2c1c65484a510feaef08a685bb9573f2709bd9240f50da9c83398bf34a02ffa4

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeekTrace_v2.exe
Size 151KB
Sample260909-nclyravdlb
SHA256 2c1c65484a510feaef08a685bb9573f2709bd9240f50da9c83398bf34a02ffa4
MD5 659911156896f2f365f28a6c1d23924b
SHA1 3617f83b30133cac1a465f1c4b36e887fc13e597
SHA512 f4f55ae7ccea4d7caee6ff4d3f9b751530fbd7606c7265f131212574936563569003b8632611edde9e6f87105983399d950d2de02fe07438a228545dab3a1c8d
SSDEEP 3072:1qeXA/4yIg9vkNPNu6H6xCYOiEUE265sJ2:1vgvkNFNaxm0EMJ
TLSH
T1DBE33B07E2A850BDE1B6C679CD924841FB737C594B71A6CF07507AB61E72BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WeekTrace_v2.exe

C:\Users\Admin\AppData\Local\Temp\WeekTrace_v2.exe
"C:\Users\Admin\AppData\Local\Temp\WeekTrace_v2.exe"
1⤵
- Checks computer location settings
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.json

Path F:\周迹存档\data.json
Size 1KB
SHA256 f59a8e05d1aa7516b0472f1e7dd828d011d4f78104016a9f5bb9afed8ed69b0d
MD5 568d6118bc550de90f4543f87437986b
SHA1 b5f6fe261aa8dd09cd5670344a73a348babd1a74
SHA512 86a371042b157d0be3eed2add0531e62db17d2b414a8934de1a3c296b8e5658e2575eb4374855f2d15ec06dbfdf98fcfda001380c8539199a729b171b956b05f
TLSH
T1192166042B793DBAC2449907E9E66ACA21D5BCEC49DE300DCD48EC9CCF3415B7A6019F
MD5 SHA1 SHA512 TLSH

Submit Download

data.tmp

Path F:\周迹存档\data.tmp
Size 1KB
SHA256 a07c2c5919a54ecb61e49edd1f97f5025e5d4e77058e8c5e8c56860a8ebe2c95
MD5 aed880722ab9c0c8b3b99349879d7124
SHA1 a212f8f0986c22cfb88de7fd97377ad57746e271
SHA512 f66df428a647504ab2b73ccf119d071998a42d59d39d4031de37c388346fc86753f321b8b35d06c53237a689dc7b51c15e4e99b4d0ed8bf4df60f75d0b06aea2
TLSH
T17D218C042B793DBAC2449907E9E66ACA21D5BCEC49DE300DCD48DC9CCF3415B766019F
MD5 SHA1 SHA512 TLSH