Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 18:28
General
- Target Setup安装包4.21.exe
- Size 18.8MB
- Sample260420-w4jayad18w
- SHA256 830ba08491da484ce6bd63305806a7db8066502b04266c4f67d656ffc2e09495
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 12 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup安装包4.21.exe"C:\Users\Admin\AppData\Local\Temp\Setup安装包4.21.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6HU7H.tmp\Setup安装包4.21.tmp"C:\Users\Admin\AppData\Local\Temp\is-6HU7H.tmp\Setup安装包4.21.tmp" /SL5="$50236,18670902,1152512,C:\Users\Admin\AppData\Local\Temp\Setup安装包4.21.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\dell\sBat\eDjjTE\0lEOrP\oyLq\eZULe3.exe"C:\dell\sBat\eDjjTE\0lEOrP\oyLq\eZULe3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\dell\sBat\eDjjTE\0lEOrP\oyLq\'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Set-MpPreference -MAPSReporting Disabled"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c icacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /deny "Users":(D) & icacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /grant "Users":(OI)(CI)(RX)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /deny "Users":(D)3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /grant "Users":(OI)(CI)(RX)3⤵
- Modifies file permissions
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fao55kdb.czm.ps1
Setup安装包4.21.tmp
H.k
eZULe3.exe
f3d2.sf
memory/1080-65-0x000001C846A00000-0x000001C846A0C000-memory.dmp
memory/2172-75-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/2172-84-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/2172-79-0x000001B739FE0000-0x000001B739FEC000-memory.dmp
memory/2172-76-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/2172-77-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/2172-74-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/2172-70-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/2172-42-0x000001B73C360000-0x000001B73E060000-memory.dmp
memory/3300-67-0x0000016C20980000-0x0000016C2098C000-memory.dmp
memory/4248-19-0x00000000005F0000-0x000000000099F000-memory.dmp
memory/4248-5-0x00000000030D0000-0x00000000030D1000-memory.dmp
memory/4332-41-0x000001D67E430000-0x000001D67E452000-memory.dmp
memory/4332-66-0x000001D6660B0000-0x000001D6660BC000-memory.dmp
memory/4428-0-0x0000000000C10000-0x0000000000D38000-memory.dmp
memory/4428-20-0x0000000000C10000-0x0000000000D38000-memory.dmp
memory/5008-30-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-68-0x00000130E9D40000-0x00000130E9DEC000-memory.dmp
memory/5008-22-0x00000130E6400000-0x00000130E7206000-memory.dmp
memory/5008-27-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-23-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-69-0x00000130E5CF0000-0x00000130E5CFC000-memory.dmp
memory/5008-31-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-78-0x00000130E6400000-0x00000130E7206000-memory.dmp
memory/5008-32-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-80-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-87-0x00000130E5CF0000-0x00000130E5CFC000-memory.dmp
memory/5008-33-0x00000130E8040000-0x00000130E9D40000-memory.dmp
memory/5008-91-0x00000130E8040000-0x00000130E9D40000-memory.dmp