Analysis
- max time kernel
22s - max time network
21s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 16:10
General
- Target PINK Theme.exe
- Size 4.7MB
- Sample260504-tmf35sft71
- SHA256 8be75984d959fd83a384550d4858958974f2e9821215b18b7e4c0e47c3b43ac9
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PINK Theme.exe"C:\Users\Admin\AppData\Local\Temp\PINK Theme.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E69BNI76CM.tmp\PINK Theme.tmp"C:\Users\Admin\AppData\Local\Temp\is-E69BNI76CM.tmp\PINK Theme.tmp" /SL5="$A01DA,2538853,1080320,C:\Users\Admin\AppData\Local\Temp\PINK Theme.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\Windows\install.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install.ps1
l.psm1
__PSScriptPolicyTest_c3515ijl.2og.ps1
PINK Theme.tmp
memory/64-35-0x0000000000EA0000-0x0000000000FB6000-memory.dmp
memory/64-1-0x0000000000EA0000-0x0000000000FB6000-memory.dmp
memory/1404-5-0x0000000001730000-0x0000000001731000-memory.dmp
memory/1404-37-0x00000000006A0000-0x0000000000CB2000-memory.dmp
memory/1404-33-0x0000000001730000-0x0000000001731000-memory.dmp
memory/1996-28-0x00000187B79E0000-0x00000187B7A0A000-memory.dmp
memory/1996-36-0x00000187B7580000-0x00000187B7590000-memory.dmp
memory/1996-29-0x00000187B79E0000-0x00000187B7A04000-memory.dmp
memory/1996-31-0x00000187B7DD0000-0x00000187B7F92000-memory.dmp
memory/1996-32-0x00000187B84D0000-0x00000187B89F8000-memory.dmp
memory/1996-22-0x00000187B7640000-0x00000187B7662000-memory.dmp
memory/1996-34-0x00000187B7580000-0x00000187B7590000-memory.dmp
memory/1996-27-0x00000187B7580000-0x00000187B7590000-memory.dmp
memory/1996-15-0x00000187B7580000-0x00000187B7590000-memory.dmp
memory/1996-38-0x00000187B7580000-0x00000187B7590000-memory.dmp
memory/1996-16-0x00000187B7580000-0x00000187B7590000-memory.dmp
memory/1996-39-0x000001879EE90000-0x000001879EE9C000-memory.dmp
memory/1996-41-0x00000187B79E0000-0x00000187B79E8000-memory.dmp
memory/1996-40-0x00000187B7590000-0x00000187B763D000-memory.dmp