Overview

overview

10

Static

static

3

点击安�...��.exe

windows10-2004-x64

10

点击安�...��.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    26/05/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    点击安装中文语言包.exe
  • Size 5.5MB
  • Sample260526-ffepvaby2j
  • SHA256 4ef56fe1c4c570f02e7248013ab4b44dcdfdeff54ec9792a3bfca7abedbff4b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutiondonutloaderinstallerloaderpersistenceransomware

Malware Config

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Detects DonutLoader 1 IoCs
    loader
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\点击安装中文语言包.exe
    "C:\Users\Admin\AppData\Local\Temp\点击安装中文语言包.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe
      "C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Users\Admin\AppData\Local\Temp\is-2FUNC02OF3.tmp\1.chation_mscate..tmp
        "C:\Users\Admin\AppData\Local\Temp\is-2FUNC02OF3.tmp\1.chation_mscate..tmp" /SL5="$5011C,4289231,909312,C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:488
        • C:\Windows\SysWOW64\msiexec.exe
          "msiexec.exe" /i "C:\Program Files\Python\unlyric.msi" /qn
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\com2masta.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2912
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2384
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7DAD20066B4F720CF83E1EAF3CAAC1BA
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4484
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 0BD1DD6AA68B6F6E73E4D213EA8F90A4
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System32
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3508
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1092
      • C:\windows\system32\Dism.exe
        C:\windows\system32\Dism.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5830e2.rbs
        • Path C:\Config.Msi\e5830e2.rbs
        • Size 3KB
        • SHA256 0fe3366920e9a1cd7cb7c057e0b007dc2e56f3ec9d2e126e528d0f1d13aa3ce2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-HWT26TIWV6.tmp
        • Path C:\Program Files\Python\7_files\is-HWT26TIWV6.tmp
        • Size 149B
        • SHA256 97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-P9TBGU8SLO.tmp
        • Path C:\Program Files\Python\7_files\is-P9TBGU8SLO.tmp
        • Size 53KB
        • SHA256 4728844ab037049a6396b5528dbd628808f7bc8156b344ebc740db90e3863b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 4KB
        • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 62587e449266393b0389fbdea62a3303c0dc412a5d939d21b02240a195c09b82
        • MD5 SHA1 SHA512
        Submit Download

        1.chation_mscate..exe
        • Path C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe
        • Size 5.7MB
        • SHA256 c4816bb8da4bbf85074a84ea440345c96fa6ed1dd28420fa7077b129986f85a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_nvdbtjch.e1m.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvdbtjch.e1m.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        com2masta.bat
        • Path C:\Users\Admin\AppData\Local\Temp\com2masta.bat
        • Size 64B
        • SHA256 0a51e589f434d6c5f381c4ff8411e6a7eea8eac0db450a63d7d3e714f5c3afd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1.chation_mscate..tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-2FUNC02OF3.tmp\1.chation_mscate..tmp
        • Size 4.2MB
        • SHA256 be785978df77e79c13fca468f8eb61a17e13b403e11b1343f85194886c662343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-LDYWKLZNO4.tmp\_isetup\_is7z.dll
        • Size 973KB
        • SHA256 5fbe8b388573ac086a9374ea466977b543e33c839f00ef6471e584c2cb0690e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isdecmp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-LDYWKLZNO4.tmp\_isetup\_isdecmp.dll
        • Size 31KB
        • SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        emjio.tmp
        • Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
        • Size 399KB
        • SHA256 22bcc2a44d06769877706fa4c6dac71d99d4e9948512a39cf51f285638807880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resource.png
        • Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
        • Size 675KB
        • SHA256 30e9d277166471f576ee5d445fa10af5086a757d6d9a019f063e5cf2b31d1b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        h16472861748525632546.ini
        • Path C:\Users\Admin\AppData\Roaming\Adobe\h16472861748525632546.ini
        • Size 26B
        • SHA256 fa6577247c28c130fa7bc5c2605e79f138c2627339ce78539efa9940a2f84243
        • MD5 SHA1 SHA512
        Submit Download

        MSI32F2.tmp
        • Path C:\Windows\Installer\MSI32F2.tmp
        • Size 557KB
        • SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3B92.tmp
        • Path C:\Windows\Installer\MSI3B92.tmp
        • Size 25KB
        • SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/488-407-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-428-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-452-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-447-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-445-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-440-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-435-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-344-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-345-0x0000000001800000-0x0000000001801000-memory.dmp
        Download

        memory/488-430-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-423-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-417-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-384-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-412-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/488-21-0x0000000001800000-0x0000000001801000-memory.dmp
        Download

        memory/488-405-0x0000000000560000-0x00000000009A8000-memory.dmp
        Download

        memory/1092-347-0x00000285F2610000-0x00000285F262A000-memory.dmp
        Download

        memory/1092-346-0x00000285F2140000-0x00000285F214A000-memory.dmp
        Download

        memory/2200-254-0x000001852E740000-0x000001852E762000-memory.dmp
        Download

        memory/2236-402-0x000001E167750000-0x000001E167831000-memory.dmp
        Download

        memory/3508-350-0x0000019E36DE0000-0x0000019E36DEA000-memory.dmp
        Download

        memory/3508-349-0x0000019E368B0000-0x0000019E368B6000-memory.dmp
        Download

        memory/3508-348-0x0000019E36880000-0x0000019E36888000-memory.dmp
        Download

        memory/4136-316-0x0000022DF8CA0000-0x0000022DF8D53000-memory.dmp
        Download

        memory/4136-315-0x0000022DF8A70000-0x0000022DF8A8C000-memory.dmp
        Download

        memory/4136-323-0x0000022DF8D60000-0x0000022DF8D6A000-memory.dmp
        Download

        memory/4136-342-0x0000022DF8EE0000-0x0000022DF8EFC000-memory.dmp
        Download

        memory/4948-13-0x00000000007A0000-0x000000000088D000-memory.dmp
        Download

        memory/4948-343-0x00000000007A0000-0x000000000088D000-memory.dmp
        Download