1273bf55749d2ba299c094c34f32fb98ef0e7910748772e3c6008ed08e86a878

Analysis

user interaction
yes
max time kernel
10s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 119KB
Sample260718-sed35sd12q
SHA256 1273bf55749d2ba299c094c34f32fb98ef0e7910748772e3c6008ed08e86a878
MD5 bda9ecc0b9fde9e205240a511313cc7a
SHA1 415afbbd32b35c55edd1c9d2545dcfdd1a96f5aa
SHA512 61242f08e408a104b79054895d6f6d96cc6205831c12e478def6e6357241666df193590d4ea79b978425e3484ff2f270e01e7ad5eea25a576db024c803fc6f40
SSDEEP 1536:RsnkkOcSotb7B4eTZ+xg9vijvX0wndXUU4nQwmcShLt+xalyl9XpE:eS80WKpnSU4nQwtOt+xalylF
TLSH
T1B9C36C2131ECE4B1C4A540764846CF60773AFC621E799D8373E43E9F9E326C1E66A2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2956	3520	setup.exe	89

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TempDSUnload\CpInDSUnload.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CpInDSUnload.bat

Path C:\Users\Admin\AppData\Local\Temp\TempDSUnload\CpInDSUnload.bat
Size 577B
SHA256 56696b12bf575ef19c1b309e945efa9fe8ab18b25f8be5b760d1a040f851643e
MD5 fff1805fee7a17aac23c1a7fc238d329
SHA1 33fea67f451ff176b20cd77c61b4220af6ced72b
SHA512 bfd891043e3f53977b144d69592403993e2ca8f5c55dc5b88bc11443d299d42236e91548e24fe82a7436a2e79929d059dcf38121bbddc50a0641ed35b7ec082f
TLSH
T1B2F0970686C7CE29090959170AF6A64EC4E84A9EBE853FA08F20DC093282D0DF7C7722
MD5 SHA1 SHA512 TLSH

Submit Download