Analysis
- user interaction
yes - max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 22:08
Behavioral task
behavioral1
Sample
winzip11.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target winzip11.exe
- Size 5.6MB
- Sample260710-12jadaew4x
- SHA256 7cf4c2cd94cf6eb9dd0fe65fbea08d8e8d62385b33b02af6cb2e14ecae6656d9
- MD5 4bf2bbe05bcd27eb014def7494fc0868
- SHA1 41b53cdeb136b1cfc7a4f8466e7532ff0b007a18
- SHA512 c5f40313cf7376054ba5e4be5fb771b4f7b9f35a372423d7483865fe82ed1dac921a2eaf7ec1fce08dea630bb77f3e65a0202157660f56409b92e500c9bb8e1e
- SSDEEP 98304:4HHX3vBSRH8nIp8NuJvbDMtzzHJ0lY+m7hVOJz6koHxD0bezY05Z8VXFjpx:4nHQRHZ3JjDMtzJ0ngVuzmpzojpx
- TLSH T12346338390E4BE40EA207032B572DE242238CCB7992D3D535F7C591B7DFB25825A56AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3864-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/3864-12-0x0000000000400000-0x000000000047D000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\COE\WinZip110\WinZip110_202607102308.log winzip11.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winzip11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language winzip11.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\COE\WinZip110\WinZip110_202607102308.log
- Size 452B
- SHA256 db20e99603ecbffd1c81667a6ffee49deaba82e391c9f8f609a4c9b85ee8daed
- MD5 6a78a36c69c8ef2a9842f58f0147a7ef
- SHA1 935c694613003f1ed28b9f1de840f414b9a1a992
- SHA512 816a6cb4c3a3d85cd9b427fbce8f56e8fd488fc7842276b6c8999ab1ceca8be7f956aa3ec7fd407c97abf7bc815043884b3ad6b489cabd54fafb672b375640ba
- TLSH T141F03956917405B4B9024369892F0E4EB6D2F28373CC3244BBBED392035108FCE3E205
- MD5 SHA1 SHA512 TLSH