f535325100ad36c2c55dcaa9bba67a4157c891069eb49160d943a0f1e21e97ec

Analysis

user interaction
yes
max time kernel
24s
max time network
20s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IttihadCPL.7z
Size 967KB
Sample260802-d55lfscf28
SHA256 f535325100ad36c2c55dcaa9bba67a4157c891069eb49160d943a0f1e21e97ec
MD5 e822ea037bb642717e66ef0ea97d2049
SHA1 7ca88a81b90d88f8ff3fccd142544a9030961de5
SHA512 f559ed5f2647cb68572741f8924bb4b153158e5e139930a23bf9f303771aa9e08a48a1c1da40a2126ef5b6461108ca552db6f0b0f61c41d7a94a9b32537b38bc
SSDEEP 24576:S24h8pQVnZmK8fzbQ5llg2HQIuQX3HV4NGlctHx8cig0Jy7x:74hVnZmhfz62dItnHu2+RtibJCx
TLSH
T1152533846771D5ABAB7F1D506C045168FDC8C182EA98CE235F8140EAAE6483FF05DADE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3384	zbe.Deobf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	3384	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zbe.Deobf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3108	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3108	7zFM.exe
Token: 35	3108	7zFM.exe
Token: SeSecurityPrivilege	3108	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3108	7zFM.exe
3108	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\IttihadCPL.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3108

C:\Users\Admin\Desktop\zbe.Deobf.exe
"C:\Users\Admin\Desktop\zbe.Deobf.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 844
  2⤵
  - Program crash
  PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3384 -ip 3384
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zbe.Deobf.exe

Path C:\Users\Admin\Desktop\zbe.Deobf.exe
Size 834KB
SHA256 03fcf806eb56514542d942e1384693d83ff7ba772de5c4a1e89e62c3a386c29a
MD5 455ad4887eefaa0b5fb80eb989630665
SHA1 48f8aa63a32fa4431b3dfc9444bba72ac0d13290
SHA512 a10a29a2740de906e2f307ba3fd1c05f41d08872943677e08e83357fe13a61fa5931ff09d80e60cb056ccf4b6ff925202eb873a163a300c0a04cc2e4a248cc78
SSDEEP 12288:B+0i0+0NeUZtHknAjIaqAg8GxPTfb3ImHhmcLB2:B+0H+0zZtHknxgPiPn3IWM
TLSH
T14F05B1C87E77512FEF99D93A6814B01E196CAEE1D68E9116F2FC3E0B75B46203450AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3384-6-0x0000000000E40000-0x0000000000F16000-memory.dmp

Download