4bb1d2130bb7ac35a03eb2f1eb483fc74103cea2086f3fc6984cb8724bcbcbfc

Resubmissions

07/09/2026, 03:31

260907-d3anasbr5t10

07/09/2026, 03:26

260907-dzah5awtbs10

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
US_Airways_E-Ticket_Print_Doc.exe
Size 92KB
Sample260907-d3anasbr5t
SHA256 4bb1d2130bb7ac35a03eb2f1eb483fc74103cea2086f3fc6984cb8724bcbcbfc
MD5 53fec0c29fb30de88c9a6a369e8cae62
SHA1 597b9aab24a0bffce34407f5ea8c5082dc4bb3b2
SHA512 852645ae4e7cd4f9f80061f01a56715b3240a7831f00f72f897d12809cd0bfdffdcb218aa15e89b99bb269e83e82cac2d5adfda628969dab8b8f4fac7698bcb8
SSDEEP 1536:IKt4CZ0XlXogPZEtEFNxVJz4sqAbyYPNwHBTUeC3R0FrPQxnLiaO:34CZ4YghAqVFX3PahTULmkn
TLSH
T1E993DFC2BD85C472E28145366076CC5A4219BFBC69A4E507BED47EC322BB283D17B91F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4340	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 3356	1976	US_Airways_E-Ticket_Print_Doc.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	US_Airways_E-Ticket_Print_Doc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	US_Airways_E-Ticket_Print_Doc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3356	US_Airways_E-Ticket_Print_Doc.exe
3356	US_Airways_E-Ticket_Print_Doc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 3356	1976	US_Airways_E-Ticket_Print_Doc.exe	85
PID 1976 wrote to memory of 3356	1976	US_Airways_E-Ticket_Print_Doc.exe	85
PID 1976 wrote to memory of 3356	1976	US_Airways_E-Ticket_Print_Doc.exe	85
PID 1976 wrote to memory of 3356	1976	US_Airways_E-Ticket_Print_Doc.exe	85
PID 3356 wrote to memory of 4340	3356	US_Airways_E-Ticket_Print_Doc.exe	86
PID 4340 wrote to memory of 4572	4340	svchost.exe	87

C:\Users\Admin\AppData\Local\Temp\US_Airways_E-Ticket_Print_Doc.exe
"C:\Users\Admin\AppData\Local\Temp\US_Airways_E-Ticket_Print_Doc.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\US_Airways_E-Ticket_Print_Doc.exe
  "C:\Users\Admin\AppData\Local\Temp\US_Airways_E-Ticket_Print_Doc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\US_Airways_E-Ticket_Print_Doc.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

US_Airways_E-Ticket_Print_Doc.txt

Path C:\Users\Admin\AppData\Local\Temp\US_Airways_E-Ticket_Print_Doc.txt
Size 48B
SHA256 8d4dc3adb1c650cbcd8d6bca245083be6b4949dc74c19b5630391caf44bd0d5d
MD5 43382e1f053304855e9320c71ed3b6cd
SHA1 a7df410c7cd79bfe9a8fe980226f979d2330a5f9
SHA512 b1cc79429cdec123435de38cd5ebb4f106239167f1d2d490df555443f73351ccdc262e2c0618cd8b6fc430dd30b9f74c96590cb03c7ef72fb90eeef53532ad41
MD5 SHA1 SHA512

Submit Download

memory/1976-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1976-8-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3356-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3356-4-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4340-7-0x00000000009A0000-0x00000000009AE000-memory.dmp

Download

memory/4340-6-0x00000000009A0000-0x00000000009AE000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads