Analysis
- geolocation tags
- max time kernel
29s - max time network
8s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
27/06/2026, 17:05
General
- Target GPU-Z.2.69.0.exe
- Size 11.0MB
- Sample260627-vmcldsbz2z
- SHA256 aa6495e40a1dc3b03b03b5b0c831c5fd8f2722c9cb71254d9a059ccf4c9ba578
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GPU-Z.2.69.0.exe"C:\Users\Admin\AppData\Local\Temp\GPU-Z.2.69.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IM27A.tmp\gpuz_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-IM27A.tmp\gpuz_installer.tmp" /SL5="$50220,832512,832512,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GPU-Z.exe
gpuz_installer.exe
gpuz_installer.tmp
memory/1884-7-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1884-16-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2784-18-0x0000000000400000-0x000000000071C000-memory.dmp
memory/4612-0-0x0000000000070000-0x0000000003402000-memory.dmp
memory/4612-1-0x0000000003400000-0x0000000003401000-memory.dmp
memory/4612-2-0x0000000000070000-0x0000000003402000-memory.dmp
memory/4612-15-0x0000000000070000-0x0000000003402000-memory.dmp