aa6495e40a1dc3b03b03b5b0c831c5fd8f2722c9cb71254d9a059ccf4c9ba578

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GPU-Z.2.69.0.exe
Size 11.0MB
Sample260522-wt3a3aez6w
SHA256 aa6495e40a1dc3b03b03b5b0c831c5fd8f2722c9cb71254d9a059ccf4c9ba578
MD5 19a5f2bbb19710d2d36153b6cb12c3a7
SHA1 31914785ccf9c11b823d1734f36fb64230a9b28c
SHA512 145cfa11eda1e283c7273c03e452ebd7c4f00efd85517e28ad6cff98ad8c54f4a9cca31e6f6ea198a6bfbbc0537be38b1baa43bc9232f4417d80315ceb014603
SSDEEP 196608:nQ5OcWjV9kFz+iL+AnBfv1obPi2SQ1OB/tbb/CHqcE/oYCdmX0xB:nQ7WjVyFz+S+a7CQDmqWYyYU
TLSH
T1A1C6336EBB6BD614F26D6AF5D8ECEE488807EFC109D04F5FA940106803F7726EAB4550
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
800	gpuz_installer.exe
4844	gpuz_installer.tmp
5688	GPU-Z.exe
3000	GPU-Z-v3.sys

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2632-0-0x0000000000FE0000-0x0000000004372000-memory.dmp	upx
behavioral2/memory/2632-5-0x0000000000FE0000-0x0000000004372000-memory.dmp	upx
behavioral2/files/0x001a00000002b4ce-14.dat	upx
behavioral2/memory/2632-15-0x0000000000FE0000-0x0000000004372000-memory.dmp	upx
behavioral2/memory/2632-46-0x0000000000FE0000-0x0000000004372000-memory.dmp	upx
behavioral2/memory/5688-55-0x00000000000A0000-0x0000000003432000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GPU-Z\unins000.dat	gpuz_installer.tmp
File opened for modification	C:\Program Files (x86)\GPU-Z\GPU-Z.exe	gpuz_installer.tmp
File created	C:\Program Files (x86)\GPU-Z\unins000.dat	gpuz_installer.tmp
File created	C:\Program Files (x86)\GPU-Z\is-RNIQ8.tmp	gpuz_installer.tmp
File created	C:\Program Files (x86)\GPU-Z\is-OJH2F.tmp	gpuz_installer.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPU-Z.2.69.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpuz_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpuz_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPU-Z.exe

Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2632-5-0x0000000000FE0000-0x0000000004372000-memory.dmp	innosetup
behavioral2/files/0x001a00000002b4cf-6.dat	innosetup
behavioral2/memory/800-7-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral2/memory/2632-15-0x0000000000FE0000-0x0000000004372000-memory.dmp	innosetup
behavioral2/memory/800-17-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral2/memory/800-45-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral2/memory/2632-46-0x0000000000FE0000-0x0000000004372000-memory.dmp	innosetup
behavioral2/memory/5688-55-0x00000000000A0000-0x0000000003432000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	gpuz_installer.tmp
4844	gpuz_installer.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	GPU-Z.2.69.0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	gpuz_installer.tmp

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2632	GPU-Z.2.69.0.exe
5688	GPU-Z.exe
5688	GPU-Z.exe
5688	GPU-Z.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 800	2632	GPU-Z.2.69.0.exe	79
PID 800 wrote to memory of 4844	800	gpuz_installer.exe	80
PID 4844 wrote to memory of 5688	4844	gpuz_installer.tmp	82

C:\Users\Admin\AppData\Local\Temp\GPU-Z.2.69.0.exe
"C:\Users\Admin\AppData\Local\Temp\GPU-Z.2.69.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Users\Admin\AppData\Local\Temp\is-JO5VC.tmp\gpuz_installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-JO5VC.tmp\gpuz_installer.tmp" /SL5="$90252,832512,832512,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Program Files (x86)\GPU-Z\GPU-Z.exe
      "C:\Program Files (x86)\GPU-Z\GPU-Z.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5688

C:\Users\Admin\AppData\Local\Temp\GPU-Z-v3.sys
C:\Users\Admin\AppData\Local\Temp\\GPU-Z-v3.sys
1⤵
- Executes dropped EXE
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GPU-Z-v3.sys

Path C:\Users\Admin\AppData\Local\Temp\GPU-Z-v3.sys
Size 65KB
SHA256 69fb21e4c8dbfcab838d53d98ec7357d35e30cbbe5fde9e26457d79242ddd78e
MD5 132006f1712896a68dc5d4ef9f8891b2
SHA1 56664f538773a01166f69790ecf72bd9021f5c1c
SHA512 87ae27e26aa7331cb2fcd19a55e6397716c6dfe938a8bdb3118439eced6ef3ae6e1ea6e58798e65ddccdd859162c5926721472c4ba3d42ec3e04ad7e07aaddc4
SSDEEP 768:U1Lc2wuSMYLqIczet4cTGVNQIE0uaTynm2ht4JEY/IukqBNnbLQFVq6FRAmbLx3q:Uhci9qGNaSynmP2qznoFVq6FRVplzc
TLSH
T1FF638D826B6C5DC1D9D28534D2F8C763EE717182772296CF0AA4C4343D27BD25B3A62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPU-Z.exe

Path C:\Users\Admin\AppData\Local\Temp\GPU-Z.exe
Size 11.0MB
SHA256 aa6495e40a1dc3b03b03b5b0c831c5fd8f2722c9cb71254d9a059ccf4c9ba578
MD5 19a5f2bbb19710d2d36153b6cb12c3a7
SHA1 31914785ccf9c11b823d1734f36fb64230a9b28c
SHA512 145cfa11eda1e283c7273c03e452ebd7c4f00efd85517e28ad6cff98ad8c54f4a9cca31e6f6ea198a6bfbbc0537be38b1baa43bc9232f4417d80315ceb014603
SSDEEP 196608:nQ5OcWjV9kFz+iL+AnBfv1obPi2SQ1OB/tbb/CHqcE/oYCdmX0xB:nQ7WjVyFz+S+a7CQDmqWYyYU
TLSH
T1A1C6336EBB6BD614F26D6AF5D8ECEE488807EFC109D04F5FA940106803F7726EAB4550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpuz_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
Size 1.6MB
SHA256 fec58d516cec80e35c7b37fd0594c79de44ca79b468afb56720dae427a600dd2
MD5 f2496f2e516f4c2b86a54700db886426
SHA1 d5927ecb0df448cc9b86e6c7481e2ec3d5303cfc
SHA512 893ba99f21b986aca93af019eb001860b529400e7c9838431abbf5b4e47c5d1e632e2b2706e48ed97777e4d0f337dda04dc96ff2e93872030f5d35c80e0c34f6
SSDEEP 24576:D7FUDowAyrTVE3U5F/Nl6Kic6QL3E2vVsjECUAQT45deRV9R3:DBuZrEUv6KIy029s4C1eH9t
TLSH
T1FF75BF3FF268A13EC56A1B3245B39320997BBA51B81A8C1E07FC344DCF765601E3B656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpuz_installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JO5VC.tmp\gpuz_installer.tmp
Size 3.1MB
SHA256 ff02cd92b07585423ef7bdd0a873374922767fe21f93fcebc24181a5ee2111fa
MD5 4c9111b5058cb0a71da1c566e6b15de5
SHA1 cdf0963572c509ecc8651a7081dd5aca44886007
SHA512 3dc28a3f0a1404b67dd5374e2c5e13f1c1b0250c1e07666dbbd4bf31b400ee549c3beb7b872dd7d10dd54ce401b01a362a59bca54b2c7209cbedd97caa7cea46
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
TLSH
T19EE53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-45-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/800-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/800-17-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2632-5-0x0000000000FE0000-0x0000000004372000-memory.dmp

Download

memory/2632-15-0x0000000000FE0000-0x0000000004372000-memory.dmp

Download

memory/2632-0-0x0000000000FE0000-0x0000000004372000-memory.dmp

Download

memory/2632-46-0x0000000000FE0000-0x0000000004372000-memory.dmp

Download

memory/2632-1-0x0000000004370000-0x0000000004371000-memory.dmp

Download

memory/4844-18-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/4844-33-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/4844-44-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/5688-55-0x00000000000A0000-0x0000000003432000-memory.dmp

Download