Analysis
- user interaction
yes - max time kernel
67s - max time network
65s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 23:22
General
- Target Tasket++_setup-1.6.exe
- Size 11.3MB
- Sample260421-3ct2pahs51
- SHA256 2bc1826a328ea398418045a0561e9629a34c20a49ace5997ef0d7ad3b2afa972
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tasket++_setup-1.6.exe"C:\Users\Admin\AppData\Local\Temp\Tasket++_setup-1.6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DCYS7ASK3A.tmp\Tasket++_setup-1.6.tmp"C:\Users\Admin\AppData\Local\Temp\is-DCYS7ASK3A.tmp\Tasket++_setup-1.6.tmp" /SL5="$B006C,10782164,882176,C:\Users\Admin\AppData\Local\Temp\Tasket++_setup-1.6.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\Tasket++\Tasket++.exe"C:\Users\Admin\AppData\Roaming\Tasket++\Tasket++.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d4 0x3041⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tasket++_setup-1.6.tmp
Qt6Core.dll
Qt6Gui.dll
Qt6Widgets.dll
Tasket++.exe
libgcc_s_seh-1.dll
libstdc++-6.dll
libwinpthread-1.dll
qminimal.dll
qoffscreen.dll
qwindows.dll
programData.ini
qmodernwindowsstyle.dll
memory/60-63-0x0000000003890000-0x00000000038EF000-memory.dmp
memory/60-5-0x0000000001D80000-0x0000000001D81000-memory.dmp
memory/60-62-0x0000000000F80000-0x000000000132A000-memory.dmp
memory/436-64-0x0000000000620000-0x0000000000707000-memory.dmp
memory/436-0-0x0000000000620000-0x0000000000707000-memory.dmp
memory/436-65-0x0000000000EC0000-0x0000000001060000-memory.dmp
memory/4692-95-0x000001A662A50000-0x000001A662AA5000-memory.dmp
memory/4692-114-0x00007FFF3E030000-0x00007FFF3E701000-memory.dmp
memory/4692-90-0x00007FFF3E030000-0x00007FFF3E701000-memory.dmp
memory/4692-89-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-96-0x00007FFF3D1E0000-0x00007FFF3D301000-memory.dmp
memory/4692-97-0x00007FFF3F570000-0x00007FFF3F5B3000-memory.dmp
memory/4692-94-0x00007FFF3D310000-0x00007FFF3DDFF000-memory.dmp
memory/4692-85-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-93-0x00007FFF4C280000-0x00007FFF4C296000-memory.dmp
memory/4692-92-0x00007FFF3DE00000-0x00007FFF3E02A000-memory.dmp
memory/4692-91-0x00007FFF4C1D0000-0x00007FFF4C1F2000-memory.dmp
memory/4692-98-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-102-0x00007FF6DA220000-0x00007FF6DA354000-memory.dmp
memory/4692-110-0x00007FFF3D1E0000-0x00007FFF3D301000-memory.dmp
memory/4692-103-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-108-0x00007FFF3D310000-0x00007FFF3DDFF000-memory.dmp
memory/4692-104-0x00007FFF3E030000-0x00007FFF3E701000-memory.dmp
memory/4692-88-0x00007FF6DA220000-0x00007FF6DA354000-memory.dmp
memory/4692-120-0x00007FFF3D1E0000-0x00007FFF3D301000-memory.dmp
memory/4692-113-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-118-0x00007FFF3D310000-0x00007FFF3DDFF000-memory.dmp
memory/4692-84-0x00007FFF3F169000-0x00007FFF3F16B000-memory.dmp
memory/4692-131-0x00007FFF3D1E0000-0x00007FFF3D301000-memory.dmp
memory/4692-129-0x00007FFF3D310000-0x00007FFF3DDFF000-memory.dmp
memory/4692-124-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-125-0x00007FFF3E030000-0x00007FFF3E701000-memory.dmp
memory/4692-134-0x00007FFF3E710000-0x00007FFF3F177000-memory.dmp
memory/4692-133-0x00007FF6DA220000-0x00007FF6DA354000-memory.dmp
memory/4692-135-0x00007FFF3E030000-0x00007FFF3E701000-memory.dmp
memory/4692-142-0x00007FFF3F570000-0x00007FFF3F5B3000-memory.dmp
memory/4692-141-0x00007FFF3D1E0000-0x00007FFF3D301000-memory.dmp
memory/4692-138-0x00007FFF4C280000-0x00007FFF4C296000-memory.dmp
memory/4692-139-0x00007FFF3D310000-0x00007FFF3DDFF000-memory.dmp