29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe
Size 335KB
Sample260916-21tkdsfc98
SHA256 29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387
MD5 b355705863d3e54dc5b8bcf0e7ad3c62
SHA1 92754aec2bc66d222e54d7c0f76a19ebf119293c
SHA512 e95c98c7a4b00784d3052f57e73da03e2a93ebf5b07df119346d137eece89823a557b5920fb8582a9ec7e4c9b924221f99beafa980b5753fb1cde1418d1df408
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEb:GaoVmp+84YAIkOkTB+weaiuWXy
TLSH
T168747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3160	microsoftedgeupdatebroker32.exe
872	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	872	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	eventviewer.exe
872	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3160	1168	29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe	87
PID 1168 wrote to memory of 872	1168	29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe	88

C:\Users\Admin\AppData\Local\Temp\29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe
"C:\Users\Admin\AppData\Local\Temp\29c29f64eb7dfab3a9b36903ce69066286a5c47bf87f64a4ee28ddeb04bf2387.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 1428
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 872 -ip 872
1⤵
PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download