Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 22:22
General
- Target tick_wins_setup_release_x64_8060.exe
- Size 21.3MB
- Sample260502-2amn6agv8s
- SHA256 3d0f17e1bc778583b1273aa2bcc6e8d2a830c677868a78b1f82b89f5fad115d4
Malware Config
Signatures
- Drops startup file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 29 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tick_wins_setup_release_x64_8060.exe"C:\Users\Admin\AppData\Local\Temp\tick_wins_setup_release_x64_8060.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VTIAB.tmp\tick_wins_setup_release_x64_8060.tmp"C:\Users\Admin\AppData\Local\Temp\is-VTIAB.tmp\tick_wins_setup_release_x64_8060.tmp" /SL5="$502D6,21436368,1145856,C:\Users\Admin\AppData\Local\Temp\tick_wins_setup_release_x64_8060.exe"2⤵
- Drops startup file
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im TickTick.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TickTick.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\TickTick\TickTick.exe"C:\Program Files (x86)\TickTick\TickTick.exe"3⤵
- Executes dropped EXE
-
-
-
C:\PROGRA~2\TickTick\TickTick.exeC:\PROGRA~2\TickTick\TickTick.exe1⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bugsnag.dll
CommonMark.dll
ICSharpCode.AvalonEdit.dll
Ical.Net.dll
KotlinModels.dll
KotlinMultiplatformAll.dll
Microsoft.Toolkit.Uwp.Notifications.dll
Microsoft.Xaml.Behaviors.dll
Newtonsoft.Json.dll
System.Net.Http.dll
System.Runtime.dll
System.Threading.Tasks.Extensions.dll
System.ValueTuple.dll
TickTick.exe.config
TickTickDao.dll
TickTickHandler.dll
TickTickModels.dll
TickTickUtils.dll
WPFMediaKit.dll
WebSocket4Net.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.IdentityModel.JsonWebTokens.dll
Microsoft.IdentityModel.Logging.dll
Microsoft.IdentityModel.Tokens.dll
NHotkey.Wpf.dll
NHotkey.dll
TickTick.exe
sqlite3.dll
vcruntime140.dll
tick_wins_setup_release_x64_8060.tmp
TickTick.lnk
TickTick.lnk
memory/568-0-0x0000000000400000-0x0000000000525000-memory.dmp
memory/568-8-0x0000000000400000-0x0000000000525000-memory.dmp
memory/568-572-0x0000000000400000-0x0000000000525000-memory.dmp
memory/1328-553-0x000001B5FA7B0000-0x000001B5FA7E2000-memory.dmp
memory/1328-548-0x000001B5DE1C0000-0x000001B5E010C000-memory.dmp
memory/1328-627-0x0000000076610000-0x0000000076907000-memory.dmp
memory/1328-569-0x000001B5FB920000-0x000001B5FBA2A000-memory.dmp
memory/1328-574-0x000001B5FAA10000-0x000001B5FAA18000-memory.dmp
memory/1328-568-0x000001B5FAD90000-0x000001B5FADCC000-memory.dmp
memory/1328-567-0x000001B5FAD30000-0x000001B5FAD42000-memory.dmp
memory/1328-565-0x000001B5FB440000-0x000001B5FB4F2000-memory.dmp
memory/1328-578-0x000001B5FAD50000-0x000001B5FAD69000-memory.dmp
memory/1328-584-0x000001B5FD5C0000-0x000001B5FD5F8000-memory.dmp
memory/1328-585-0x000001B5FAD70000-0x000001B5FAD7E000-memory.dmp
memory/1328-560-0x000001B5FAA30000-0x000001B5FAA46000-memory.dmp
memory/1328-587-0x000001B5FADF0000-0x000001B5FAE06000-memory.dmp
memory/1328-558-0x000001B5FABA0000-0x000001B5FAD28000-memory.dmp
memory/1328-589-0x000001B5FDAC0000-0x000001B5FDB60000-memory.dmp
memory/1328-590-0x000001B5FDC10000-0x000001B5FDCB8000-memory.dmp
memory/1328-557-0x000001B5FA9F0000-0x000001B5FAA04000-memory.dmp
memory/1328-592-0x000001B5FD600000-0x000001B5FD61A000-memory.dmp
memory/1328-555-0x000001B5FA770000-0x000001B5FA790000-memory.dmp
memory/1328-551-0x000001B5FAE20000-0x000001B5FB438000-memory.dmp
memory/1328-598-0x000001B5FDA80000-0x000001B5FDAAC000-memory.dmp
memory/1328-596-0x000001B5FDB60000-0x000001B5FDB94000-memory.dmp
memory/1328-550-0x000001B5E05E0000-0x000001B5E0612000-memory.dmp
memory/1328-594-0x000001B5FDA50000-0x000001B5FDA78000-memory.dmp
memory/1328-600-0x000001B5FDBA0000-0x000001B5FDBCC000-memory.dmp
memory/1328-626-0x000001B5FA8F0000-0x000001B5FA99F000-memory.dmp
memory/1328-625-0x000001B5E0500000-0x000001B5E050C000-memory.dmp
memory/1328-602-0x000001B5FDA20000-0x000001B5FDA36000-memory.dmp
memory/1328-624-0x000001B5FDDF0000-0x000001B5FDE0C000-memory.dmp
memory/1328-604-0x000001B5FAD80000-0x000001B5FAD8A000-memory.dmp
memory/1328-605-0x000001B5FDD40000-0x000001B5FDDB6000-memory.dmp
memory/1328-607-0x000001B5FADD0000-0x000001B5FADDA000-memory.dmp
memory/1328-609-0x000001B5FDBF0000-0x000001B5FDC0A000-memory.dmp
memory/1328-612-0x000001B5FDD10000-0x000001B5FDD36000-memory.dmp
memory/1328-617-0x000001B5FDCE0000-0x000001B5FDCFE000-memory.dmp
memory/1328-616-0x000001B5FADE0000-0x000001B5FADE8000-memory.dmp
memory/1504-620-0x000001F408970000-0x000001F40897C000-memory.dmp
memory/1504-621-0x000001F422C70000-0x000001F422D1F000-memory.dmp
memory/1504-610-0x000001F422A40000-0x000001F422A4A000-memory.dmp
memory/1504-613-0x000001F422A50000-0x000001F422A58000-memory.dmp
memory/4484-7-0x0000000001030000-0x000000000107A000-memory.dmp
memory/4632-11-0x0000000002790000-0x0000000002791000-memory.dmp
memory/4632-10-0x0000000000E20000-0x0000000000E6A000-memory.dmp
memory/4632-9-0x0000000000400000-0x0000000000747000-memory.dmp
memory/4632-5-0x0000000002790000-0x0000000002791000-memory.dmp
memory/4632-13-0x0000000000400000-0x0000000000747000-memory.dmp
memory/4632-484-0x0000000000400000-0x0000000000747000-memory.dmp
memory/4632-571-0x0000000000E20000-0x0000000000E6A000-memory.dmp
memory/4632-570-0x0000000000400000-0x0000000000747000-memory.dmp