91f72a189dbf57543b867bea37b3a5a0d32a48f0cab3e4ea2eff5e47459652b3

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
تعريف ابيض (2).rar
Size 1.1MB
Sample260814-efe5yafa65
SHA256 91f72a189dbf57543b867bea37b3a5a0d32a48f0cab3e4ea2eff5e47459652b3
MD5 631f5e25b95fb7ecf8b74dad8c052db9
SHA1 6d83114ef785931da243d3d875fb9260a190c84a
SHA512 3d56fa15174c4ed918835ea031d68961466fc097efed922014bd94140402dd408e2efbada6737049a5390773fdabbed2db25f187c8fe3b2c71f1a2b20ea377f2
SSDEEP 24576:cVDVu+7hPg/JZI2lCTm62Mgh/wt28yjkHbrK44yQfl7Ih7:q0+7h6HlW2MgJwegLQfRe7
TLSH
T10045331B34D6F55C4B058C95EADB477DB72CE5AE8284B2C1ECA390F02E2F0ADA51911F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
804	Creative EAX Setting.exe
2988	Creative EAX Setting.exe
5776	Creative EAX Setting.exe
2812	Creative EAX Setting.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3108	804	WerFault.exe	95
5340	2988	WerFault.exe	100
4992	5776	WerFault.exe	105
1476	2812	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4728	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4728	7zFM.exe
Token: 35	4728	7zFM.exe
Token: SeSecurityPrivilege	4728	7zFM.exe
Token: SeSecurityPrivilege	4728	7zFM.exe
Token: SeSecurityPrivilege	4728	7zFM.exe
Token: SeSecurityPrivilege	4728	7zFM.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe
4728	7zFM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 804	4728	7zFM.exe	95
PID 4728 wrote to memory of 2988	4728	7zFM.exe	100
PID 4728 wrote to memory of 5776	4728	7zFM.exe	105
PID 4728 wrote to memory of 2812	4728	7zFM.exe	108

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\تعريف ابيض (2).rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\7zO87259D18\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87259D18\Creative EAX Setting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 880
    3⤵
    - Program crash
    PID:3108
- C:\Users\Admin\AppData\Local\Temp\7zO87265ED8\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87265ED8\Creative EAX Setting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 880
    3⤵
    - Program crash
    PID:5340
- C:\Users\Admin\AppData\Local\Temp\7zO87260A88\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87260A88\Creative EAX Setting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 880
    3⤵
    - Program crash
    PID:4992
- C:\Users\Admin\AppData\Local\Temp\7zO87274A98\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87274A98\Creative EAX Setting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 884
    3⤵
    - Program crash
    PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 804 -ip 804
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2988 -ip 2988
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5776 -ip 5776
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2812 -ip 2812
1⤵
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Creative EAX Setting.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO87259D18\Creative EAX Setting.exe
Size 1.2MB
SHA256 e8a5f1678f3d98dce412f5850345499b09313540c45e7b082cfbd425c55b6ff6
MD5 8e6b242a2eeba6fe62d74b34245674b5
SHA1 573235c2519e868ebfd3c5e4d4fea551f77c8218
SHA512 0c791b74e665c96e57936ca8798ed46e641e3f9330f9e48fe41ac9261856aa275859b4127d77392be87912509eae5efc6dff0fa304414f8cfd3063e6657e1097
SSDEEP 24576:bORgaMj3XRD+uVq2H2Cuk1+Lda3WvhMVeO/mDo5ufij:bORgaMj3XRD+ufH2Cuk1+Lda3WvhoMoP
TLSH
T1D7556BD2E84489D4F92E09B3A0679DB016A31D7EEDF4A49D64C9BC2B15B3353503F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/804-12-0x00000000002A0000-0x00000000003E0000-memory.dmp

Download

memory/804-13-0x0000000005300000-0x00000000058A4000-memory.dmp

Download

memory/804-14-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Download