Analysis
- max time kernel
298s - max time network
292s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251017-en - resource tags
- submitted
29/11/2025, 23:21
General
- Target ws-Setup-Complete.exe
- Size 10.0MB
- Sample251129-3b4vhatmcl
- SHA256 4081a4c50d6591f1075a29df14b5399719d005457c844f9213a809a325e37b23
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe"C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\nslookup.exenslookup.exe /?najshu308fags832⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /v /c Set IJKhL=cmd & !IJKhL! < Bride.mid2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\findstr.exefindstr /V "SELECTION" Sometimes4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\781086\Slides.comSlides.com f4⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Slides.com
f
Benefits.mid
Bride.mid
Door
Equity.mid
Everything
Humidity
Individually
Maine
Perfectly
Peru
Sit
Sometimes
Validity.mid
Valium
memory/1304-51-0x0000000005770000-0x000000000578C000-memory.dmp
memory/1304-50-0x00000000016C0000-0x00000000016C1000-memory.dmp
memory/1304-52-0x0000000005770000-0x000000000578C000-memory.dmp
memory/1304-53-0x0000000005770000-0x000000000578C000-memory.dmp
memory/1304-54-0x0000000005770000-0x000000000578C000-memory.dmp
memory/1304-55-0x0000000005770000-0x000000000578C000-memory.dmp
memory/1304-56-0x0000000005770000-0x000000000578C000-memory.dmp
memory/1304-57-0x0000000005770000-0x000000000578C000-memory.dmp