d800436b4cc0787ca1cf323c94a1d64a9afb9d8e2684d0056d9d19b1711ae17f

Resubmissions

28/06/2026, 05:29

260628-f6zspsft7q7

28/06/2026, 05:26

260628-f45wyaft4x3

28/06/2026, 05:13

260628-fwls4aft214

28/06/2026, 05:11

260628-ft8vvaft2y3

Analysis

user interaction
yes
max time kernel
509s
max time network
463s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FREE WAVE.exe
Size 426KB
Sample260628-fwls4aft21
SHA256 d800436b4cc0787ca1cf323c94a1d64a9afb9d8e2684d0056d9d19b1711ae17f
MD5 a1556ff30b9030c004b3f1357a341e07
SHA1 d355af8ba8ef82dfed17d420c778dee5360b4f55
SHA512 3c544711cc385cf795b2ca03f570d5878108be5e5e5237b2cc86492386f665090f651528a4fca1eb1f7f6300b4997d32a2f7ae0603749f84cda16d37a15428a9
SSDEEP 6144:H5rMrnpFjyWOhYsGBnKIEwnG3jAtkhVROe5cI/NZk49giIngf6XcnCOZ:OFWWJfnKI9gAuh7O8cYuiInK6kpZ
TLSH
T1BF94AE45F1F944F8C067A1399697A60FEE35340817304BDB23E8E5682BE37F496BA712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

C:\Users\Admin\AppData\Local\Temp\FREE WAVE.exe
"C:\Users\Admin\AppData\Local\Temp\FREE WAVE.exe"
1⤵
PID:3652

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3768

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads