d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe
Size 7.5MB
Sample260730-p14n5sybmb
SHA256 d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d
MD5 522cc6319a8d8b9092ceea1f3ee8830d
SHA1 4b5259ab6df88decf999fcb6819c1da7abe5a61a
SHA512 6bb75a2117b78ed56b5298dd6dcbfe96e425a27eb0ad0ff7264e9ee58eb0cdb283fbe3641a10f2c2174a0db062d820fd92f13b17d0f204db6576678b7bd5a001
SSDEEP 98304:Z3Tb1Oy7kKglx4t4XxoD9z4YrZHh1FPeoolALAIx:Z3n7k7x4texWvrZHFHo
TLSH
T1D77638906A808319E893097CF43BD6A9C5E92D2D232D9CCFD27C3E6825313F1D67579A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe

Executes dropped EXE 1 IoCs

pid	Process
2312	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2312	uninstall.exe
2312	uninstall.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2312	uninstall.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2312	4400	d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe	84

C:\Users\Admin\AppData\Local\Temp\d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe
"C:\Users\Admin\AppData\Local\Temp\d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\PlayerFab\64FA04C79C214130B6A34666D606F2F6\uninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\PlayerFab\64FA04C79C214130B6A34666D606F2F6\uninstall.exe" /uninstall /file"C:\Users\Admin\AppData\Local\Temp\d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\PlayerFab\64FA04C79C214130B6A34666D606F2F6\uninstall.exe
Size 7.5MB
SHA256 d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d
MD5 522cc6319a8d8b9092ceea1f3ee8830d
SHA1 4b5259ab6df88decf999fcb6819c1da7abe5a61a
SHA512 6bb75a2117b78ed56b5298dd6dcbfe96e425a27eb0ad0ff7264e9ee58eb0cdb283fbe3641a10f2c2174a0db062d820fd92f13b17d0f204db6576678b7bd5a001
SSDEEP 98304:Z3Tb1Oy7kKglx4t4XxoD9z4YrZHh1FPeoolALAIx:Z3n7k7x4texWvrZHFHo
TLSH
T1D77638906A808319E893097CF43BD6A9C5E92D2D232D9CCFD27C3E6825313F1D67579A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Users\Admin\Documents\DVDFab\PlayerFab\Log\install.log
Size 779B
SHA256 62acef84e35f0098365f0d09cc98f7c29eec3aaa0aa77fc967b1037b2b21cad4
MD5 1596fb59a373a56b24567c9d3cf2d421
SHA1 24fa6e044e7d28592ef02385cbe109b32a8a8361
SHA512 2fed19e4def4b4202a99d4f16d353348947e3c8ecdb3c92dc92427b47839762924b141d8b2ec044196175b9ba6907d4d99b271030e38c5ba8129dec3f386ad59
TLSH
T113017B690EB2859D2848C0935EA7EA4DD0F6FD4C378EB71477B1441013C0626DF5EBAE
MD5 SHA1 SHA512 TLSH

Submit Download