cc39da364b8a91c86f3c170308a99887d9d9c1c985bdff85970171d5d92e13de

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc39da364b8a91c86f3c170308a99887d9d9c1c985bdff85970171d5d92e13de.exe
Size 447KB
Sample260920-3ew9ts1epd
SHA256 cc39da364b8a91c86f3c170308a99887d9d9c1c985bdff85970171d5d92e13de
MD5 5fae63a9eca40c32b2867c4838154ceb
SHA1 938a69b0fa128c7e90e4006d950bba3e757b57ed
SHA512 f1751f5d563273811e24c092c27293d1ca3a938627c87c8e29b1579c8f44e2d16fdf56fe9c5d7fd8682eef1c2c01992a3724cbd6355672a4c8f741b237042fbb
SSDEEP 6144:sXyf+/bnQC4lTVN4K3qYp0HWhK0+Sbm61Os+18:sXC+/34TVNx3lqHWhK0+SbmU+18
TLSH
T183A46DD065D88C35E3F6D73074E29623893A6DD22D3B895FF2B432590F786B0D62463A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	4440	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc39da364b8a91c86f3c170308a99887d9d9c1c985bdff85970171d5d92e13de.exe

C:\Users\Admin\AppData\Local\Temp\cc39da364b8a91c86f3c170308a99887d9d9c1c985bdff85970171d5d92e13de.exe
"C:\Users\Admin\AppData\Local\Temp\cc39da364b8a91c86f3c170308a99887d9d9c1c985bdff85970171d5d92e13de.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 524
  2⤵
  - Program crash
  PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4440 -ip 4440
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4440-0-0x0000000000525000-0x0000000000526000-memory.dmp

Download