5a546c344dc4f1b09c6c6f328ba7a5d6c2e1e3387440750349dd4ca2418e3d13

Analysis

user interaction
yes
max time kernel
270s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Epson_ES-50_EA_50_Web.exe
Size 2.4MB
Sample260701-e3jrmses9k
SHA256 5a546c344dc4f1b09c6c6f328ba7a5d6c2e1e3387440750349dd4ca2418e3d13
MD5 da23aab37eb9c6771bc6c3c4ef0423d8
SHA1 715a2b533308185bb6205d44bd193c98e4a7c7f3
SHA512 df4533990de17352fcc42a1ee00ebbdc0a1048aa1df724307658c60cb817e6971c14c62f61375655ca0cb63257d3053cf53b45e8869f83f45d3e3c75b671ea28
SSDEEP 49152:QCz076GIcZSmS78Ei9zZNINdC2ZwA3jcEs9Rewuo6psJ2GhF7E7k:Fw1I9mS8AluA3jc9ReVoN2GJ
TLSH
T19CC59AF29E9EF5ACFD1838389995B074DB2E68361EA0C0E13B6DA10D0BFF1606531567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4232	Epson_ES-50_EA_50_Web.tmp
3184	InstallNavi.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epson_ES-50_EA_50_Web.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epson_ES-50_EA_50_Web.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallNavi.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3748-0-0x0000000000400000-0x000000000046E000-memory.dmp	innosetup
behavioral1/memory/3748-125-0x0000000000400000-0x000000000046E000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4232	Epson_ES-50_EA_50_Web.tmp
4232	Epson_ES-50_EA_50_Web.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4232	Epson_ES-50_EA_50_Web.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3184	InstallNavi.exe
3184	InstallNavi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 4232	3748	Epson_ES-50_EA_50_Web.exe	84
PID 4232 wrote to memory of 3184	4232	Epson_ES-50_EA_50_Web.tmp	85

C:\Users\Admin\AppData\Local\Temp\Epson_ES-50_EA_50_Web.exe
"C:\Users\Admin\AppData\Local\Temp\Epson_ES-50_EA_50_Web.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\is-DOH94.tmp\Epson_ES-50_EA_50_Web.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DOH94.tmp\Epson_ES-50_EA_50_Web.tmp" /SL5="$7021E,2084627,410624,C:\Users\Admin\AppData\Local\Temp\Epson_ES-50_EA_50_Web.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\ES-50_(EA)\Downloader\InstallNavi.exe
    "C:\Users\Admin\AppData\Local\Temp\ES-50_(EA)\Downloader\InstallNavi.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallNavi.exe

Path C:\Users\Admin\AppData\Local\Temp\ES-50_(EA)\Downloader\InstallNavi.exe
Size 3.9MB
SHA256 741fe97484478bdfd4a1c53d8d95003594abb5c8c95e28c8376d4097cb792774
MD5 667a485aba9f5c0477fec57a1d9c8a7b
SHA1 07c1b81a1e3539956c3db0692d7210198a08568f
SHA512 7af7614db1808ff75d5627688fa7fcb0385ded71411669bb2fc12cc47ff08bb217339d037bb2d89bf2d7f126b67f8ab4f99566e8bf3463bda161c93a775f88a8
SSDEEP 98304:cxZvPNn7lLpSXF3FP1hXEmKSmlYzl3gFZjiKY0pOHM6KquMjsTbX1yJjbbK+uJbu:wN7l9Sr1KSmluMuFgVP8FLOyomFHKnPE
TLSH
T1FD16B0213EE9447BD16305729AE8A338D2FEBD602B36014722947E6969F1FC17729D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

string.us

Path C:\Users\Admin\AppData\Local\Temp\ES-50_(EA)\Downloader\_res\_style\string.us
Size 1KB
SHA256 8142fe6f97a99dee951cb75fd33c71ee090a2729a2ee16dff488ae1b277a1bf7
MD5 363a7a4132a02cc19a4c34d20e42dcc9
SHA1 c67a9fc6b88292a63741ea88a0c2d8d7c2c4d7b2
SHA512 e029071c6e3352566b4aff0035de29635a57d5e1c6e8190bdca193dc435bb15f2711c23985a1912b32d2cb08582a4f32a8a5a800cf33b8a8487177a4a1c62b2f
TLSH
T1D221034223F80148BAF37B01AAB98C30497BBCAD993AC21C558D184E07F3A509D65FB7
MD5 SHA1 SHA512 TLSH

Submit Download

Epson_ES-50_EA_50_Web.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DOH94.tmp\Epson_ES-50_EA_50_Web.tmp
Size 1.4MB
SHA256 186b4df60d151163fc20458e8898d4f18b4211d5acd5507a0b47783b94d87e79
MD5 61962da9e47c271d73a95aaab5574154
SHA1 32ebe380462e70939dbf9aa7c7c54475df6e81b8
SHA512 01875693d9283054e20c9be329ce568e8cd59954e5c69986f1bcdff07aacec8b30a4d384fe1812cbdd2b028445deee596dab6162a73b847912ecb0ddc3426cf1
SSDEEP 24576:OnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtszpqx9D67273:0HeKh4nqzF3PYdStsz8A7273
TLSH
T1FB65D6B19E9AF03EF8223A348D56F174DA2A79311F64D4C93FAC590C0BBF6606935253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3748-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3748-125-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4232-5-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/4232-124-0x0000000000400000-0x0000000000574000-memory.dmp

Download