a99d03f0f96fb479b42f01a289413811e3c05090e3212f5bc1613d04f6fdfa67

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InterWinner8.10.4037.exe
Size 27.2MB
Sample260619-p9f97sf14p
SHA256 a99d03f0f96fb479b42f01a289413811e3c05090e3212f5bc1613d04f6fdfa67
MD5 892695e2a995022c2a9bf67a3d9d9b5a
SHA1 93bac93385da641b90f62d3f0dfdc98e9dd353dc
SHA512 77ee0813e0f1c6307f19a23a309974748f11154d0e60dc5d916fb20904e4b46c7d340a185aac7bd4dc73ce93465ede0c90ec9cf82895b9aba090fcc33276e78f
SSDEEP 786432:FY6L7CDsbL2aOySKqRXx4WFS/xOtPeVSItVqc:FY6vmsBOy9qRBjFS/xOtmVSIWc
TLSH
T1CA57337D65F1027EC3A38073C195B7722EEE6F6A29971407AF80E87699731E2670710B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2068	InterWinner8.10.4037.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InterWinner8.10.4037.exe

Suspicious use of SetWindowsHookAW 2 IoCs

pid	Process
2068	InterWinner8.10.4037.exe
2068	InterWinner8.10.4037.exe

C:\Users\Admin\AppData\Local\Temp\InterWinner8.10.4037.exe
"C:\Users\Admin\AppData\Local\Temp\InterWinner8.10.4037.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IWUNZIP.DLL

Path C:\Users\Admin\AppData\Local\Temp\INSTALL.IW\IWUNZIP.DLL
Size 137KB
SHA256 35c3adf79dcc6753f3bec3c63a39075990f48fd52041465fade0ad1e4a1aa051
MD5 a9ef418674bb2412b0a541bac0c6b09d
SHA1 f9afd16abed066501d97ca3cb0128b25dea97ffb
SHA512 c716834c6e1e9e9d808b3db1798765cc2fd658706159a21d6baa89f1929e2e4803f0833602d2d4ce7235c96769dc0398bd61b7723ae75d1b497c18151a5d6c2a
SSDEEP 3072:nWCDE6d2WQZx11o9Fav4uJXOpAzPNfIUfWTVzjgVigTz:W6d2LjFzXOpAzFgdVzA
TLSH
T1A1D36D41A8C9D0F1FA866238107BEBB75F34425722169583F75CDDF21A3A221E76E34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download