d654d0e277ff3f5618bfcbafce94678dd5fceefb2419897dc856cadba834e5c9

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
599s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 89KB
Sample260905-gc971sca92
SHA256 d654d0e277ff3f5618bfcbafce94678dd5fceefb2419897dc856cadba834e5c9
MD5 dcfe5422567cd53f3019e90796b3c495
SHA1 9f5b371c3b4bc814230c652cb034cc94755f4ec1
SHA512 eaa110e8aacee067eab2f4faf1b0361aead6d05c3426c53fb3d0b7207cffae955c47722b4ff34e69a09b7b117aadb970042b3ec5ded42e081944ea5a2ff7489f
SSDEEP 1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfJwk:T7DhdC6kzWypvaQ0FxyNTBfJd
TLSH
T118936D41F3E102F7EAF2053100A6722F973663389764E8DBC75C2E529913AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5640	cmd.exe
4056	cmd.exe
1820	cmd.exe
2904	cmd.exe
268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Delays execution with timeout.exe 21 IoCs

defense_evasion

pid	Process
2740	timeout.exe
1788	timeout.exe
5260	timeout.exe
2908	timeout.exe
4060	timeout.exe
5824	timeout.exe
1668	timeout.exe
2716	timeout.exe
2760	timeout.exe
2924	timeout.exe
2812	timeout.exe
5804	timeout.exe
3740	timeout.exe
5992	timeout.exe
3908	timeout.exe
6040	timeout.exe
4408	timeout.exe
4332	timeout.exe
3240	timeout.exe
2200	timeout.exe
6108	timeout.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 268	5032	Setup.exe	90
PID 268 wrote to memory of 936	268	cmd.exe	91
PID 268 wrote to memory of 5640	268	cmd.exe	92
PID 268 wrote to memory of 1820	268	cmd.exe	93
PID 268 wrote to memory of 4056	268	cmd.exe	94
PID 268 wrote to memory of 2904	268	cmd.exe	95
PID 268 wrote to memory of 2740	268	cmd.exe	100
PID 268 wrote to memory of 1668	268	cmd.exe	101
PID 268 wrote to memory of 2716	268	cmd.exe	102
PID 268 wrote to memory of 5992	268	cmd.exe	103
PID 268 wrote to memory of 1788	268	cmd.exe	104
PID 268 wrote to memory of 5260	268	cmd.exe	105
PID 268 wrote to memory of 2760	268	cmd.exe	106
PID 268 wrote to memory of 2924	268	cmd.exe	107
PID 268 wrote to memory of 2812	268	cmd.exe	108
PID 268 wrote to memory of 3908	268	cmd.exe	109
PID 268 wrote to memory of 4332	268	cmd.exe	110
PID 268 wrote to memory of 2908	268	cmd.exe	111
PID 268 wrote to memory of 6040	268	cmd.exe	112
PID 268 wrote to memory of 3240	268	cmd.exe	113
PID 268 wrote to memory of 5804	268	cmd.exe	114
PID 268 wrote to memory of 4408	268	cmd.exe	115
PID 268 wrote to memory of 2200	268	cmd.exe	116
PID 268 wrote to memory of 4060	268	cmd.exe	117
PID 268 wrote to memory of 6108	268	cmd.exe	118
PID 268 wrote to memory of 5824	268	cmd.exe	119
PID 268 wrote to memory of 3740	268	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7D64.tmp\7D65.tmp\7D66.bat C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:936
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:5640
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:1820
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:4056
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:2904
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2740
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1668
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2716
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5992
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1788
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5260
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2760
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2924
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2812
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3908
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4332
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2908
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:6040
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3240
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5804
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4408
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2200
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4060
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:6108
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5824
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D66.bat

Path C:\Users\Admin\AppData\Local\Temp\7D64.tmp\7D65.tmp\7D66.bat
Size 651B
SHA256 690e052af59752b928687952c07ebd747806f64edddd799471857904ffa7041e
MD5 2a9373d56b03c8590ff1c7bca500e3b2
SHA1 9f3d826f05eca9d4ea036364b4f0d9978fb13425
SHA512 7d3b2c24952b367e2ada5bda643616581fe5d50a9861622c52af050f8f7c323dd41b178a2a6ea4731c54dde1cb28bc243bac5e458ae01dd970bdebff5c4bcd88
TLSH
T1FEF07D056843149A253CCDB20E6A7B86F72AC0EF8221DF5830809504CF6F96270F6AEE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5032-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download