1faabd2b923a9015d224e157578475aebad9e156f068b6d386e7c3087416ffce

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 21:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1faabd2b923a9015d224e157578475aebad9e156f068b6d386e7c3087416ffce.exe
Size 519KB
Sample260721-zw52hsfd52
SHA256 1faabd2b923a9015d224e157578475aebad9e156f068b6d386e7c3087416ffce
MD5 65754f4cd7a475aefe856e392d10db4a
SHA1 759610dd4a1f208df36d97d76e79087a64f8ef8a
SHA512 4ee72c10dc91372da6becb29a17f13c155de582b5b8614d2505ce1fdedc6923e3882b0bf0df95189b9324b770250e60017502f110ab44fb2f32d4fe5e484dde5
SSDEEP 6144:a0jO11c4qooQb/X5/LYSgPHLeoQWFHirVcEOkCybEaQRXr9HNdvOa:aR1O4q0D5/USgPHLeomlOkx2LIa
TLSH
T116B46D2AB6A0D036C4779574C4A296A6FFB1B4213B318ACFA39047561F637D2BE3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5836-0-0x00000000007B0000-0x000000000083A000-memory.dmp	upx
behavioral2/memory/5836-1-0x00000000007B0000-0x000000000083A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
260	5836	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1faabd2b923a9015d224e157578475aebad9e156f068b6d386e7c3087416ffce.exe

C:\Users\Admin\AppData\Local\Temp\1faabd2b923a9015d224e157578475aebad9e156f068b6d386e7c3087416ffce.exe
"C:\Users\Admin\AppData\Local\Temp\1faabd2b923a9015d224e157578475aebad9e156f068b6d386e7c3087416ffce.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 472
  2⤵
  - Program crash
  PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5836 -ip 5836
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5836-0-0x00000000007B0000-0x000000000083A000-memory.dmp

Download

memory/5836-1-0x00000000007B0000-0x000000000083A000-memory.dmp