Overview

overview

5

Static

static

1

winzip77-pp.exe

windows10-2004-x64

5

winzip77-pp.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    178s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 06:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winzip77-pp.exe
  • Size 2.8MB
  • Sample260728-g67c8aff79
  • SHA256 a608bb3ec5b09cfa4eeb3b93d1b0a9fae0fe32a4fea3c60be2fdf8000238dec6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winzip77-pp.exe
    "C:\Users\Admin\AppData\Local\Temp\winzip77-pp.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Users\Admin\AppData\Local\Temp\e5974e8\winzip77-pp.exe
      run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\winzip77-pp.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 1840
        3⤵
        • Program crash
        PID:4684
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1640 -ip 1640
    1⤵
      PID:4760

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          winzip77-pp.exe
          • Path C:\Users\Admin\AppData\Local\Temp\e5974e8\winzip77-pp.exe
          • Size 2.8MB
          • SHA256 a608bb3ec5b09cfa4eeb3b93d1b0a9fae0fe32a4fea3c60be2fdf8000238dec6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Load.html
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\Load.html
          • Size 2KB
          • SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          common.css
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\common\css\common.css
          • Size 2KB
          • SHA256 265d280bad44060c22a6caef0140bb8085b994cdd8d76789f3a43a6e7f2a16ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          common.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\common\js\common.js
          • Size 45KB
          • SHA256 38d94300f8b4a82899eaeb4b2e8583fdd8f8040c0e5d8c666af4270b74c13e34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          external.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\common\js\external.js
          • Size 36B
          • SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
          • MD5 SHA1 SHA512
          Submit Download

          jquery-1.11.2.min.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\common\js\jquery-1.11.2.min.js
          • Size 93KB
          • SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          config.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\config\config.js
          • Size 5KB
          • SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installerlist.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\config\installerlist.js
          • Size 2KB
          • SHA256 df2f68a1db705dc49b25faf1c04d69e84e214142389898110f6abb821a980dcc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installparams.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\config\installparams.js
          • Size 564B
          • SHA256 b8105a6af2d317c7de21ff10a79a8599ab32d17022997b38704e2406e6e03b72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          stubparams.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\config\stubparams.js
          • Size 37KB
          • SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          features.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\pages\Initialization\features.js
          • Size 506B
          • SHA256 cba5152c525188a27394b48761362a9e119ef3d79761358a1e42c879c2fe08cc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          page.css
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\pages\Initialization\page.css
          • Size 66B
          • SHA256 cd804f5b34e9f8d0a7b085a0d9337b864e83d286b1408210343997f029fcc628
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          page.html
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\pages\Initialization\page.html
          • Size 2KB
          • SHA256 4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          page.js
          • Path C:\Users\Admin\AppData\Local\Temp\e597797\pages\Initialization\page.js
          • Size 2KB
          • SHA256 0135163476d0eb025e0b26e9d6b673730b76b61d3fd7c8ffcd064fc2c0c0682a
          • MD5 SHA1 SHA512 TLSH
          Submit Download