Analysis
- user interaction
yes - max time kernel
134s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/05/2026, 18:57
General
- Target setup.exe
- Size 2.4MB
- Sample260529-xmd6bsfs2k
- SHA256 7213f30970c9764e1e0f85f15125f9241cf2619fb4724d322b5fe6f8ee3d9da0
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Drops file in System32 directory 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Drops file in System32 directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Fraps\fraps.exe"C:\Fraps\fraps.exe" /exit2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Fraps\fraps.exe"C:\Fraps\fraps.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Fraps\fraps64.dat"C:\Fraps\fraps64.dat"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x450 0x1501⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fraps.exe
fraps32.dll
fraps64.dat
fraps64.dll
frapslcd.dll
AdvSplash.dll
StartMenu.dll
System.dll
memory/2688-48-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/2688-51-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/2688-46-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/2688-45-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/2688-47-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2688-49-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/2688-44-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-66-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/4704-79-0x0000000004DA0000-0x0000000004DA2000-memory.dmp
memory/4704-61-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/4704-60-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/4704-58-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/4704-59-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/4704-70-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/4704-72-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/4704-71-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/4704-69-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/4704-68-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/4704-67-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/4704-73-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/4704-74-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/4704-75-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-76-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/4704-77-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/4704-62-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/4704-78-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/4704-80-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/4704-63-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/4704-64-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/4704-85-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/4704-65-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/4704-57-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-93-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-94-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-95-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-98-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-99-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-100-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-103-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-104-0x0000000000400000-0x0000000000C03000-memory.dmp
memory/4704-105-0x0000000000400000-0x0000000000C03000-memory.dmp