7802333b4e4d478f300d870253e51a86b58b6e29f9a704f4762e636b52be6acf

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winzip77.exe
Size 2.8MB
Sample260604-wxap8act8p
SHA256 7802333b4e4d478f300d870253e51a86b58b6e29f9a704f4762e636b52be6acf
MD5 bdb55bc8d5dcc26d4d3a5adb269a1552
SHA1 7ed29547bc531714864ae6c4c1a58d20f74265e2
SHA512 b8bd83d5df6840ba0f0f0133e1d64ca9392846c2397f80609a97262280db9971d9823f589566223a6491d8d586d1ad5b4c86e42f52ad7fecd185d1ce3d604b8f
SSDEEP 49152:KhpwnruuTfa9RbGMTVGl5hVcqWiCA7CEcLQzQrvXXjehIRcNd5Y:W6rnDa9tG4OHOqWikQzQrvjehIR4Y
TLSH
T133D58E6139587036C1A30A30AD68FE79E1BD76F80F7125CB36948F2939B17C24A3597B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4312	winzip77.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3876	4312	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip77.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 4312	1916	winzip77.exe	79

C:\Users\Admin\AppData\Local\Temp\winzip77.exe
"C:\Users\Admin\AppData\Local\Temp\winzip77.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\e581529\winzip77.exe
  run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\winzip77.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 2100
    3⤵
    - Program crash
    PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4312 -ip 4312
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winzip77.exe

Path C:\Users\Admin\AppData\Local\Temp\e581529\winzip77.exe
Size 2.8MB
SHA256 7802333b4e4d478f300d870253e51a86b58b6e29f9a704f4762e636b52be6acf
MD5 bdb55bc8d5dcc26d4d3a5adb269a1552
SHA1 7ed29547bc531714864ae6c4c1a58d20f74265e2
SHA512 b8bd83d5df6840ba0f0f0133e1d64ca9392846c2397f80609a97262280db9971d9823f589566223a6491d8d586d1ad5b4c86e42f52ad7fecd185d1ce3d604b8f
SSDEEP 49152:KhpwnruuTfa9RbGMTVGl5hVcqWiCA7CEcLQzQrvXXjehIRcNd5Y:W6rnDa9tG4OHOqWikQzQrvjehIR4Y
TLSH
T133D58E6139587036C1A30A30AD68FE79E1BD76F80F7125CB36948F2939B17C24A3597B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Load.html

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\Load.html
Size 2KB
SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
MD5 1757c2d0841f85052f85d8d3cd03a827
SHA1 801b085330505bad85e7a5af69e6d15d962a7c3a
SHA512 4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a
TLSH
T19541319F0C86DA52C13046BAD5BED1ACED0592631301CD9875DC71822FB8A988D77EE6
MD5 SHA1 SHA512 TLSH

Submit Download

common.js

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\common\js\common.js
Size 45KB
SHA256 38d94300f8b4a82899eaeb4b2e8583fdd8f8040c0e5d8c666af4270b74c13e34
MD5 e528e711cf4e1c2c1ca73cc9ee1bb562
SHA1 25a7a5c85cf5c737dc5e510c03010ba58e7d8a6f
SHA512 b0a4bb01e80f201cb16d0f54d290d038d58851f6ba03c20ad82c851186217b3ba9bd4b2f16f83455b827decc8a16985314116dddcc34bdc4afe57c14c39198ca
SSDEEP 768:/2FvEEnIkeTIdMTSWz32eIWs/Bxq2Jn22ZnIZLWZfDRY:IKIdMT7
TLSH
T11C23835D58462C15E972733C9B2F04C9EEA615630456D2007FAEB6C0AF7A414C2FAFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

external.js

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\common\js\external.js
Size 36B
SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
MD5 140918feded87fe0a5563a4080071258
SHA1 9a45488c130eba3a9279393d27d4a81080d9b96a
SHA512 56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6
MD5 SHA1 SHA512

Submit Download

jquery-1.11.2.min.js

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\common\js\jquery-1.11.2.min.js
Size 93KB
SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
MD5 5790ead7ad3ba27397aedfa3d263b867
SHA1 8130544c215fe5d1ec081d83461bf4a711e74882
SHA512 781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a
SSDEEP 1536:5P1vk7i6GUHdXXeyQazBu+4HhiO2AEeLNFoqqhJ7SerN5sVI6xcBgPv7E+nzms9d:A4Ud4qhJvNPqcB47MfWWca98HrB
TLSH
T17793D8D9B7D67062977730B850BF510BB13A98EAB80C4C60F1A4D8E47E74A89507BF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.js

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\config\config.js
Size 5KB
SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
MD5 34f8eb4ea7d667d961dccfa7cfd8d194
SHA1 80ca002efed52a92daeed1477f40c437a6541a07
SHA512 b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50
SSDEEP 96:7pD675DZ4J+52Hz55KcQua5UGRP+w9lGPONIXsmkD8MKSt4DQ4semlIiiIp6+PEz:VD67pmNeuf+P+ilyON4ZfDQ8P+PEz
TLSH
T111C186DF2988423F39800361927F1DD5EB96CF16E505496331BFE694AB3746080AB6DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installparams.js

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\config\installparams.js
Size 556B
SHA256 c9598accd0aff0165421bdfd9a3454fa5d730b3deafcc9bacc64dbab3499afa7
MD5 30634c81be55b6ecb551e0b140abea53
SHA1 1da7ba96218bc87217ae19f8d29c04b96f71e801
SHA512 03b4f31fecc8b41c07e23c1110410c774baf1731b0c613576e030eeef448052fc26512b8664958a47f4e5b04d687b8e684f8f62d81ba79f13b33947ec03bcd59
TLSH
T13EF0C08A12C3849B3C42255C646C1ED5771345BC56E4615EB7F0EDDC43DCD3D0C2B084
MD5 SHA1 SHA512 TLSH

Submit Download

stubparams.js

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\config\stubparams.js
Size 37KB
SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
MD5 91f6304d426d676ec9365c3e1ff249d5
SHA1 05a3456160862fbaf5b4a96aeb43c722e0a148da
SHA512 530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4
SSDEEP 384:6KJtKKAJC3/XlBT4/15kWiMi6/Aqlsa4WBw1+M7QmhWSbBpL3dkFpdpSVk1n8E:xKKAJC39FQniOlsaZwf7Q3SbbQp8E
TLSH
T1A803745FDD91AC171AB6174A7C9E4A07F228872FA005905B38BD811E4FB3DACD1672B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page.html

Path C:\Users\Admin\AppData\Local\Temp\e5816a0\pages\Initialization\page.html
Size 2KB
SHA256 4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
MD5 b23411777957312ec2a28cf8da6bcb4a
SHA1 6dd3bdf8be0abb5cb8bf63a35de95c8304f5e7c7
SHA512 e520b4096949a6d7648c197a57f8ce5462adb2cc260ccac712e5b939e7d259f1eee0dfc782959f3ea689befce99cddf38b56a2cc140566870b045114e9b240dc
TLSH
T1235125165CC6D86780B289C1C5B1FA19EE4097039349DD4472EC67EB6FF3E888C17AA4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads