07dffb6d312b5988e776e733927ee19e1ae141dbbf9154b621581134c734e5f6

Resubmissions

02/06/2026, 22:26

260602-2cp73aew6x7

02/06/2026, 22:21

260602-195hksew3z7

02/06/2026, 21:57

260602-1t86tset9w7

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReleaseSetup_03100.exe
Size 70.1MB
Sample260602-2cp73aew6x
SHA256 07dffb6d312b5988e776e733927ee19e1ae141dbbf9154b621581134c734e5f6
MD5 bcf2576300f88085712f4a99243a1d37
SHA1 546e584f36f97864bb76563c54be6c1020a8bf7d
SHA512 4f44ebf9e362d66550b91938015d7b5ba4bb4e7490c029783acf3aecec3a6a68f5b0e7aec1408b6a8d0fc91a9905cc7612eb9c1f0add5ff4270daa536614363b
SSDEEP 393216:ZKJnIfhMXZZy+MwMzoZG9toN2tgylAYLAbzzeP/:ZKJyuk+ooZG9tzt3l8r+
TLSH
T1CEF7B0D0B554F1D4F39A4A12856ABA68863326313B01EC6E7D5732C10E392D7FEA1E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4908	setup.exe

Loads dropped DLL 3 IoCs

pid	Process
4908	setup.exe
4908	setup.exe
4908	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReleaseSetup_03100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x001b00000002b3ff-3.dat	nsis_installer_1
behavioral2/files/0x001b00000002b3ff-3.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5148	ReleaseSetup_03100.exe
5148	ReleaseSetup_03100.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	ReleaseSetup_03100.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 4908	5148	ReleaseSetup_03100.exe	81

C:\Users\Admin\AppData\Local\Temp\ReleaseSetup_03100.exe
"C:\Users\Admin\AppData\Local\Temp\ReleaseSetup_03100.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Users\Admin\AppData\Local\Temp\7zSC146CD58\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC146CD58\setup.exe
Size 13.4MB
SHA256 cd17118864ec1dddc105bd65bf3b3eee378deffa3cafa79b762bb00d0b66a6fe
MD5 e2ce848a4bd43c79989a92dbb6e980a0
SHA1 a38bd7a8b1bfb05635266351190912bed04c665e
SHA512 4fcf51c17604f181da3d1343ecb3b5b029b5cc0c431f6cda89bb4f614804fadacbbebd3f6de4bffe0254ad23aa4b097c96db54c0567bb415c1b107b08514dca3
SSDEEP 393216:ptpPs96luGNk5lEbg12xFbK9Z5yfdnL/MGz:9tMGulEbg1qb8Z2rnz
TLSH
T1A3E633745BC38169F185113F89838191D2FFE2966A7001558F356FEEBDEFA29E4AB030
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf128B.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf128B.tmp\StartMenu.dll
Size 7KB
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
TLSH
T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsf128B.tmp\ioSpecial.ini
Size 765B
SHA256 e9b94f22ac336558be6ac6c0a3b02bd976c4faa92d8bca6437d4429a1e1ce3c7
MD5 4a1c602ae366ed61c3b743c898667464
SHA1 ba54ecd3a4ca3ba7ae23c24894b27834529a8f6e
SHA512 94dcbd9c39189e63440ba72619ee3f03a874f4cf012ab063bb51cb5eb6e155b0c717f523ed2329e1a3f095fa3ee0fd93eb6d03da94413ef58cee10fe7abd4b43
TLSH
T11501D049A92A93260421115294FE378653A11E240F12B8F9F425C886A38ECD3C6DDFD3
MD5 SHA1 SHA512 TLSH

Submit Download