Overview

overview

6

Static

static

1

NiniteInstaller.exe

windows10-2004-x64

6

NiniteInstaller.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/06/2026, 12:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NiniteInstaller.exe
  • Size 422KB
  • Sample260624-prphvsb15x
  • SHA256 68b8dfa48f450078204821165191603f0c2f29493751e0975ca2d881db12b408
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywaretrojanupx

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 7 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • NSIS installer 4 IoCs
    installer
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NiniteInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\NiniteInstaller.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\1246C5~1\target.exe
      target.exe /S
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:628
    • C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\2A1723~1\target.exe
      C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\2A1723~1\target.exe /S
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\Everything.exe
        "C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\Everything.exe" -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"
        3⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Program Files\Everything\Everything.exe
          "C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          PID:4684
      • C:\Program Files\Everything\Everything.exe
        "C:\Program Files\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033
        3⤵
        • Executes dropped EXE
        PID:1628
    • C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\3A27DB~1\target.exe
      target.exe /S /NOCANDY
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:4800
    • C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\3A27DB~1\unzip.exe
      "C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\3A27DB~1\unzip.exe" -o translation.zip
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2740
    • C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43FFF5~1\target.exe
      C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43FFF5~1\target.exe -install -all-users /s
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:768
    • C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43FFF5~2\target.exe
      C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43FFF5~2\target.exe /VERYSILENT /SP- /NORESTART
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Users\Admin\AppData\Local\Temp\is-5LJD7MZ3GB.tmp\target.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-5LJD7MZ3GB.tmp\target.tmp" /SL5="$50268,18914073,1017856,C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43fff5bc-6fc9-11f1-aa2c-761c4632812c\target.exe" /VERYSILENT /SP- /NORESTART
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:1064
    • C:\Program Files\VideoLAN\VLC\uninstall.exe
      "C:\Program Files\VideoLAN\VLC\uninstall.exe" /S
      2⤵
        PID:3332
        • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
          "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" /S _?=C:\Program Files\VideoLAN\VLC\
          3⤵
            PID:4156
      • C:\Program Files\Everything\Everything.exe
        "C:\Program Files\Everything\Everything.exe" -svc
        1⤵
        • Executes dropped EXE
        PID:552
      • C:\Program Files\Everything\Everything.exe
        "C:\Program Files\Everything\Everything.exe" -startup
        1⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4876

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ImgBurn.exe
            • Path C:\Program Files (x86)\ImgBurn\ImgBurn.exe
            • Size 2.6MB
            • SHA256 02c74678128a9dfef58eab5abe269382c6b4862440c26c22cde7b83868f478f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uninstall.exe
            • Path C:\Program Files (x86)\ImgBurn\uninstall.exe
            • Size 72KB
            • SHA256 1b5cb8035b18d06b5219f2e7d30200ca343c0ce6763962c7c41534aecc2b1c80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 707KB
            • SHA256 46e875296485409bde0482143e86dab9c675f2f3e67c99f3e2ab00b737532991
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Audacity.exe
            • Path C:\Program Files\Audacity\Audacity.exe
            • Size 14.9MB
            • SHA256 10bc7436ffc0dfb99aed8c1c1df9521434b8af28f9470dbf2e5e3dddea6196a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-HC67V6359Y.tmp
            • Path C:\Program Files\Audacity\Languages\es\is-HC67V6359Y.tmp
            • Size 345KB
            • SHA256 04733111a8e484461bdcd4a163b16b7337a207382fc58ff224697e2bac0ab46e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-9IJX5GUZ6D.tmp
            • Path C:\Program Files\Audacity\Languages\tr\is-9IJX5GUZ6D.tmp
            • Size 336KB
            • SHA256 60a3e5698e024d79161138aa9554166d70cd258e59fa5651fecd6fe825dad843
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Everything.ini
            • Path C:\Program Files\Everything\Everything.ini
            • Size 215B
            • SHA256 f0969f438d2869641d8f76d5b9fd2b82c7232134a90972e96abb3783d1e2fbe5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            target.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\1246c5fd-6fc9-11f1-aa2c-761c4632812c\target.exe
            • Size 1.6MB
            • SHA256 d64a0468f5b5b0b0fc5b2188450bcd655b70809d97b1c4535f2884635094377d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            target.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\2a17236a-6fc9-11f1-aa2c-761c4632812c\target.exe
            • Size 1.9MB
            • SHA256 c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            translation.zip
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\3A27DB~1\translation.zip
            • Size 22B
            • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
            • MD5 SHA1 SHA512
            Submit Download

            target.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\3a27dbea-6fc9-11f1-aa2c-761c4632812c\target.exe
            • Size 3.0MB
            • SHA256 49aa06eaffe431f05687109fee25f66781abbe1108f3f8ca78c79bdec8753420
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unzip.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\3a27dbea-6fc9-11f1-aa2c-761c4632812c\unzip.exe
            • Size 164KB
            • SHA256 8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            target.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43fff5b4-6fc9-11f1-aa2c-761c4632812c\target.exe
            • Size 10.6MB
            • SHA256 1eee71cccd2ea6e94d5bcea54ee2f759844da3e1a0ee2f6045035b1d17b94381
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            target.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\43fff5bc-6fc9-11f1-aa2c-761c4632812c\target.exe
            • Size 19.5MB
            • SHA256 4a6d77f023c0209a396fcf2f3c7c04e240b6ba9897b3231a6ed18e14c10caa16
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Ninite.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\f8deb837-6fc8-11f1-aa2c-761c4632812c\Ninite.dll
            • Size 1.7MB
            • SHA256 c63fd2680fa7bbb6b7736257dd8d995e4ca2d0db1bf1d9909da9a1eff85068cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            target.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-5LJD7MZ3GB.tmp\target.tmp
            • Size 4.3MB
            • SHA256 3cb1d280ca1981efc02a89290d1df94c7208941a4ea4e1f17bdcedb974d50bfb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FindProcDLL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc6D34.tmp\FindProcDLL.dll
            • Size 3KB
            • SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc6D34.tmp\System.dll
            • Size 10KB
            • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Changes.txt
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\Changes.txt
            • Size 20KB
            • SHA256 8e279763ef89aae7073e29584e65ac05e410a45d2a8ea5ed1b3a160f70715924
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Everything.lng
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\Everything.lng
            • Size 1008KB
            • SHA256 84e0ae09a9e268424ce85a85135c704c534ff60f92e150413b9df05a88979be7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            License.txt
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\License.txt
            • Size 2KB
            • SHA256 50fea29fabe12533c4e43407e12f549b8c3a2d250fe13b961623147acb1c25b2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\Uninstall.exe
            • Size 139KB
            • SHA256 9a2ed5aa6f5f40783619b736769a4a32817694b372f1f4f1082c1a0fb97a7489
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            everything.exe
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\Everything\everything.exe
            • Size 2.2MB
            • SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstallOptions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\InstallOptions.dll
            • Size 15KB
            • SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstallOptions.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\InstallOptions.ini
            • Size 1KB
            • SHA256 99b98f333848dacc5df866402181a6e2441fff0f9cdbb2a26f5f2c5d5dd12c52
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            InstallOptions2.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\InstallOptions2.ini
            • Size 2KB
            • SHA256 caf045fdf50d8706410dabb4b4db6edab64d09a1c4229854666c5fdcbc70f35d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsr1F43.tmp\System.dll
            • Size 12KB
            • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Un_A.exe
            • Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
            • Size 237KB
            • SHA256 9688e690947d9e5fa9d0f871c39742e29ef14f391d9301fc82c6eb7f7534f916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Everything.ini
            • Path C:\Users\Admin\AppData\Roaming\Everything\Everything.ini
            • Size 20KB
            • SHA256 2fb724dd202047575842ab8b47f7c395b06c84879af5a1cd5978b3a0111e3580
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Audacity.lnk
            • Path C:\Users\Public\Desktop\Audacity.lnk
            • Size 860B
            • SHA256 9b541ed3dc9bafc370e852ba194f1c16d5c287f80b5091d5081509735920153a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Everything.lnk
            • Path C:\Users\Public\Desktop\Everything.lnk
            • Size 1KB
            • SHA256 a1a542e34fad5af6cbd3c8d6b6f0090404fe084108c7d11853c7bbeb38d51633
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ImgBurn.lnk
            • Path C:\Users\Public\Desktop\ImgBurn.lnk
            • Size 1KB
            • SHA256 f0146d4e5a16c7c087e7626fb825f011c3e1bb9e7f0c8a85516d8aa33310e40c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SumatraPDF.lnk
            • Path C:\Users\Public\Desktop\SumatraPDF.lnk
            • Size 1KB
            • SHA256 73d4651aacf98e07350d774880d751de3dedf572e4bc3b0f6b58f66c49949dd1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/228-458-0x00000000006B0000-0x00000000007B7000-memory.dmp
            Download

            memory/228-975-0x00000000006B0000-0x00000000007B7000-memory.dmp
            Download

            memory/228-1029-0x00000000006B0000-0x00000000007B7000-memory.dmp
            Download

            memory/1064-1028-0x0000000000640000-0x0000000000AA1000-memory.dmp
            Download

            memory/3332-1039-0x0000000000400000-0x0000000000481000-memory.dmp
            Download

            memory/4800-396-0x0000000002F20000-0x0000000002F23000-memory.dmp
            Download

            memory/4800-397-0x0000000002F20000-0x0000000002F23000-memory.dmp
            Download