77c678df12411c3d7cc67c2971be72913df85cafd05e5bd78c1b8cf84b508301

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HystericBirthday.exe
Size 4.1MB
Sample260802-vja86axcja
SHA256 77c678df12411c3d7cc67c2971be72913df85cafd05e5bd78c1b8cf84b508301
MD5 4c1a3beaf60944ba1f42613374064ac1
SHA1 bbc8ab62d3f42e6aa0c68d6934c3ae21a31ff972
SHA512 ac55fc87985082e229b77d6ed09ae3d48c4c1e123f0ee27bcadd01a4f967d0960237223a657925e826073b17be884c9be1345447b7795e5791cc8e154e78b893
SSDEEP 49152:N7FkW6Zril0QLZxU+UdmaYsBRmUVh+ilpST26Tc346Ez0tuHIBpwP218MBSHItuL:N7FkWstQNxU+U4aYsBRmKZ4Y3gLR
TLSH
T16D1619FC7140A657F0C404B16BE9EA90A9663DA98B35179329933FF61470EB676E3303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3316	4868	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HystericBirthday.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4868	HystericBirthday.exe
4868	HystericBirthday.exe

C:\Users\Admin\AppData\Local\Temp\HystericBirthday.exe
"C:\Users\Admin\AppData\Local\Temp\HystericBirthday.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17964
  2⤵
  - Program crash
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4868 -ip 4868
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

corpseparty2u.ini

Path C:\Users\Admin\AppData\Local\Temp\corpseparty2u.ini
Size 1KB
SHA256 f56b0c27a07d262f869dfeb3e1c4eb8e783826230abdbf867e0621967895f660
MD5 5296d936fbce221c5494d147c05fcedb
SHA1 0fb279b4f806377ef862379cd9a4a5fb1f20b07b
SHA512 2a220db79d9de94e6b7f761976093b48342e1c4af75d9cd0c8f408eda3f0603cfa9c121d44a73e796e02df2f1508f24087c3453c7c2808c4c38c6d1e6bec428d
TLSH
T127216D3D857CAB2E495FA3F55CE6458218FEB2444C0336D1CE0956F79E890861778723
MD5 SHA1 SHA512 TLSH

Submit Download