Analysis
- user interaction
yes - max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 09:25
Behavioral task
behavioral1
Sample
ZimmetTakipSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target ZimmetTakipSetup.exe
- Size 67.3MB
- Sample260605-ldtzmsd17p
- SHA256 55902c3fb407f9794cbcca8b165a0017d697b5a6725300628e01c443939d3068
- MD5 fdf0a2eaa669cd64abbe977a260046bc
- SHA1 d72f8ee29abf78af4b9c1d3bdb5faf39890cbad9
- SHA512 26a7fc8436ec0caf3ffb43fc5522b15d7669182a6c1fa149ab74f45a70df12e422558ce047a6fb2f17d0dbe98c6685eee59fa2ff57f0d139b9156268d2072271
- SSDEEP 1572864:NYA0nmgPKE1C53Jlzj9z7v6zHXJaNqF5zr70jT7xbksBJuf/IdUEQ4Sp55:NzkpKtj9fMHXJV5zv0jTtbkj3IdUEIj
- TLSH T172F73397E19DA87EE03E4B318AB1D154483B3511AC468E0AC9ECB55CCF652613E3F78B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1312 ZimmetTakipSetup.tmp 5524 Zimmet_Takip_Sistemi.exe - Loads dropped DLL 5 IoCs
pid Process 5140 MsiExec.exe 5140 MsiExec.exe 5140 MsiExec.exe 5140 MsiExec.exe 5140 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5464 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI31D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI31E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI31F7.tmp msiexec.exe File created C:\Windows\Installer\e592dcd.msi msiexec.exe File opened for modification C:\Windows\Installer\e592dcd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI3157.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI31C5.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zimmet_Takip_Sistemi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZimmetTakipSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZimmetTakipSetup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/1476-0-0x0000000000460000-0x0000000000548000-memory.dmp innosetup behavioral2/memory/1476-6-0x0000000000460000-0x0000000000548000-memory.dmp innosetup behavioral2/memory/1476-69-0x0000000000460000-0x0000000000548000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1312 ZimmetTakipSetup.tmp 1312 ZimmetTakipSetup.tmp 5464 msiexec.exe 5464 msiexec.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 5300 msiexec.exe Token: SeIncreaseQuotaPrivilege 5300 msiexec.exe Token: SeSecurityPrivilege 5464 msiexec.exe Token: SeCreateTokenPrivilege 5300 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5300 msiexec.exe Token: SeLockMemoryPrivilege 5300 msiexec.exe Token: SeIncreaseQuotaPrivilege 5300 msiexec.exe Token: SeMachineAccountPrivilege 5300 msiexec.exe Token: SeTcbPrivilege 5300 msiexec.exe Token: SeSecurityPrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeLoadDriverPrivilege 5300 msiexec.exe Token: SeSystemProfilePrivilege 5300 msiexec.exe Token: SeSystemtimePrivilege 5300 msiexec.exe Token: SeProfSingleProcessPrivilege 5300 msiexec.exe Token: SeIncBasePriorityPrivilege 5300 msiexec.exe Token: SeCreatePagefilePrivilege 5300 msiexec.exe Token: SeCreatePermanentPrivilege 5300 msiexec.exe Token: SeBackupPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeShutdownPrivilege 5300 msiexec.exe Token: SeDebugPrivilege 5300 msiexec.exe Token: SeAuditPrivilege 5300 msiexec.exe Token: SeSystemEnvironmentPrivilege 5300 msiexec.exe Token: SeChangeNotifyPrivilege 5300 msiexec.exe Token: SeRemoteShutdownPrivilege 5300 msiexec.exe Token: SeUndockPrivilege 5300 msiexec.exe Token: SeSyncAgentPrivilege 5300 msiexec.exe Token: SeEnableDelegationPrivilege 5300 msiexec.exe Token: SeManageVolumePrivilege 5300 msiexec.exe Token: SeImpersonatePrivilege 5300 msiexec.exe Token: SeCreateGlobalPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5464 msiexec.exe Token: SeTakeOwnershipPrivilege 5464 msiexec.exe Token: SeRestorePrivilege 5464 msiexec.exe Token: SeTakeOwnershipPrivilege 5464 msiexec.exe Token: SeRestorePrivilege 5464 msiexec.exe Token: SeTakeOwnershipPrivilege 5464 msiexec.exe Token: SeRestorePrivilege 5464 msiexec.exe Token: SeTakeOwnershipPrivilege 5464 msiexec.exe Token: SeRestorePrivilege 5464 msiexec.exe Token: SeTakeOwnershipPrivilege 5464 msiexec.exe Token: SeRestorePrivilege 5464 msiexec.exe Token: SeTakeOwnershipPrivilege 5464 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1312 ZimmetTakipSetup.tmp - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1312 1476 ZimmetTakipSetup.exe 81 PID 1312 wrote to memory of 5300 1312 ZimmetTakipSetup.tmp 82 PID 5464 wrote to memory of 5140 5464 msiexec.exe 85 PID 1312 wrote to memory of 5712 1312 ZimmetTakipSetup.tmp 86 PID 1312 wrote to memory of 5524 1312 ZimmetTakipSetup.tmp 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZimmetTakipSetup.exe"C:\Users\Admin\AppData\Local\Temp\ZimmetTakipSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\is-BJ910QIYQ1.tmp\ZimmetTakipSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-BJ910QIYQ1.tmp\ZimmetTakipSetup.tmp" /SL5="$30254,69343874,887296,C:\Users\Admin\AppData\Local\Temp\ZimmetTakipSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\msiexec.exe"msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-I3QJLTWKJJ.tmp\SqlLocalDB.msi" /qn /norestart IACCEPTSQLSERVERLICENSETERMS=YES3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c sqllocaldb start "MSSQLLocalDB" || sqllocaldb create "MSSQLLocalDB" -s3⤵
- System Location Discovery: System Language Discovery
PID:5712
-
-
C:\Zimmet Takip Sistemi\Zimmet_Takip_Sistemi.exe"C:\Zimmet Takip Sistemi\Zimmet_Takip_Sistemi.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 31D50C4C9AB20E011DF82D1B0EC8CEE02⤵
- Loads dropped DLL
PID:5140
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-BJ910QIYQ1.tmp\ZimmetTakipSetup.tmp
- Size 4.2MB
- SHA256 e5887d91572d2726e28ef6beb3546d3e01eb27c1bf1e08ee00f66640f1743106
- MD5 0b6d2740d12753e45851baee29df64af
- SHA1 78336f6d8dac15145cf9a66e83d637eba06ea726
- SHA512 53683a30deb43c3f46173aeb1c81c6ca328b7add01ecd18173faa89b88a0dd13913c0fdb8ad32478717cd9d8e747cf792238afc325cd49041d7160122e3faa28
- SSDEEP 49152:AC+KV5oP3m5US+sVlCGnmJc8cnoWwDgxtIDjVT0r333Ph5:ACDLoUnnmJc8coWwDVT0r333PD
- TLSH T160266D13F284653AE46B1A3B483BA658583F7F713A168C477BEC2D4C4E396406D2A7C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3157.tmp
- Size 185KB
- SHA256 6ad8e9dcd4dc9e353080bc37b4136d6e2a8d8a2e0f34d5ce57ef8af6633bb96f
- MD5 f3881bd42a56fb9199a20cdeba573beb
- SHA1 1cee9c9f1e25082b86b16b7332abe5110c200b13
- SHA512 eab028717d9778301cca718d2000896b58591e681dd24fda4107f1f02ce94cfb0f65fc92806cbf1109aaec2f63b5c3a374dc79693b2e64fcc573e626bd6d5f14
- SSDEEP 3072:ewdUswqtbfdfrBaBujl0W0wAbSKsxN2MA+zcl/FTYW0CI:ewdU9UBFowoSKrNG
- TLSH T173145B54B3EA10B5F4B7D63889E15756EA72F81107309AFF039C476A0E33BD49939B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI31C5.tmp
- Size 637KB
- SHA256 6a47534ec1dadb39b23b24f3e75b4dd36c4190ccd0dcc428b69c26dbc61fbd39
- MD5 dfb38472d08f625d086bcd9700103664
- SHA1 7b9b78445b803c2e1dc710c5850165b7f11dad6f
- SHA512 53790464d4640d54c538b097c2e0cf3f68ea083451277808e28a6ec4e996e81b539d28d27038bc5647c61d40faf65827b10603c36dc30b43fc5305cee053dca5
- SSDEEP 12288:wUs7H7mYQSSL5NYJeDQzOi5IaFsUoyFEdd:FuH74nL5NYJeZi5IaFBpFEdd
- TLSH T1FAD42A1EEAA900F1D4BAC03DDA92622AF8717451473047DB43919A5F5F37BE4AB3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI31E7.tmp
- Size 553KB
- SHA256 1524f7ce0af92f7964b6471dab3d49bfff5b20821e30030978de655d1a77972f
- MD5 8566cc1e28c3246360f0e66756386a94
- SHA1 823d89b174a532cdbab5e138a4896de7ef13cafd
- SHA512 13b4c24da4fcad820a572d9c6d29c19dde9f605797c26d17a43bec45c2798d21457bb2630b5de8e5ab4707d0adaf9361fe3912cbf727a8adc6eee1efd585a442
- SSDEEP 6144:66j02CsEpCqkZXiNzOV8LJarb19c54bVcYu3qqhohy+e6WBK:1CssZYyNS8LJaV9c5oVc17hoMpBK
- TLSH T198C4291AFAB903F1D0B6C03D9992621AF9B174A54B3057DB53914A0F4F37BE49A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI31F7.tmp
- Size 493KB
- SHA256 e7aece2fee8ef3ba9f22b5668766b717325c52cb760f04bf85769e81af8776e7
- MD5 6a1ade81a319d8c6ca8faac6e00c6576
- SHA1 0d68e89ab575a7604adccf81a9406773e138295f
- SHA512 903e1909ffd5bdf099f28724d37f952e0d3245c3cdba156bbe8fc644ca8f7c5edbe711a6718f365257498bd348b58d197ca59fda6f1cf07c8ec0f12a3dbaeca2
- SSDEEP 6144:+R4e4Lb7qMiLSlCvMmDQtNqvFGvZLbnsoh0qjI3A3LL:K4FqMiWlCUmMUFGBHnsoak3LL
- TLSH T12DB42A1ABAB580F1D0B6D13C8D92A71AF8713461477057DB6391DA2B2F33BE4993EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Zimmet Takip Sistemi\Zimmet_Takip_Sistemi.exe
- Size 7.4MB
- SHA256 7805af6284eef976f58e5528260c5e5020c63fe268e37a5ed3e58c4e8b608584
- MD5 2c35bb33fdf3407a92056960fc4efe11
- SHA1 921f7702d74f2efd79596e37b70a4d3a7538e868
- SHA512 f7295e338344b341dc11f0450a8fbd8f25d38547d2f01dd94343183832e8d466d78bfe2c8a41426be9181ec335cecccf5a1611a3aace5eb6c8ae42e59bd3c792
- SSDEEP 196608:nCAm2uBbMnudzvCcF1Nichz6Q9cEcptTjFyFmX7m68Wu6:3mzBZdzvXF3i8OQ9cFp868W
- TLSH T19E76334272DE4663C0EA65B626F9926207B3F2262075E3C965A175EA4FFB3C10303F57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Zimmet Takip Sistemi\Zimmet_Takip_Sistemi.exe.config
- Size 459B
- SHA256 f78f095eb641a268f1c54bbe0b3e90cd903589ead6eb59bbb2179318049e9790
- MD5 fddcebba25c72d375856a6b4e0a7bd30
- SHA1 817ca38b4708c60adffac09b7c324cc96f54f2c6
- SHA512 f068329c6e3a66c1151dc1cfe6cbb10ed151d6bd923d0aad08873072b9f96719d6a94fd1c178cc0b592bacf6546546ec7fb3cfee31cba40739ace845a1e24a4e
- TLSH T1BEF05C30B24CBD4143730A5581128108CD39B1D6502B204CF1ADF776DF715C9219338F
- MD5 SHA1 SHA512 TLSH