Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 22:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpuw3p2zee.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpuw3p2zee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpuw3p2zee.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target tmpuw3p2zee.exe
- Size 58KB
- Sample260525-2ba2raa141
- SHA256 18fc38daf13abe5b65c9cb694bd551a1b1d11b9077b0f255a680f567c0c949aa
- MD5 369f5611f6fb13cc2ae38611db75c758
- SHA1 f408de3b5090acc339cc9cf45b9cb4b238c05098
- SHA512 f6dfdfa7003f2dd7633670e7dd4231ed740ab4d2b4c34c3ec1f88d40c5de254026b8796b51f29d30bd897a7fc6283e3222374512be706557d4c35d7399bf1ee5
- SSDEEP 768:RM5WaKyBevI8OHKA+hmXid6Z9HUEMyerTAzwavKCFC/nGVykmBdwxkpNZsP:S5P2vIg7dNrTAzZv3FaGU5LRm
- TLSH T19643F631A2E84915F66B43B45831475B6D327C365E68C8BFAB08AB5C3D3518FA6D0F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3956 set thread context of 5660 3956 tmpuw3p2zee.exe 80 - Program crash 1 IoCs
pid pid_target Process procid_target 5212 4836 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpuw3p2zee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpuw3p2zee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4836 winver.exe 4836 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3212 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4836 winver.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3956 tmpuw3p2zee.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3956 wrote to memory of 5660 3956 tmpuw3p2zee.exe 80 PID 3956 wrote to memory of 5660 3956 tmpuw3p2zee.exe 80 PID 3956 wrote to memory of 5660 3956 tmpuw3p2zee.exe 80 PID 5660 wrote to memory of 4836 5660 tmpuw3p2zee.exe 81 PID 4836 wrote to memory of 3212 4836 winver.exe 54 PID 4836 wrote to memory of 720 4836 winver.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:720
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 4325⤵
- Program crash
PID:5212
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4836 -ip 48361⤵PID:2548