Analysis
- user interaction
yes - max time kernel
48s - max time network
48s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 01:24
General
- Target Set-up.exe
- Size 7.3MB
- Sample260503-bslxgaat21
- SHA256 b72bf33ae94f3e91acc279c2a106382762ccc5bc0e7e7a02a148d4ef531eea92
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\UpdateEnter.pps" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3396-22-0x00007FF906C80000-0x00007FF906C90000-memory.dmp
memory/3396-47-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-13-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-15-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-17-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-18-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-16-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-14-0x00007FF949704000-0x00007FF949705000-memory.dmp
memory/3396-19-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-21-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-20-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-25-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-51-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-50-0x0000020DF6AF0000-0x0000020DF6BDA000-memory.dmp
memory/3396-23-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-26-0x00007FF906C80000-0x00007FF906C90000-memory.dmp
memory/3396-27-0x00007FF949704000-0x00007FF949705000-memory.dmp
memory/3396-28-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-30-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-35-0x0000020DF6AF0000-0x0000020DF6BDA000-memory.dmp
memory/3396-36-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/3396-46-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-49-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-48-0x00007FF9096F0000-0x00007FF909700000-memory.dmp
memory/3396-24-0x00007FF949660000-0x00007FF949869000-memory.dmp
memory/4748-11-0x0000000001B70000-0x0000000001B8A000-memory.dmp
memory/4748-12-0x0000000003C50000-0x0000000003CB4000-memory.dmp