18fc38daf13abe5b65c9cb694bd551a1b1d11b9077b0f255a680f567c0c949aa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/05/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpuw3p2zee.exe
Size 58KB
Sample260525-2ba2raa141
SHA256 18fc38daf13abe5b65c9cb694bd551a1b1d11b9077b0f255a680f567c0c949aa
MD5 369f5611f6fb13cc2ae38611db75c758
SHA1 f408de3b5090acc339cc9cf45b9cb4b238c05098
SHA512 f6dfdfa7003f2dd7633670e7dd4231ed740ab4d2b4c34c3ec1f88d40c5de254026b8796b51f29d30bd897a7fc6283e3222374512be706557d4c35d7399bf1ee5
SSDEEP 768:RM5WaKyBevI8OHKA+hmXid6Z9HUEMyerTAzwavKCFC/nGVykmBdwxkpNZsP:S5P2vIg7dNrTAzZv3FaGU5LRm
TLSH
T19643F631A2E84915F66B43B45831475B6D327C365E68C8BFAB08AB5C3D3518FA6D0F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4592 set thread context of 3800	4592	tmpuw3p2zee.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	4796	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpuw3p2zee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpuw3p2zee.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	winver.exe
4796	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3392	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3392	Explorer.EXE
Token: SeCreatePagefilePrivilege	3392	Explorer.EXE
Token: SeShutdownPrivilege	3392	Explorer.EXE
Token: SeCreatePagefilePrivilege	3392	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4796	winver.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4592	tmpuw3p2zee.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3800	4592	tmpuw3p2zee.exe	83
PID 4592 wrote to memory of 3800	4592	tmpuw3p2zee.exe	83
PID 4592 wrote to memory of 3800	4592	tmpuw3p2zee.exe	83
PID 3800 wrote to memory of 4796	3800	tmpuw3p2zee.exe	84
PID 4796 wrote to memory of 3392	4796	winver.exe	57
PID 4796 wrote to memory of 576	4796	winver.exe	52

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:576

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3392
- C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 424
        5⤵
        Program crash
        
        PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4796 -ip 4796
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-17-0x0000000000130000-0x0000000000136000-memory.dmp

Download

memory/576-13-0x0000000000130000-0x0000000000136000-memory.dmp

Download

memory/576-14-0x0000000000130000-0x0000000000136000-memory.dmp

Download

memory/3392-3-0x00000000025A0000-0x00000000025A6000-memory.dmp

Download

memory/3392-10-0x00007FFD6AB2D000-0x00007FFD6AB2E000-memory.dmp

Download

memory/3392-9-0x00000000025A0000-0x00000000025A6000-memory.dmp

Download

memory/3392-19-0x00007FFD6ACB0000-0x00007FFD6ACB1000-memory.dmp

Download

memory/3392-18-0x00007FFD6ACC0000-0x00007FFD6ACC1000-memory.dmp

Download

memory/3800-2-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4796-4-0x0000000002C90000-0x0000000002C96000-memory.dmp

Download

memory/4796-16-0x0000000002C90000-0x0000000002C96000-memory.dmp

Download

memory/4796-7-0x0000000002C90000-0x0000000002C96000-memory.dmp

Download

memory/4796-8-0x0000000077793000-0x0000000077794000-memory.dmp

Download