Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
02/05/2026, 22:22
General
- Target tick_wins_setup_release_x64_8060.exe
- Size 21.3MB
- Sample260502-2amn6agv8s
- SHA256 3d0f17e1bc778583b1273aa2bcc6e8d2a830c677868a78b1f82b89f5fad115d4
Malware Config
Signatures
- Drops startup file 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 29 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tick_wins_setup_release_x64_8060.exe"C:\Users\Admin\AppData\Local\Temp\tick_wins_setup_release_x64_8060.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-419QH.tmp\tick_wins_setup_release_x64_8060.tmp"C:\Users\Admin\AppData\Local\Temp\is-419QH.tmp\tick_wins_setup_release_x64_8060.tmp" /SL5="$1401CE,21436368,1145856,C:\Users\Admin\AppData\Local\Temp\tick_wins_setup_release_x64_8060.exe"2⤵
- Drops startup file
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im TickTick.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TickTick.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\TickTick\TickTick.exe"C:\Program Files (x86)\TickTick\TickTick.exe"3⤵
- Executes dropped EXE
-
-
-
C:\PROGRA~2\TickTick\TickTick.exeC:\PROGRA~2\TickTick\TickTick.exe1⤵
- Drops startup file
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bugsnag.dll
CommonMark.dll
ICSharpCode.AvalonEdit.dll
Ical.Net.dll
KotlinModels.dll
Microsoft.Toolkit.Uwp.Notifications.dll
Microsoft.Xaml.Behaviors.dll
Newtonsoft.Json.dll
System.Net.Http.dll
System.Runtime.dll
System.Threading.Tasks.Extensions.dll
System.ValueTuple.dll
TickTick.exe.config
TickTickDao.dll
TickTickModels.dll
TickTickUtils.dll
VCRUNTIME140.dll
WPFMediaKit.dll
WebSocket4Net.dll
KotlinMultiplatformAll.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.IdentityModel.JsonWebTokens.dll
Microsoft.IdentityModel.Logging.dll
Microsoft.IdentityModel.Tokens.dll
NHotkey.Wpf.dll
NHotkey.dll
TickTick.exe
TickTickHandler.dll
sqlite3.dll
tick_wins_setup_release_x64_8060.tmp
TickTick.lnk
TickTick.lnk
memory/2404-15-0x0000000000400000-0x0000000000747000-memory.dmp
memory/2404-614-0x0000000000400000-0x0000000000747000-memory.dmp
memory/2404-12-0x0000000000950000-0x0000000000951000-memory.dmp
memory/2404-368-0x0000000000400000-0x0000000000747000-memory.dmp
memory/2404-10-0x0000000000400000-0x0000000000747000-memory.dmp
memory/2404-5-0x0000000000950000-0x0000000000951000-memory.dmp
memory/2404-615-0x0000000000D70000-0x0000000000E4C000-memory.dmp
memory/2404-11-0x0000000000D70000-0x0000000000E4C000-memory.dmp
memory/2404-376-0x0000000000D70000-0x0000000000E4C000-memory.dmp
memory/2844-617-0x00000000009D0000-0x0000000000AF0000-memory.dmp
memory/2844-0-0x0000000000400000-0x0000000000525000-memory.dmp
memory/2844-8-0x0000000000400000-0x0000000000525000-memory.dmp
memory/2844-616-0x0000000000400000-0x0000000000525000-memory.dmp
memory/2844-9-0x00000000009D0000-0x0000000000AF0000-memory.dmp
memory/4740-573-0x000001BD2CE70000-0x000001BD2CE78000-memory.dmp
memory/4740-563-0x000001BD2CEB0000-0x000001BD2CEC6000-memory.dmp
memory/4740-588-0x000001BD32160000-0x000001BD32200000-memory.dmp
memory/4740-589-0x000001BD322B0000-0x000001BD32358000-memory.dmp
memory/4740-583-0x000001BD2FBA0000-0x000001BD2FBD8000-memory.dmp
memory/4740-591-0x000001BD31E70000-0x000001BD31E8A000-memory.dmp
memory/4740-593-0x000001BD320F0000-0x000001BD32118000-memory.dmp
memory/4740-584-0x000001BD2DFF0000-0x000001BD2DFFE000-memory.dmp
memory/4740-577-0x000001BD2CE80000-0x000001BD2CE99000-memory.dmp
memory/4740-571-0x000001BD2E000000-0x000001BD2E10A000-memory.dmp
memory/4740-597-0x000001BD32120000-0x000001BD3214C000-memory.dmp
memory/4740-595-0x000001BD32200000-0x000001BD32234000-memory.dmp
memory/4740-599-0x000001BD32240000-0x000001BD3226C000-memory.dmp
memory/4740-570-0x000001BD2D210000-0x000001BD2D24C000-memory.dmp
memory/4740-569-0x000001BD2D010000-0x000001BD2D022000-memory.dmp
memory/4740-601-0x000001BD320C0000-0x000001BD320D6000-memory.dmp
memory/4740-561-0x000001BD2D040000-0x000001BD2D1C6000-memory.dmp
memory/4740-603-0x000001BD31E10000-0x000001BD31E1A000-memory.dmp
memory/4740-604-0x000001BD323E0000-0x000001BD32456000-memory.dmp
memory/4740-586-0x000001BD31E40000-0x000001BD31E56000-memory.dmp
memory/4740-568-0x000001BD2D290000-0x000001BD2D342000-memory.dmp
memory/4740-609-0x000001BD34B50000-0x000001BD34B76000-memory.dmp
memory/4740-560-0x000001BD2CE50000-0x000001BD2CE64000-memory.dmp
memory/4740-608-0x000001BD323B0000-0x000001BD323CA000-memory.dmp
memory/4740-607-0x000001BD32150000-0x000001BD3215A000-memory.dmp
memory/4740-612-0x000001BD34E20000-0x000001BD34E28000-memory.dmp
memory/4740-558-0x000001BD2CBE0000-0x000001BD2CC00000-memory.dmp
memory/4740-556-0x000001BD2CBA0000-0x000001BD2CBD2000-memory.dmp
memory/4740-554-0x000001BD2D4D0000-0x000001BD2DAE8000-memory.dmp
memory/4740-553-0x000001BD2CB20000-0x000001BD2CB52000-memory.dmp
memory/4740-626-0x000000006FE10000-0x0000000070107000-memory.dmp
memory/4740-551-0x000001BD10770000-0x000001BD126BC000-memory.dmp
memory/4740-625-0x000001BD12A40000-0x000001BD12A4C000-memory.dmp
memory/4740-622-0x000001BD353E0000-0x000001BD353FC000-memory.dmp
memory/4884-7-0x0000000000AA0000-0x0000000000BC0000-memory.dmp
memory/4980-624-0x0000021DD5310000-0x0000021DD531C000-memory.dmp
memory/4980-621-0x0000021DEF3D0000-0x0000021DEF3D8000-memory.dmp
memory/4980-619-0x0000021DEF210000-0x0000021DEF21A000-memory.dmp