7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Resubmissions

22/05/2026, 10:16

260522-ma5gmsgz6j8

22/05/2026, 10:08

260522-l58bcabw4z3

Analysis

user interaction
yes
max time kernel
805s
max time network
453s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260522-ma5gmsgz6j
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4680	powershell.exe
5	4680	powershell.exe
6	4680	powershell.exe
8	4680	powershell.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1932	forfiles.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4680	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4680	powershell.exe
2392	powershell.exe
5532	powershell.exe
432	powershell.exe
344	powershell.exe
1748	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3324	PING.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-36455-aB9aRKdcewQE\cbNTAsWvB.11o:Zone.Identifier	Setup.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3324	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2392	powershell.exe
2392	powershell.exe
5532	powershell.exe
5532	powershell.exe
432	powershell.exe
432	powershell.exe
344	powershell.exe
344	powershell.exe
1748	powershell.exe
1748	powershell.exe
4680	powershell.exe
4680	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeIncreaseQuotaPrivilege	2392	powershell.exe
Token: SeSecurityPrivilege	2392	powershell.exe
Token: SeTakeOwnershipPrivilege	2392	powershell.exe
Token: SeLoadDriverPrivilege	2392	powershell.exe
Token: SeSystemProfilePrivilege	2392	powershell.exe
Token: SeSystemtimePrivilege	2392	powershell.exe
Token: SeProfSingleProcessPrivilege	2392	powershell.exe
Token: SeIncBasePriorityPrivilege	2392	powershell.exe
Token: SeCreatePagefilePrivilege	2392	powershell.exe
Token: SeBackupPrivilege	2392	powershell.exe
Token: SeRestorePrivilege	2392	powershell.exe
Token: SeShutdownPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeSystemEnvironmentPrivilege	2392	powershell.exe
Token: SeRemoteShutdownPrivilege	2392	powershell.exe
Token: SeUndockPrivilege	2392	powershell.exe
Token: SeManageVolumePrivilege	2392	powershell.exe
Token: 33	2392	powershell.exe
Token: 34	2392	powershell.exe
Token: 35	2392	powershell.exe
Token: 36	2392	powershell.exe
Token: SeIncreaseQuotaPrivilege	2392	powershell.exe
Token: SeSecurityPrivilege	2392	powershell.exe
Token: SeTakeOwnershipPrivilege	2392	powershell.exe
Token: SeLoadDriverPrivilege	2392	powershell.exe
Token: SeSystemProfilePrivilege	2392	powershell.exe
Token: SeSystemtimePrivilege	2392	powershell.exe
Token: SeProfSingleProcessPrivilege	2392	powershell.exe
Token: SeIncBasePriorityPrivilege	2392	powershell.exe
Token: SeCreatePagefilePrivilege	2392	powershell.exe
Token: SeBackupPrivilege	2392	powershell.exe
Token: SeRestorePrivilege	2392	powershell.exe
Token: SeShutdownPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeSystemEnvironmentPrivilege	2392	powershell.exe
Token: SeRemoteShutdownPrivilege	2392	powershell.exe
Token: SeUndockPrivilege	2392	powershell.exe
Token: SeManageVolumePrivilege	2392	powershell.exe
Token: 33	2392	powershell.exe
Token: 34	2392	powershell.exe
Token: 35	2392	powershell.exe
Token: 36	2392	powershell.exe
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeIncreaseQuotaPrivilege	5532	powershell.exe
Token: SeSecurityPrivilege	5532	powershell.exe
Token: SeTakeOwnershipPrivilege	5532	powershell.exe
Token: SeLoadDriverPrivilege	5532	powershell.exe
Token: SeSystemProfilePrivilege	5532	powershell.exe
Token: SeSystemtimePrivilege	5532	powershell.exe
Token: SeProfSingleProcessPrivilege	5532	powershell.exe
Token: SeIncBasePriorityPrivilege	5532	powershell.exe
Token: SeCreatePagefilePrivilege	5532	powershell.exe
Token: SeBackupPrivilege	5532	powershell.exe
Token: SeRestorePrivilege	5532	powershell.exe
Token: SeShutdownPrivilege	5532	powershell.exe
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeSystemEnvironmentPrivilege	5532	powershell.exe
Token: SeRemoteShutdownPrivilege	5532	powershell.exe
Token: SeUndockPrivilege	5532	powershell.exe
Token: SeManageVolumePrivilege	5532	powershell.exe
Token: 33	5532	powershell.exe
Token: 34	5532	powershell.exe
Token: 35	5532	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2736	Setup.exe
2736	Setup.exe
2176	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1284	2736	Setup.exe	80
PID 2736 wrote to memory of 4520	2736	Setup.exe	82
PID 2736 wrote to memory of 4012	2736	Setup.exe	84
PID 2736 wrote to memory of 2976	2736	Setup.exe	86
PID 2976 wrote to memory of 2392	2976	cmd.exe	88
PID 2736 wrote to memory of 3108	2736	Setup.exe	90
PID 3108 wrote to memory of 5532	3108	cmd.exe	92
PID 2736 wrote to memory of 4952	2736	Setup.exe	93
PID 4952 wrote to memory of 432	4952	cmd.exe	95
PID 2736 wrote to memory of 5600	2736	Setup.exe	96
PID 5600 wrote to memory of 344	5600	cmd.exe	98
PID 2736 wrote to memory of 4824	2736	Setup.exe	99
PID 4824 wrote to memory of 1748	4824	cmd.exe	101
PID 2736 wrote to memory of 1932	2736	Setup.exe	102
PID 1932 wrote to memory of 416	1932	forfiles.exe	103
PID 416 wrote to memory of 6068	416	cmd.exe	105
PID 6068 wrote to memory of 3464	6068	cmd.exe	106
PID 6068 wrote to memory of 3932	6068	cmd.exe	107
PID 3932 wrote to memory of 4044	3932	conhost.exe	108
PID 4044 wrote to memory of 6008	4044	cmd.exe	109
PID 4044 wrote to memory of 3324	4044	cmd.exe	110
PID 4044 wrote to memory of 4680	4044	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1748
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-36455-aB9aRKdcewQE /m cbNTAsWvB.11o /c "cmd /c ren @file cbNTAsWvB.bat && call cbNTAsWvB.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "cbNTAsWvB.11o" cbNTAsWvB.bat && call cbNTAsWvB.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp-36455-aB9aRKdcewQE\cbNTAsWvB.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6068
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
    - - C:\Windows\system32\conhost.exe
        
        "C:\Windows\Sysnative\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-36455-aB9aRKdcewQE\cbNTAsWvB.bat" /launched
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3932
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-36455-aB9aRKdcewQE\cbNTAsWvB.bat /launched
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:6008
        
        C:\Windows\system32\PING.EXE
        
        ping -n 5 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3324
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Command "& ([scriptblock]::Create($env:_avt))"
        7⤵
        Badlisted process makes network request
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4680

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...