Analysis
- geolocation tags
- max time kernel
27s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 22:10
General
- Target wrsetup.exe
- Size 11.6MB
- Sample260622-13fwmsgx6q
- SHA256 e1777c300861bfd8bc925d9fff949a62257fac1d3bdbd06325a534692aab3762
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Enumerates system info in registry 2 TTPs 2 IoCs
- Kills process with taskkill 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wrsetup.exe"C:\Users\Admin\AppData\Local\Temp\wrsetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C2SPR.tmp\wrsetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-C2SPR.tmp\wrsetup.tmp" /SL5="$401E6,11097109,929792,C:\Users\Admin\AppData\Local\Temp\wrsetup.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Win Riser_launcher" /f3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "winrgr.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Win Riser\winrgr.exe"C:\Program Files\Win Riser\winrgr.exe" noscn3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.winriser.com/inw/install/win-riser/?utm_source=winrsrdft&utm_campaign=winrsrdft&utm_medium=winrsrdft&utm_pubid=&p=win5896_win5756_runt&bs=&ctx=&at=&msclkid=&gclid=&ud=-2690185254724927179&xip=85.203.46.7&xdt=22-06-2026+23%3a10%3a53&ftc=0&acttype=1&productid=1784⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff98e7bc188,0x7ff98e7bc194,0x7ff98e7bc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,12373606925845862767,8195819728766695024,262144 --field-trial-handle=2292,i,12189346462807419580,3488649579678065028,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,5055810960023153533,9643420786228896843,524288 --field-trial-handle=2292,i,12189346462807419580,3488649579678065028,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,18378044486092328668,7530646334928206827,524288 --field-trial-handle=2292,i,12189346462807419580,3488649579678065028,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,4221858052581924026,8564555334684549563,2097152 --field-trial-handle=2292,i,12189346462807419580,3488649579678065028,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,17873971795828066815,7279473024856550747,2097152 --field-trial-handle=2292,i,12189346462807419580,3488649579678065028,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5104,i,3199255106778275062,4046417097765595434,2097152 --field-trial-handle=2292,i,12189346462807419580,3488649579678065028,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:15⤵
-
-
-
-
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.Win32.TaskScheduler.dll
System.Data.SQLite.dll
WPFToolkit.dll
langs.db
winrgr.exe
winrgr.exe.config
SQLite.Interop.dll
settings.dat
settings.dat
SCT Auditing Pending Reports
Local State
wrsetup.tmp
WinRiserAPI.dll
jsonconfig.dll
gtipinfo.json
promoapps.xml
memory/4272-54-0x0000000000400000-0x0000000000724000-memory.dmp
memory/4272-46-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/4272-158-0x0000000000400000-0x0000000000724000-memory.dmp
memory/4272-45-0x0000000004790000-0x00000000047C5000-memory.dmp
memory/4272-12-0x0000000004790000-0x00000000047C5000-memory.dmp
memory/4272-6-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/4272-44-0x0000000000400000-0x0000000000724000-memory.dmp
memory/4376-176-0x0000000001300000-0x0000000001320000-memory.dmp
memory/4868-160-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/4868-43-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/4868-0-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/4924-171-0x0000000020150000-0x00000000201EC000-memory.dmp
memory/4924-182-0x0000000022710000-0x0000000022C20000-memory.dmp
memory/4924-191-0x00000000221F0000-0x0000000022200000-memory.dmp
memory/4924-179-0x0000000022010000-0x0000000022044000-memory.dmp
memory/4924-183-0x0000000023470000-0x0000000023780000-memory.dmp
memory/4924-193-0x0000000022F80000-0x0000000022FD4000-memory.dmp
memory/4924-194-0x0000000022CC0000-0x0000000022D09000-memory.dmp
memory/4924-178-0x0000000021110000-0x0000000021188000-memory.dmp
memory/4924-172-0x00000000206C0000-0x0000000020B8E000-memory.dmp
memory/4924-170-0x000000001CAA0000-0x000000001CAEC000-memory.dmp
memory/4924-169-0x000000001FAD0000-0x000000001FEA4000-memory.dmp
memory/4924-168-0x000000001F340000-0x000000001F476000-memory.dmp
memory/4924-167-0x000000001EE30000-0x000000001F340000-memory.dmp
memory/4924-227-0x0000000023900000-0x0000000023930000-memory.dmp
memory/4924-228-0x0000000024710000-0x00000000247B6000-memory.dmp
memory/4924-159-0x0000000001970000-0x0000000001980000-memory.dmp
memory/4924-235-0x00000000248B0000-0x00000000249A0000-memory.dmp
memory/4924-238-0x0000000023990000-0x00000000239CE000-memory.dmp