\25F3.tmp\25F4.bat "C:\Users\Admin\AppData\Local\Temp\Installer Automatiquement.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\msg.exe
    msg * "Erreur : Le fichier Discord est obligatoire et doit contenir les bonnes informations / The file Discord is mandatory and must contain the correct information."
    3⤵
    PID:3972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25F4.bat

Path C:\Users\Admin\AppData\Local\Temp\25F2.tmp\25F3.tmp\25F4.bat
Size 7KB
SHA256 a845cf5ce05f8867d59aa608c99d48f00b61e340840bd2f0daf0e88266dc50e8
MD5 69c156c36e7c093421443059df6a4ce0
SHA1 42608b7dff1943de96d98cf04429a81b57498414
SHA512 971085f2a241317026fd0ee160621e3aee55f9a23ee66bb7dfc2edacc0d2ac260c96cde5ab513a79a02ba4f35e77bac78336482432bb06660b42f7c1ca9427dd
SSDEEP 96:VkH0wHCGkTTL4bRB/L89At4vM8Wt9PfEi/HIpnYvttMfEi/H/pnKt4vjcrFtL7BF:qH1HD07ReHEi/o4yEi/fHLcrL
TLSH
T1EFF15304BF0CBB7426D4F365EA349904E32AE3CD6289BD15ED0EBC581756AE3607C6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3256-4-0x00000182C82A0000-0x00000182C82D0000-memory.dmp

Download

memory/3972-2-0x000001B0022E0000-0x000001B002310000-memory.dmp

Download

memory/4556-3-0x0000000000720000-0x0000000000750000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads