33c272efb613da42cc5807a5780f19ea1de21bb20a8eea98556c0428fa5ff16f

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fun.exe
Size 14KB
Sample260529-tglrfaf18v
SHA256 33c272efb613da42cc5807a5780f19ea1de21bb20a8eea98556c0428fa5ff16f
MD5 968416360884ef2c9f69b60175c36a75
SHA1 bc556650dc0150e1976bb969570ac70a1ff5190a
SHA512 d4604b25282d9d6dbf950a7312b9c4e735bfcb731151dcb71f0e8cf5902a5ad77801d3deafe77d1e636d940bcd300d08f04f7bb6c6f6b6e716f5feedb0fb1e42
SSDEEP 192:4LMJno70kYcFamvaR9NdaLix5aqiSv/VunlYJLLLTuCmjDa8Jek+Iyn2qPj:4L0nUrFa19daLiHISXhPLTuCzfzP
TLSH
T1BD52522AB3EC0310F3BE5B360A7D93518936F9579833FF4D115DDC8E2B15A448AA1B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	fun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3768	5028	fun.exe	89
PID 3768 wrote to memory of 2468	3768	cmd.exe	91
PID 2468 wrote to memory of 1944	2468	net.exe	92

C:\Users\Admin\AppData\Local\Temp\fun.exe
"C:\Users\Admin\AppData\Local\Temp\fun.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.bat

Path C:\Users\Admin\AppData\Local\Temp\cmd.bat
Size 2KB
SHA256 2b67903e248d7d475ad4670a34a9ff0943c87dcff99367e441be3a6b04d14d52
MD5 0f4de94f217d7975444cde3dc900c7a3
SHA1 e1e967a9ed1bd27b25a06fe14729d46e55179b6c
SHA512 27c4cc4b124125ac8265db2916a9d37d30a02ba6518545ab7818d3cfb26c5df670d809df3af025e8c4290cc87cf9ca38abb450804c64c62832f87bdf547f02f6
TLSH
T1F751AC3F3B09C33555101994952EC94AABB8B086FDB0B55886D7C0E3B15FECAB2789D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5028-0-0x0000000000A30000-0x0000000000A3A000-memory.dmp

Download