107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.exe
Size 7.6MB
Sample260827-thy36abk3s
SHA256 107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e
MD5 bab80b993cc939773e5acc9d692c7774
SHA1 675226987f11cc44497c4a1f5b862fe6a6ba961a
SHA512 cfbee5ce1c3c044064507d0af61924eb1429ef934f4154b549d258c1a0c73a69dc7e45e6f49af16c35a3b005cbe15b6fdec65c98535edaf384663e77b1db9f06
SSDEEP 196608:sDaAN5cb50fxkaH5a0aWhH4DvJJQHm/dIaTFxnWL:s+K5c9ako5SvJmHVqm
TLSH
T1C58633824192F7B1E53682B12C957B41EC73FC0324B688CCE99961CA6EBB3475B4DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2620	107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp
5660	audioutilities33714.exe

Loads dropped DLL 1 IoCs

pid	Process
2620	107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 22 IoCs

pid	pid_target	Process	procid_target
5772	5660	WerFault.exe	87
5816	5660	WerFault.exe	87
5856	5660	WerFault.exe	87
6004	5660	WerFault.exe	87
4824	5660	WerFault.exe	87
3716	5660	WerFault.exe	87
1204	5660	WerFault.exe	87
440	5660	WerFault.exe	87
3484	5660	WerFault.exe	87
2708	5660	WerFault.exe	87
1504	5660	WerFault.exe	87
5156	5660	WerFault.exe	87
4088	5660	WerFault.exe	87
2568	5660	WerFault.exe	87
3632	5660	WerFault.exe	87
4784	5660	WerFault.exe	87
760	5660	WerFault.exe	87
1764	5660	WerFault.exe	87
5280	5660	WerFault.exe	87
4628	5660	WerFault.exe	87
3480	5660	WerFault.exe	87
1928	5660	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audioutilities33714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4996-1-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/4996-53-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5660	audioutilities33714.exe
5660	audioutilities33714.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2620	4996	107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.exe	85
PID 2620 wrote to memory of 5660	2620	107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp	87

C:\Users\Admin\AppData\Local\Temp\107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.exe
"C:\Users\Admin\AppData\Local\Temp\107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\is-QNB8T.tmp\107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QNB8T.tmp\107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp" /SL5="$50254,7713638,54272,C:\Users\Admin\AppData\Local\Temp\107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Audio Utilities 5.11.3.3714\audioutilities33714.exe
    "C:\Users\Admin\AppData\Local\Audio Utilities 5.11.3.3714\audioutilities33714.exe" ce09f4aba446e09147806049b13219b1
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 868
      4⤵
      Program crash
      PID:5772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 876
      4⤵
      Program crash
      PID:5816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 884
      4⤵
      Program crash
      PID:5856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 908
      4⤵
      Program crash
      PID:6004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1148
      4⤵
      Program crash
      PID:4824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1156
      4⤵
      Program crash
      PID:3716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1276
      4⤵
      Program crash
      PID:1204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1284
      4⤵
      Program crash
      PID:440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1156
      4⤵
      Program crash
      PID:3484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1280
      4⤵
      Program crash
      PID:2708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1344
      4⤵
      Program crash
      PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1348
      4⤵
      Program crash
      PID:5156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1420
      4⤵
      Program crash
      PID:4088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1340
      4⤵
      Program crash
      PID:2568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1176
      4⤵
      Program crash
      PID:3632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1168
      4⤵
      Program crash
      PID:4784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1064
      4⤵
      Program crash
      PID:760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1492
      4⤵
      Program crash
      PID:1764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1264
      4⤵
      Program crash
      PID:5280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1048
      4⤵
      Program crash
      PID:4628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1412
      4⤵
      Program crash
      PID:3480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1504
      4⤵
      Program crash
      PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5660 -ip 5660
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5660 -ip 5660
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5660 -ip 5660
1⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5660 -ip 5660
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5660 -ip 5660
1⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 5660
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 5660
1⤵
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5660 -ip 5660
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5660 -ip 5660
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5660 -ip 5660
1⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5660 -ip 5660
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5660 -ip 5660
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5660 -ip 5660
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 5660
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5660 -ip 5660
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5660 -ip 5660
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 5660
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5660 -ip 5660
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5660 -ip 5660
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5660 -ip 5660
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5660 -ip 5660
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5660 -ip 5660
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audioutilities33714.exe

Path C:\Users\Admin\AppData\Local\Audio Utilities 5.11.3.3714\audioutilities33714.exe
Size 3.6MB
SHA256 4f899a0f3178fe6d40713a083f5f691c9c262c6bbb354d9c168d1c234e8ee3bf
MD5 4d7e6f24eacf87c5a6afef838bea8593
SHA1 88ac1132fff00aaf57b03f445805f4b6745577a3
SHA512 e2a407d9dc001560c7e4787f7bc823cf0ee745002d50cd007e79ffce07d517a73d49d546b054a75cf06fed9d93ca572c3448194d778c42ccdcf41566682f3a9f
SSDEEP 49152:aoAyr7C/EVFXBV2D3T+/SRXodJQqVhcgjqLsA9ERbd4tRNnL5Ld1viTsBrlnFjy0:a3UrpGS/4EBQsRbdWRNL5+6rlnFjtz
TLSH
T1BE06F1616307A1DFD49704F8F8338E4F85281FA24726CAF7D99C782E9A329C235B5B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-HHFUM.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QNB8T.tmp\107e2026c89f59586ef25f9977be30f662d56f4137b29a0e9621d48bacea287e.tmp
Size 683KB
SHA256 2342ea9cdcd0e045a2ee7c8db9fb8cd1072365419a23087b5b2e9c101434fa55
MD5 2ef71939660e4ea2f55b1bbaebd6933a
SHA1 57095b1176f2f058d92d8265c6228f4408b4f796
SHA512 f5e3e5c86624583398ac53a9c51a7a67d9961e7276d3dfef8a0dda88837df3097baeb3779137b21c3cce9a3ecc60b6fac0637a60e22d22617ef781d727598fe8
SSDEEP 12288:p0QfKb+GlrPj37VzHEA6Yd2qKvJ4wyyrNQIRZCGkKKch/bcXExy4:BfKb+GlrPj37VzHEA6B3vDaCCGk+/bcQ
TLSH
T1A3E47C32F2A0D837D1731F789D1B82955836BE103E38A5A776E81F4C4F79681792B2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2620-52-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2620-7-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2620-14-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4996-53-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4996-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4996-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/5660-48-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-49-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-50-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-51-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-55-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-56-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-57-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-58-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download

memory/5660-61-0x0000000000400000-0x0000000000BA1000-memory.dmp

Download