166f38772f04564813f8d63e0dbcd7747e75b5e172991b38cf303d87665255ca

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
166f38772f04564813f8d63e0dbcd7747e75b5e172991b38cf303d87665255ca.exe
Size 1.6MB
Sample260825-rt744azyas
SHA256 166f38772f04564813f8d63e0dbcd7747e75b5e172991b38cf303d87665255ca
MD5 ba1f1aa48456137c4f90f311712750ff
SHA1 6fd7db3764e73d8d98aaeafa83c6334d7992d921
SHA512 089d23f55930fe91c90bf1e4b32807cff07a59379263a136267d294ad090351e1b5baff1dec0fed537748aa34a3635c90aefa1e777662ad67217803775b7b258
SSDEEP 24576:cCiGk63nsDlb3OeGJ5yrkx7gXuahsfAqOKHBRhGuIX6eHhUGotJzYmmX2NbQ:cCiGf3s5iBJ5yrkx7gd8JIKeSfZyQM
TLSH
T1DD75221075D58432F2F30D3089F199B10F3DBD608F72A99F13861A2E1EB5AE1E636766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5840	4400	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	166f38772f04564813f8d63e0dbcd7747e75b5e172991b38cf303d87665255ca.exe

C:\Users\Admin\AppData\Local\Temp\166f38772f04564813f8d63e0dbcd7747e75b5e172991b38cf303d87665255ca.exe
"C:\Users\Admin\AppData\Local\Temp\166f38772f04564813f8d63e0dbcd7747e75b5e172991b38cf303d87665255ca.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 604
  2⤵
  - Program crash
  PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4400 -ip 4400
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads