Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
11/08/2026, 03:30
General
- Target wooooooooooooooooooooooooowwwwww.exe
- Size 64KB
- Sample260811-d2ynqsvdqc
- SHA256 986453c8f31f933a245c3e49ed4dea9df2005baa80aaff02ee060a600443a7c9
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wooooooooooooooooooooooooowwwwww.exe"C:\Users\Admin\AppData\Local\Temp\wooooooooooooooooooooooooowwwwww.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5056-0-0x0000000074962000-0x0000000074963000-memory.dmp
memory/5056-1-0x0000000000ED0000-0x0000000000EE6000-memory.dmp
memory/5056-2-0x0000000074950000-0x000000007510C000-memory.dmp
memory/5056-5-0x0000000006510000-0x00000000065AC000-memory.dmp
memory/5056-6-0x0000000006B70000-0x000000000712A000-memory.dmp
memory/5056-7-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/5056-8-0x0000000074962000-0x0000000074963000-memory.dmp
memory/5056-9-0x0000000074950000-0x000000007510C000-memory.dmp
memory/5056-10-0x00000000075F0000-0x0000000007666000-memory.dmp
memory/5056-11-0x00000000066B0000-0x00000000066BE000-memory.dmp
memory/5056-12-0x0000000007570000-0x000000000758E000-memory.dmp
memory/5056-13-0x0000000007930000-0x00000000079C2000-memory.dmp