Overview

overview

6

Static

static

1

Dr.Fone_Installer.exe

windows10-2004-x64

6

Dr.Fone_Installer.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/06/2026, 07:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Dr.Fone_Installer.exe
  • Size 2.6MB
  • Sample260605-jndpasdv7l
  • SHA256 1f7ab2399a2014a8e7e4da6d4b2f815b49a3a92912c358afc26c78494c297275
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoveryspyware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dr.Fone_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Dr.Fone_Installer.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2644
      2⤵
      • Program crash
      PID:5164
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2332 -ip 2332
    1⤵
      PID:5140

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          wsWAE.log
          • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
          • Size 2KB
          • SHA256 4d36780c32fe29b89065a16f7902a2751a7f8432dd61aa3eacd9c26b1e395e8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wsWAE.log
          • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
          • Size 3KB
          • SHA256 e18c3eced07fee810f4e992f6e4671db59c29f3782f50becd9f9a1a4bcd20f0d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wsWAE.log
          • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
          • Size 1KB
          • SHA256 6985ee3c2865bceab1b0a9c49dc4bdc9bd5d927fce49cf67e19420f26001b5c2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wsWAE.log
          • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
          • Size 4KB
          • SHA256 a63dd0eff45694b0a2bc9ec616128f25cbcd13185a3571e313de7d0690fa9693
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wsduilib.log
          • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
          • Size 1KB
          • SHA256 a3e0e6477d276fcefade4a7d0d4d6e0b5a5b2d114a12e2872a84c56d0336eb34
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wsduilib.log
          • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
          • Size 77KB
          • SHA256 129226d67b371ececab3ac58fb925dc2a9de152d6d88dcfc01162a1fcc62eb2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download