2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3

Analysis

max time kernel
899s
max time network
481s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Size 107KB
Sample260715-e1bm9abw3n
SHA256 2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3
MD5 f9a22315670147c91e2e044403f8e791
SHA1 a0407ef0c23fc82c831b2e2fef48048e98c17e56
SHA512 865f71d0ddc09506fea34aaf481f79469c7fbcb523dcf4f6967a4f55ad4d17907e1294c21f5e7dae96844d54a5e16174579b11256c8836ab3c17403f9a259d7f
SSDEEP 1536:M554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU+/I0:vswTbD6LLraInhEdlg5BJU+/I0
TLSH
T107B37D217980C032E8A714738DFCDA699A6CF9311B5598C7B3C84A6E0F617E1BF35267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5056

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 df27279509d26d3373a6832d26e0ac3d5ab0b08a8f16af09cc4db67b4f8ab337
MD5 645b65a97bac60f9b31a22db62427492
SHA1 b274bdad634c7eaa5cb38758961b2e6210a518e0
SHA512 48ccce50da5f1f68e0b290fc9b39ae33299de5460e7ff1c75e3aa01f18769d023edbd58af4b7e033aea457a0a6fc1f0fc14f7536fe1ce0df3aade063a886edf4
TLSH
T1CD31792739F90008A073BF8AEFE8E5F7D76A79117949C85940D2034F49D5A80EA13A7B
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH