67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe
Size 2.0MB
Sample260604-ste9raas6l
SHA256 67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478
MD5 eba1ad16bc2fa284adae07cbebef8f7f
SHA1 225163dfd08838ae6bfec6e27994b92955013576
SHA512 909a8663ee28f43e7737f36707ee1a0195cd73e441dc4d2e6497d6bd7dad67465e21cdb0dd0e07511313673c1f8847c7a85966876165d197566dbbae8f34459b
SSDEEP 49152:iFOLMMFExN0CZb979qfWqcWMT2I9tH2gpNcjsUnlww3GJIV4p:gOIMqvTF9qf5cWMT99tH2s4sUnKoo
TLSH
T170A5E057CC098A53E5198BFDBE031E7D7A4E2F0C9D562BFE04324ECB6E242415C8B56A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4100	5092	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe

C:\Users\Admin\AppData\Local\Temp\67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe
"C:\Users\Admin\AppData\Local\Temp\67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 428
  2⤵
  - Program crash
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5092 -ip 5092
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads