edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe
Size 2.7MB
Sample261002-mpy86sys5k
SHA256 edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30
MD5 50684cd35b3bdbbe6ea7ec703c54538f
SHA1 5d7d6cc2aab5c39c4e963b80df9014c8e55fd957
SHA512 b68d10c8f88b588f38c0197d9e53f6ec81c73d8e9d33ae10baa5c2cfce3ff4c5653298d5727b588ec3d6ac76dafb7eb15780df55617466d1fe7e361f969231fe
SSDEEP 49152:D61nCNDpWLQued6Ox6hNre93IYSBb1Mtii/EgVnUrmXpfzbwAcN+6:G8NGOx6bre93IYYb1ji/Ej8wAcQ6
TLSH
T105D5E0207697C136D17181B0597CDFB191ADAC3C5F7246CBA3C43B2A5A309D26E3AF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	2564	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2564	edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe

C:\Users\Admin\AppData\Local\Temp\edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe
"C:\Users\Admin\AppData\Local\Temp\edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 700
  2⤵
  - Program crash
  PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2564 -ip 2564
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-0-0x0000000001320000-0x00000000014BB000-memory.dmp

Download

memory/2564-3-0x0000000001640000-0x00000000016C5000-memory.dmp

Download

memory/2564-6-0x0000000001640000-0x00000000016C5000-memory.dmp

Download

memory/2564-7-0x0000000001640000-0x00000000016C5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads