d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe
Size 7.5MB
Sample260730-p14n5sybmb
SHA256 d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d
MD5 522cc6319a8d8b9092ceea1f3ee8830d
SHA1 4b5259ab6df88decf999fcb6819c1da7abe5a61a
SHA512 6bb75a2117b78ed56b5298dd6dcbfe96e425a27eb0ad0ff7264e9ee58eb0cdb283fbe3641a10f2c2174a0db062d820fd92f13b17d0f204db6576678b7bd5a001
SSDEEP 98304:Z3Tb1Oy7kKglx4t4XxoD9z4YrZHh1FPeoolALAIx:Z3n7k7x4texWvrZHFHo
TLSH
T1D77638906A808319E893097CF43BD6A9C5E92D2D232D9CCFD27C3E6825313F1D67579A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4516	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	uninstall.exe
4516	uninstall.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 4516	5936	d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe	89

C:\Users\Admin\AppData\Local\Temp\d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe
"C:\Users\Admin\AppData\Local\Temp\d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Users\Admin\AppData\Local\Temp\PlayerFab\8D9E5ACBAD824764A64D962C66D9EC80\uninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\PlayerFab\8D9E5ACBAD824764A64D962C66D9EC80\uninstall.exe" /uninstall /file"C:\Users\Admin\AppData\Local\Temp\d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\PlayerFab\8D9E5ACBAD824764A64D962C66D9EC80\uninstall.exe
Size 7.5MB
SHA256 d7706d0e31d57be95c0669ac4b9d286c7e1b75b3e5433ca8c8ce7f25ef90743d
MD5 522cc6319a8d8b9092ceea1f3ee8830d
SHA1 4b5259ab6df88decf999fcb6819c1da7abe5a61a
SHA512 6bb75a2117b78ed56b5298dd6dcbfe96e425a27eb0ad0ff7264e9ee58eb0cdb283fbe3641a10f2c2174a0db062d820fd92f13b17d0f204db6576678b7bd5a001
SSDEEP 98304:Z3Tb1Oy7kKglx4t4XxoD9z4YrZHh1FPeoolALAIx:Z3n7k7x4texWvrZHFHo
TLSH
T1D77638906A808319E893097CF43BD6A9C5E92D2D232D9CCFD27C3E6825313F1D67579A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Users\Admin\Documents\DVDFab\PlayerFab\Log\install.log
Size 828B
SHA256 e62816a976bc4309cb9f7a0c21a8668c5470d3f45d59cc2ead5556c119030294
MD5 da81409af92437f737495e75a433a9a6
SHA1 bc4ca78bf7f7a7eb98a1b957788c6ba0fac7af0c
SHA512 98636f29eb96feadfdb26213d005d9d49afaff7f47c00f6dbccd5f36d631f25d642c7d16138b9351312301b139afab01554cc66709df562f0a1690f71ce0ca73
TLSH
T1CA019C250DF186AC2448D0925A67DB0FD1FAFD4A238F932873B07491438520ADE4E35E
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\Users\Admin\Documents\DVDFab\PlayerFab\Log\install.log
Size 336B
SHA256 732cff2ca3555f254621ea4dafad682494d3bf9991072c61598ad40d0020f9d6
MD5 6d07218f1476eda533864c02120f9d24
SHA1 622f2200849af7c78331649ad6583af0d687d7e5
SHA512 7fc8f28ec49b0a78e3a560e26f72b2bc1cec2fc3ee61827d051a196496de2e2ed9184e5d439188c445494d0aca330de3806eee88eeec0e09a01dfea148ebf363
TLSH
T18EE07D260DF0444C1048C09146A6D70FD1F9FC44235E921833F020510341201CE1D259
MD5 SHA1 SHA512 TLSH

Submit Download