1cffd93e4229c4e5cb51152373c5cc76bdb81e8eec3af61a71d351815bb11811

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
w2dsetup.exe
Size 319KB
Sample260813-vmxassvcph
SHA256 1cffd93e4229c4e5cb51152373c5cc76bdb81e8eec3af61a71d351815bb11811
MD5 139a7cc75e438ed6ed1e1d84698e4bc9
SHA1 0a5290df8cc2c39ce1ca1affa94951ecd5f6f58d
SHA512 e6a151a7eaf3b7f7a48f317e478f6f993014d2cef352ffacb3dc15d4314d4ce229c46ff9f213cc12ea60b6c418a556be03c082c2c020eebc72f972e854681272
SSDEEP 6144:/kIRaCnmCcwJashoB8I5QnXgBaw9hM2SRuO1687YpcQcxkcDrA:/+c3NJhGB8zQBScO16eYOQ+kV
TLSH
T1446423928EA94A30FE124CB81C323336C11EF5D5A523A51B9C7B135C66F3AE227157F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4920	tmp335B.tmp

Loads dropped DLL 1 IoCs

pid	Process
4656	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w2dsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp335B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Colors	tmp335B.tmp

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	tmp335B.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	tmp335B.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	tmp335B.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	tmp335B.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	tmp335B.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	tmp335B.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	tmp335B.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4920	884	w2dsetup.exe	89
PID 4920 wrote to memory of 4656	4920	tmp335B.tmp	90

C:\Users\Admin\AppData\Local\Temp\w2dsetup.exe
"C:\Users\Admin\AppData\Local\Temp\w2dsetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\tmp335B.tmp
  "C:\Users\Admin\AppData\Local\Temp\tmp335B.tmp" help="C:\Users\Admin\AppData\Local\Temp\tmp336C.tmp" action="install"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\wtd5828.tmp,_MagicDel@16 C:\Users\Admin\AppData\Local\Temp\tmp335B.tmp
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp335B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp335B.tmp
Size 540KB
SHA256 a4d639fecb17732c984135a8e733e1dbdca1737f16bd033b56641906388b1f91
MD5 d3ec5799314a5b3e18b3fd21c56152b0
SHA1 4d0a7f3acb352772e1a2fafbfa927f1283c2c12e
SHA512 3101b6e0240c48d3bfb485bbc9b9f15a0fc68eb45b0e72eec8d3fe2f8227b6c4120a95f13c25ea2fd578f21618978aad1ed8ae922e936072c8138d010149df3b
SSDEEP 12288:0XjhrrKmw15879oUpSezvcIQowRqcZ646Jw2IQ:0zVKmw158xoUpSqsZ+Jt
TLSH
T102C46C1ABAF3C0B7D70665B00C6DA379A5B9AD890F225EC3B388CF1C49766D15237139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp336C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp336C.tmp
Size 22KB
SHA256 b60894f9945140e2ed18132caf82d701395deda6c7a1260d8a90733d168a82fc
MD5 4fbdebbde3748fe284f7e930e6c5b844
SHA1 b3d7d9c2408990118fcee965bcf1695624733956
SHA512 6c55ca4829dfbd2300121e106a36087d1f507e1990f6e8c5f4d5da74b4811c8161c50c87fb5c364ec5f2a0d8c63202cebbf18806254529353103b0a72fee9436
SSDEEP 384:xZM1iC88eNefI+tioQ2HPGWxNnXRVnayk:xZMwC88EDQuuNnXRVaZ
TLSH
T1AFA2BF40A172A752E0849A3FBABE171B94353E74F48DB12BA01B651018F37811BD4EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtd5828.tmp

Path C:\Users\Admin\AppData\Local\Temp\wtd5828.tmp
Size 2KB
SHA256 e8629b3c749db85d122cca40676b3b80d343fff27fc5551c57d513ba05350ad8
MD5 e9e72058fc3fe6c80a2dcd2d8a509e11
SHA1 03d131ff6bb59db3e55625db961010bba37c5e62
SHA512 90b075f47128b17bddb3a850077b8009a3bbedc41670497ab45d12347880237236e43c19468d2fd7bc9b1f508b0ae24fc1d2ad233d494c8f6aa226cce0ac57e3
TLSH
T11241DD53AB6ADF7ACB98073000D34807E0BF501C4393930D6E31462C7C271D66034F95
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads