Analysis
- max time kernel
149s - max time network
144s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20250619-en - resource tags
- submitted
13/10/2025, 17:55
General
- Target Installer.exe
- Size 5.1MB
- Sample251013-wheevsfy6h
- SHA256 a78037b357f48676c3bdef0bc88bb8ed8bbeaabb1eb7e27469ccb04f8e6cc5f7
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\Installer.exe', 'C:\Users\Admin\AppData\Local', 'C:\Users\Admin\AppData\Roaming', 'C:\Users\Admin\AppData\Local', 'C:\Users\Admin\AppData\Roaming'); Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'; Add-MpPreference -ExclusionProcess 'InstallModule4176872.exe'; Add-MpPreference -ExclusionProcess 'InstallUtil.exe'; Add-MpPreference -ExclusionProcess 'MSBuild.exe'; Add-MpPreference -ExclusionProcess 'AddInProcess.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\InstallModule4176872.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallModule4176872.exe"C:\Users\Admin\AppData\Local\Temp\InstallModule4176872.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "pkvdcw" /XML "C:\Users\Admin\AppData\Local\Temp\3daa180dce814eac9c074e42d8d34c44.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "XsdType" /XML "C:\Users\Admin\AppData\Local\Temp\871fcb0d183e4baa89d77c2428dde0de.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local,C:\Users\Admin\AppData\Local\Temp\;Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\TypeId\dmckdj\XsdType.exe;Add-MpPreference -ExclusionProcess C:\Users\Admin\AppData\Local\TypeId\dmckdj\XsdType.exe;1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\TypeId\dmckdj\XsdType.exeC:\Users\Admin\AppData\Local\TypeId\dmckdj\XsdType.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
-
-
C:\Users\Admin\AppData\Local\TypeId\dmckdj\XsdType.exe"C:\Users\Admin\AppData\Local\TypeId\dmckdj\XsdType.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSBuild.exe.log
XsdType.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
3daa180dce814eac9c074e42d8d34c44.xml
871fcb0d183e4baa89d77c2428dde0de.xml
InstallModule4176872.exe
__PSScriptPolicyTest_exdaie21.dfe.ps1
memory/2052-41-0x0000000000020000-0x00000000000AA000-memory.dmp
memory/2052-42-0x000000001C910000-0x000000001CA08000-memory.dmp
memory/3776-52-0x0000025FFBA80000-0x0000025FFBAC4000-memory.dmp
memory/3776-53-0x0000025FFBB50000-0x0000025FFBBC6000-memory.dmp
memory/3984-19-0x000002082E9F0000-0x000002082EA12000-memory.dmp
memory/3984-10-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/3984-21-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/3984-25-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-9-0x0000000000400000-0x000000000109A000-memory.dmp
memory/4412-27-0x0000000021D00000-0x0000000021D8E000-memory.dmp
memory/4412-22-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-20-0x00007FFBAA54B000-0x00007FFBAA54C000-memory.dmp
memory/4412-11-0x0000000000400000-0x000000000109A000-memory.dmp
memory/4412-0-0x0000000000400000-0x000000000109A000-memory.dmp
memory/4412-8-0x0000000000400000-0x000000000109A000-memory.dmp
memory/4412-5-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-4-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-2-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-70-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-71-0x0000000000400000-0x000000000109A000-memory.dmp
memory/4412-3-0x00007FFBAA530000-0x00007FFBAA5ED000-memory.dmp
memory/4412-1-0x00007FFBAA54B000-0x00007FFBAA54C000-memory.dmp