2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3

Analysis

max time kernel
898s
max time network
424s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Size 107KB
Sample260715-e1bm9abw3n
SHA256 2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3
MD5 f9a22315670147c91e2e044403f8e791
SHA1 a0407ef0c23fc82c831b2e2fef48048e98c17e56
SHA512 865f71d0ddc09506fea34aaf481f79469c7fbcb523dcf4f6967a4f55ad4d17907e1294c21f5e7dae96844d54a5e16174579b11256c8836ab3c17403f9a259d7f
SSDEEP 1536:M554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU+/I0:vswTbD6LLraInhEdlg5BJU+/I0
TLSH
T107B37D217980C032E8A714738DFCDA699A6CF9311B5598C7B3C84A6E0F617E1BF35267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 8eb38949abbdf2c77004c3f7dd1a33c923b0f5810afe09a27297bbc3887d699e
MD5 d6fee87e1ee3de4352f53b878d8e8bb6
SHA1 cc980ab83aecc6ff20b63b53999726c3f2570f1d
SHA512 2af692bb88c85b21599a5aa8a283b98e18c3b12a28d9d3a24a150388d66bbb1a978a99ae2f858c0a3896f09ca81f80ddd399501a7c8c4b0c1af7db19db7a74c1
TLSH
T16C316D2B35F91008A073BF46EFE8D5F7D76A79106949C85A41D2034F49D5680EE13A7F
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH