68f14c17b41be9fcde553858937afff2286dac67c6b81dcb588977d22fe5e0f7

Analysis

max time kernel
118s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EL_W506T_Simulator.exe
Size 2.0MB
Sample260825-ezdffssxcs
SHA256 68f14c17b41be9fcde553858937afff2286dac67c6b81dcb588977d22fe5e0f7
MD5 8e2484a85cc1e8cd561c3bf650a411df
SHA1 2e430f8d14bf28325376fdf2cf768b060beff7ce
SHA512 8d8e57f06b3e7b88dd44ae0eac4033c648e1f21a782fe191cd5ad0b785c857d3254169ca77c9e8161e4a951d1fc0cd784cccb513f898b2d37db8e7dcb23448f9
SSDEEP 49152:bGNUqy0jWkH4GIKBekW15Fv7QUoXI6npAy1Uko:bGNpy0KkHD9tmLSXI6nck
TLSH
T113A501B1F19AC032DBA71579CD52DCFD0E5C7C1E6F194937A256B208A8F480D81E9A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4544	SHARP Calculator.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHARP Calculator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EL_W506T_Simulator.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4544	SHARP Calculator.exe
4544	SHARP Calculator.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4544	3788	EL_W506T_Simulator.exe	90

C:\Users\Admin\AppData\Local\Temp\EL_W506T_Simulator.exe
"C:\Users\Admin\AppData\Local\Temp\EL_W506T_Simulator.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\SHARP Calculator.exe
  ".\SHARP Calculator.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CalcSim.ini

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\CalcSim.ini
Size 380B
SHA256 825345d4086e3937437e347fbcbc8349cc87f738b2770c8d9dbea61069fabe7f
MD5 77ff785687b308cf410b6b151910844f
SHA1 818cdbbb76db3f5ba3ca1dbf442513b1746621eb
SHA512 ffe578de6e2762c8bd4cf508c4c0ad35413f7f110bf55ef2f9bf977969626e86db96057c8cfb3645be9aa7c856efb227c192a536b15c1ec2c14d9ce196fb8012
TLSH
T141E0925153EFE089C0D6732733EB300F4F18DB916A961003E4491EEA3B1586052EEA3D
MD5 SHA1 SHA512 TLSH

Submit Download

EL_W506T.SegLcd

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EL_W506T.SegLcd
Size 5.0MB
SHA256 3592db6f0fda27ea54f91bfb8865ac334799f4de3a758597c49f5547877f0da8
MD5 bb0e3f2e9471eca642ae36d251077528
SHA1 96c7aebe901b3f6c1cbccd29681ce1dc758862d3
SHA512 34e490f4e885af162f31bff7297da5ed78f84a4c85ccc98998b5d1fff4b1f5c17112d6da706a6d6f545258dd6920a4ecad35be15e5a1ad551d39483a6bdb38e4
SSDEEP 24576:334zzN1++BTTTTTn/////i2nnnnnnnnnnn:u1++JTTTTn/////nnnnnnnnnnnn
TLSH
T10236C64AA922DA12F58C1A39E81AE9F4015D5FF4E84C20C3798C7F6F72F6AB0C4D255D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EL_W506T.eepm

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EL_W506T.eepm
Size 192KB
SHA256 8e377f974f03c20c600bb1b3b0bdd44d7a607bed1f793280fe856b86fe744cbd
MD5 c1e086ef9f2a7f3cb5afd4441031c19c
SHA1 0759172659fe97184c65e7bea1d07d088389fe39
SHA512 e9f4e8e32b437028cc8439eb75ffe872f27319da11cd2bd9954e5cc4e4cc66c22005806d22d6a5eac396aeba097c7e510f5d0eeb55834368b189e8ff5698d1bb
SSDEEP 3072:CrmL2bmaL0/AYaph9/Xmfs8JJCmQq8qsbMv4Vcua+SHHLhADyU:CrmL2bQP0X2RJJCHxVcxrY
TLSH
T1E3149D26C882A236D2DC2C16EA27D127950D77399B2CD01F1295F7092EF58CEAE71F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EL_W506T_LP.CalPnl

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EL_W506T_LP.CalPnl
Size 3.9MB
SHA256 01bad98fcd8763e308defe5d4d84e02ae0c30b9f561298da513a12351b673ebc
MD5 dd966e2fc6a360485b40b3002e9d06a7
SHA1 947e52cb3700ffde35f2f87c5beef263c27102a5
SHA512 9b8686731cbfa2fff37f460e892b716a834185e5898cb5bbd4ddf99ae2c85c84087b03e9644ff6710bad1df08861e641b78a477f346f418c4f4dd91e6e83cc79
SSDEEP 12288:v45LChfLzZ0KnfCLgKpXJlv52ruh4+9OlEtaUycfI:A5LsZ0l5ub
TLSH
T1B416FC3BE111E155CDAC61B8851B5BFCF6EB5D82CB16CAAE018C7E12E1E3D625873D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EL_W506T_SP.CalPnl

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EL_W506T_SP.CalPnl
Size 1.8MB
SHA256 e85318b2c7838bcef1066b53fcff75440e347ffd24b33b3278e663015d1d8736
MD5 cc09f806c8023943a2efef845b3df51c
SHA1 b45ef7d9489b7657d20a1712231faedd07b67660
SHA512 a973f625dca01acd0a0ca10e9e3291ddd9780a2e49d0f8d8be6d519d31682fca307e54c1988419e47ff09d73d35dfd887727ff60ad917050096110042e286ffb
SSDEEP 6144:1x9ilwGCU9XpCx219TY+P9ilqbwSkQRCxR4+9i3h6w5+ZFaCxAxcXJf:1IwWXp71FY+qqbwnQRp96wwZFaJyXJf
TLSH
T15B95623BE111E162CDAC24B8811B4BFDF6DB5982CB16C66F518C7D02E1E7D626933E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHARP Calculator.exe

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\SHARP Calculator.exe
Size 972KB
SHA256 e5e4ed05ac23e2bfbd2b4f39a026b1d50eb45fa8dd0fa85542e01a01e08dc39f
MD5 13ee9cac1e3ef6cf8a2026316c8351e9
SHA1 5ca8da3707a8174f7421c163cb00f35db5bb5719
SHA512 a1c057b91a14acd61d3cfe9352fd19870f0efa6fd8f77963feb86c49c52e939232f031eeb9fae038ebfa86343f8053ccbfaf6bfa3eae1f84bc147ce1e34f75bc
SSDEEP 24576:1cOD3JIlMxVzPIeWhIJEeNtQQCoPq+bZezY/eEz:mOD3JIlMxVzP3WhIJEMmYq+bZegeEz
TLSH
T180256D117682D133E9B704B34DAD875DA068BE300B2458D7F3C47E2E59B56E32E392A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W506T_GY_focus.bmp

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\large\W506T_GY_focus.bmp
Size 991KB
SHA256 2eb60771cf7ed6eb59b3eb1b88eccf135ca6c61d5f6f7697d6c6ad08e998d269
MD5 71725ea30970cfb5932c4ba42d522185
SHA1 f7fbaf9199e0701524285cbea71cab27877d7576
SHA512 42b380ae63a44d7a6044e65752b604451094821a446adcfe189e6533f27256de0be7868859bbc95f4048efac8500f8a859003b91e17fe27d9b8efea5b2a1fa01
SSDEEP 1536:qHtoP2cLR2FQcCCAwSnYQ7ycdbn/U6B2rULkagcu4m0jwHY2oQF3U4pl298paK10:qyqSnYIb/vLk5ymfPEuJ2Lh
TLSH
T18B25C4A8EA405A0EF1598C38B8FBE3C914B41966093FB57EF4BA6F4A0771DD6570310B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W506T_GY_normal.bmp

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\large\W506T_GY_normal.bmp
Size 991KB
SHA256 104cd8e48741dc972965f2f7d9df67cd2894260cf4625ec40f0a788a7fc5982b
MD5 be93f1c49b48b2a6978eff5c551360f7
SHA1 51ae43755909dad12a9bf13354eeb93e1958a6ed
SHA512 8a9303b166cb3b7ffd7a882d9610d2aaeb72691d60c9fb6fddc7d26102069b5e12625f6817f2a9cfc1c867706079a79e768faaad80aa05d7fe91a34f0a0d4731
SSDEEP 1536:OZ6DtRdbHDy4LkFRPE6udpPodxwo/I2LaLPXp:OZ6hbHNLkFRQX4x2Lh
TLSH
T15E2518B8EB40090DE119CC35B8F8E79A05A01A2A2E7DB576FCB92F5B5371EC29743507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W506T_GY_press.bmp

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\large\W506T_GY_press.bmp
Size 991KB
SHA256 1eb4b3beef41e4f49970b7fe3e6063c54087612d02bfa85c711c92211a7fd00a
MD5 67ead42c85ea0c40229a0b6c7ef6c23d
SHA1 31ee1766fbebab9b3ead81a62450c0154ba41d49
SHA512 00f1e8bcfa6862f1644476de9bcba4e6ed3ab373d8f98b26bd5c612fc0c4123a60495560de3d0fb5cdba1879b7b58abed75a0509fedcffa73afa4a0b15fdd5f7
SSDEEP 1536:uXm2Kdby/LkBZ2J2fpodB5zXMwxn2LaLPXp:uX6by/Lkj2J2R25z8H2Lh
TLSH
T15E250AB8EB04454D2199CC25B8F8E38A05801D6A1E3CB5B6FDBD2F5B9376EC6970350B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W506T_GY_focus.bmp

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\small\W506T_GY_focus.bmp
Size 443KB
SHA256 dc035acc844f714cbebfd58450c36af8df08e71cb6df68073d59e93ee7090c1f
MD5 cfdf7c4eed5fff146b70cf177601d212
SHA1 02a48ba75e39d1e96bde3d503e63b74dc4521b7c
SHA512 85daa73ed3136c41eb0028cfaa992980e3244b0b8ee2716a20e675c7c4e67aef0b62f0fc01717f8fbefc3080373786023de5f75e2c1abdacbd5fefbaed8b165f
SSDEEP 1536:F9tZd7xKXUkBW3BPUYc2fHr1p/fxNpTEz6naJq6s19I+/iJs45v9CpI1gGDmM4U6:F9Pg2BwzIaJNgKfXX1gmNdADh
TLSH
T191A4B220E818625EF6189D61B8F7E3E562B5181858BF32BEF0356F5B2772CE66303507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W506T_GY_normal.bmp

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\small\W506T_GY_normal.bmp
Size 443KB
SHA256 78f30f67c08b6618f86575bb7208c47cf8a9508c3015884b8377a35d8fb057c6
MD5 fe9d712b7654c033db09a363badf343f
SHA1 6f168e05e3757e2cb35380308a784ccc435be5c8
SHA512 60ca47b665a2010056367b2d62b9aebc8cb9ac9b92db60b17591b0e55a53a4844241d9e69eeededf6ff159af42a7940b79d24fb2f3521af24d8f6121142a9523
SSDEEP 1536:MD3OOkcd2nkALjXEXD3V2i6RUCo8mcYrE9ZJ3Z3N:MD3Ovjj1RU0mcGg
TLSH
T139A4CA70EB04900D5209ED26BAF4E7E921642A1D95BE317AFD781F4B33B6EC29B07447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W506T_GY_press.bmp

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\small\W506T_GY_press.bmp
Size 443KB
SHA256 54af124c89ae25c162fd7d668ba0b4bf49f13a0f0332608c07af5dd434cedc3e
MD5 ea6ea2af66428c89db28d78092181a7c
SHA1 cc4837a8a2fec52bc2eb3a6e0dcc462eb82a09c4
SHA512 19b538eaeb5316c6a202bd138eb03f225fffa6de1e35ad7206f628a73d0d46e807766b7220cf79f9d6ad452e38eec36708bf18f5f2e61e84d9f42d326d228aba
SSDEEP 1536:FDWA3BPUYc2fB7rLcNpQJ2W9p5xWP1gGkwctjD2w:FDpg28QJ2WXTA1gPwctjDh
TLSH
T12BA43020FB05924C1209ED4AB9F4E7AA2650294958BE317AFEB46F0B3776FD35307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads