6682a3330604aaf31f6916ddbf3b78251abda3a019d15a53b1ce33b72d5cd072

Resubmissions

20/06/2026, 04:12

260620-eskwyset5v3

20/06/2026, 04:08

260620-eqg3aaet4z8

20/06/2026, 04:05

260620-entnaset4x8

Analysis

user interaction
yes
max time kernel
898s
max time network
715s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamAchievementManager-7.0.41.zip
Size 55KB
Sample260620-entnaset4x
SHA256 6682a3330604aaf31f6916ddbf3b78251abda3a019d15a53b1ce33b72d5cd072
MD5 29e63de8febe21c5fcf3df5b25971366
SHA1 b22697b6bb31563c14452e3342679f6d2cd7576f
SHA512 4d38b47164b322ad9bc657ecb5b490ecc5235bfa6f3103040b194730f85c747e11c968f76ba6db5d4952820035b5f77ff67dac563a45479f344f04dbba07cfad
SSDEEP 1536:Frh2jtHLlBz6MVu2k5a11V08DG6ChP5tVLI:FUjtHKMvF1a8KVk
TLSH
T113430154C2CFA6B5CF22CD322DDCD95B4A81AA86D24B5DC457C840D9CF3EA07E2ADB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SteamAchievementManager-7.0.41.zip
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3268

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4960

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1280

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads