7cb45ac31d75f33865511dbbfb86de8d4e79dc4a168ca34986538abbc68d69b0

Analysis

user interaction
yes
max time kernel
149s
max time network
155s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fake-malware.exe
Size 89KB
Sample260522-zyemcaey8l
SHA256 7cb45ac31d75f33865511dbbfb86de8d4e79dc4a168ca34986538abbc68d69b0
MD5 868254a4c4676de775997075de5a453c
SHA1 477aaf15fa5b98c1b9d04122d993f835d1b67dd8
SHA512 84ca467b873f16be51354f3fd86706540315dc55459c686b3e8a22d933b27264b23ba84967e0944eacd34c64230cf5aabbac35f647f8bdf4a9f23e87415428ac
SSDEEP 1536:77fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfLwF7O5:X7DhdC6kzWypvaQ0FxyNTBfLh
TLSH
T1D3936D41F3E202F7EAF1093100A6716F973663389764A8EBC74C2D529913AD5A63D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fake-malware.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3244	4716	fake-malware.exe	83
PID 3244 wrote to memory of 3428	3244	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\fake-malware.exe
"C:\Users\Admin\AppData\Local\Temp\fake-malware.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1EF.tmp\200.tmp\201.bat C:\Users\Admin\AppData\Local\Temp\fake-malware.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\system32\choice.exe
    choice /C YN /M "You have been hacked (ACCEPT YOUR FATE/TRY DELETE MALWARE)"
    3⤵
    PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

201.bat

Path C:\Users\Admin\AppData\Local\Temp\1EF.tmp\200.tmp\201.bat
Size 324B
SHA256 947fb26762ba45b6ec89d6c988ab19acbb6d5c3fa7b55485d9ee8acd89e19717
MD5 06c7333a5eb76d8db20a50d05a1e1031
SHA1 36aceda614bb275ede3ab61f5905b4b073f87810
SHA512 94494ded3efc28ecd9d20fa96e06dfb3463e0215d718ed6b2be67becd43fb034dbfaf2e9181de2d187b2948366cdc212e3edf54b4e422a6b0ed04c4b6750fc39
TLSH
T1CDE0D83774910052A4A100C25868D045F96408A7216A67467CE314322C162E4FE1DE75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4716-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download