Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 18:28
General
- Target Setup安装包4.21.exe
- Size 18.8MB
- Sample260420-w4jayad18w
- SHA256 830ba08491da484ce6bd63305806a7db8066502b04266c4f67d656ffc2e09495
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 12 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup安装包4.21.exe"C:\Users\Admin\AppData\Local\Temp\Setup安装包4.21.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OGBRI.tmp\Setup安装包4.21.tmp"C:\Users\Admin\AppData\Local\Temp\is-OGBRI.tmp\Setup安装包4.21.tmp" /SL5="$40244,18670902,1152512,C:\Users\Admin\AppData\Local\Temp\Setup安装包4.21.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\dell\sBat\eDjjTE\0lEOrP\oyLq\eZULe3.exe"C:\dell\sBat\eDjjTE\0lEOrP\oyLq\eZULe3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\dell\sBat\eDjjTE\0lEOrP\oyLq\'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Set-MpPreference -MAPSReporting Disabled"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c icacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /deny "Users":(D) & icacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /grant "Users":(OI)(CI)(RX)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /deny "Users":(D)3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\." /grant "Users":(OI)(CI)(RX)3⤵
- Modifies file permissions
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_qsknpey2.uak.ps1
Setup安装包4.21.tmp
H.k
eZULe3.exe
f3d2.sf
memory/2268-21-0x0000000000A30000-0x0000000000B58000-memory.dmp
memory/2268-22-0x0000000000FB0000-0x00000000010C2000-memory.dmp
memory/2268-0-0x0000000000A30000-0x0000000000B58000-memory.dmp
memory/2400-19-0x0000000001B20000-0x0000000001B9C000-memory.dmp
memory/2400-18-0x0000000000E80000-0x000000000122F000-memory.dmp
memory/2400-5-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/4244-104-0x000001E2E15E0000-0x000001E2E23DD000-memory.dmp
memory/4244-108-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4244-35-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4244-32-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4244-24-0x000001E2E15E0000-0x000001E2E23DD000-memory.dmp
memory/4244-34-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4244-100-0x000001E2DF920000-0x000001E2E00CE000-memory.dmp
memory/4244-25-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4244-89-0x000001E2DF920000-0x000001E2E00CE000-memory.dmp
memory/4244-90-0x000001E2E23E0000-0x000001E2E23EC000-memory.dmp
memory/4244-28-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4244-101-0x000001E2E23E0000-0x000001E2E23EC000-memory.dmp
memory/4244-33-0x000001E2E3210000-0x000001E2E4F10000-memory.dmp
memory/4492-79-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4492-85-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4492-86-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4492-87-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4492-84-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4492-116-0x000002A250170000-0x000002A25017C000-memory.dmp
memory/4492-115-0x000002A252C80000-0x000002A25342E000-memory.dmp
memory/4492-98-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4492-55-0x000002A250F80000-0x000002A252C80000-memory.dmp
memory/4944-83-0x00000155D6780000-0x00000155D678A000-memory.dmp
memory/4944-63-0x00000155D66A0000-0x00000155D66BC000-memory.dmp
memory/4944-93-0x00000155D6C50000-0x00000155D6C5A000-memory.dmp
memory/4944-92-0x00000155D67A0000-0x00000155D67A6000-memory.dmp
memory/4944-105-0x00000155BD740000-0x00000155BD74C000-memory.dmp
memory/4944-107-0x00000155BDB50000-0x00000155BDB62000-memory.dmp
memory/4944-88-0x00000155D6C30000-0x00000155D6C4A000-memory.dmp
memory/4944-106-0x00000155D5D30000-0x00000155D64DE000-memory.dmp
memory/4944-72-0x00000155D6C10000-0x00000155D6C2C000-memory.dmp
memory/4944-65-0x00000155D6690000-0x00000155D669A000-memory.dmp
memory/4944-64-0x00000155D66C0000-0x00000155D6773000-memory.dmp
memory/4944-42-0x00000155D6610000-0x00000155D6632000-memory.dmp
memory/4944-91-0x00000155D6790000-0x00000155D6798000-memory.dmp
memory/5180-123-0x0000025CE3410000-0x0000025CE3BBE000-memory.dmp
memory/5180-122-0x0000025CCB130000-0x0000025CCB13C000-memory.dmp
memory/5180-109-0x0000025CCB130000-0x0000025CCB13C000-memory.dmp
memory/5180-110-0x0000025CE3410000-0x0000025CE3BBE000-memory.dmp
memory/5180-111-0x0000025CE3360000-0x0000025CE3372000-memory.dmp
memory/6008-126-0x0000026DF73C0000-0x0000026DF7B6E000-memory.dmp
memory/6008-125-0x0000026DDEC80000-0x0000026DDEC8C000-memory.dmp
memory/6008-114-0x0000026DF7380000-0x0000026DF7392000-memory.dmp
memory/6008-113-0x0000026DF73C0000-0x0000026DF7B6E000-memory.dmp
memory/6008-112-0x0000026DDEC80000-0x0000026DDEC8C000-memory.dmp