ba83532ee234225e4e2d1d8cf81330fbf23527528cb8b51bf0ad8ccaf715873b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba83532ee234225e4e2d1d8cf81330fbf23527528cb8b51bf0ad8ccaf715873b.exe
Size 519KB
Sample260807-sy2csaycke
SHA256 ba83532ee234225e4e2d1d8cf81330fbf23527528cb8b51bf0ad8ccaf715873b
MD5 4d9801ef959b3a8fe99ecc4f528c3e99
SHA1 ebfbfd0687f1ebaf48d8d07bdba995e2e10c7846
SHA512 b56549702dce3a7e1b6fc8787b9d1215d5cd89b21ea9911eb039ae8447ec646cf903806fac4040f154599f298aa5c87d7d28eea0cb5610ab3f48da33d9172871
SSDEEP 6144:9UECH1c6WoTbMhCLF7yMIG8b/ALKxa6m6FF8irqcEOkCybEaQRXr9HNdvOa:9WHO6tgCR7yMiALKxxwOkx2LIa
TLSH
T1E9B47D2AB6A0D076C4B79574C4A296AAFBF1743137204ACFA390475A1F637D2BE3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2684-0-0x0000000000770000-0x00000000007FA000-memory.dmp	upx
behavioral2/memory/2684-1-0x0000000000770000-0x00000000007FA000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4372	2684	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba83532ee234225e4e2d1d8cf81330fbf23527528cb8b51bf0ad8ccaf715873b.exe

C:\Users\Admin\AppData\Local\Temp\ba83532ee234225e4e2d1d8cf81330fbf23527528cb8b51bf0ad8ccaf715873b.exe
"C:\Users\Admin\AppData\Local\Temp\ba83532ee234225e4e2d1d8cf81330fbf23527528cb8b51bf0ad8ccaf715873b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 472
  2⤵
  - Program crash
  PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2684 -ip 2684
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-0-0x0000000000770000-0x00000000007FA000-memory.dmp

Download

memory/2684-1-0x0000000000770000-0x00000000007FA000-memory.dmp