6cb0ef29682452de81a9576808881685161411a1fad00938ba04131159979c29

Analysis

user interaction
yes
max time kernel
118s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GPU-Z.2.70.0.exe
Size 11.1MB
Sample260628-eepmzse14x
SHA256 6cb0ef29682452de81a9576808881685161411a1fad00938ba04131159979c29
MD5 07185a3f697919e4a32d335ee5074f89
SHA1 da84d2ccdf2eb4d619315812d5f0d1a79bddd2f5
SHA512 98de5f7d6ae0120906de4efe4f483c8a4d38357a0fe940da127eba83f7d96a110ad61e4d0b42249d881037c94eafcb90b5fda30cdad51bc954e0441b6f26dd33
SSDEEP 196608:l/Z+sZqmshmds8iFZWc9q9wvxlZaXpm0p7HcmY0yafQFOkqPrukFw:lNoZl7xlv0HY0yTGrukK
TLSH
T171C63374A832C486D8F79479B4E12EC762778ACCE8FA13D74BC1604E9F0B9F45A18635
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	gpuz_installer.tmp

Executes dropped EXE 4 IoCs

pid	Process
1604	gpuz_installer.exe
1836	gpuz_installer.tmp
5112	GPU-Z.exe
5892	GPU-Z-v8.sys

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4876-0-0x0000000000020000-0x00000000033C7000-memory.dmp	upx
behavioral1/files/0x00080000000245a2-13.dat	upx
behavioral1/memory/4876-14-0x0000000000020000-0x00000000033C7000-memory.dmp	upx
behavioral1/memory/4876-43-0x0000000000020000-0x00000000033C7000-memory.dmp	upx
behavioral1/memory/5112-52-0x0000000000AF0000-0x0000000003E97000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GPU-Z\GPU-Z.exe	gpuz_installer.tmp
File created	C:\Program Files (x86)\GPU-Z\unins000.dat	gpuz_installer.tmp
File created	C:\Program Files (x86)\GPU-Z\is-73C7P.tmp	gpuz_installer.tmp
File created	C:\Program Files (x86)\GPU-Z\is-2VDQL.tmp	gpuz_installer.tmp
File opened for modification	C:\Program Files (x86)\GPU-Z\unins000.dat	gpuz_installer.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPU-Z.2.70.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpuz_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpuz_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GPU-Z.exe

Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x00070000000245a3-5.dat	innosetup
behavioral1/memory/1604-7-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/4876-14-0x0000000000020000-0x00000000033C7000-memory.dmp	innosetup
behavioral1/memory/1604-38-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/1604-41-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/4876-43-0x0000000000020000-0x00000000033C7000-memory.dmp	innosetup
behavioral1/memory/5112-52-0x0000000000AF0000-0x0000000003E97000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	gpuz_installer.tmp
1836	gpuz_installer.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	GPU-Z.2.70.0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	gpuz_installer.tmp

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4876	GPU-Z.2.70.0.exe
5112	GPU-Z.exe
5112	GPU-Z.exe
5112	GPU-Z.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1604	4876	GPU-Z.2.70.0.exe	90
PID 1604 wrote to memory of 1836	1604	gpuz_installer.exe	91
PID 1836 wrote to memory of 5112	1836	gpuz_installer.tmp	97

C:\Users\Admin\AppData\Local\Temp\GPU-Z.2.70.0.exe
"C:\Users\Admin\AppData\Local\Temp\GPU-Z.2.70.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\is-RVIBH.tmp\gpuz_installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RVIBH.tmp\gpuz_installer.tmp" /SL5="$902DC,832512,832512,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Program Files (x86)\GPU-Z\GPU-Z.exe
      "C:\Program Files (x86)\GPU-Z\GPU-Z.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5112

C:\Users\Admin\AppData\Local\Temp\GPU-Z-v8.sys
C:\Users\Admin\AppData\Local\Temp\\GPU-Z-v8.sys
1⤵
- Executes dropped EXE
PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GPU-Z-v8.sys

Path C:\Users\Admin\AppData\Local\Temp\GPU-Z-v8.sys
Size 94KB
SHA256 999cf056a298cfce5f5a61d44c218ffafccd36ecff53e433768512073e6bf005
MD5 e191f19d581c23bb8f3c7370f56db869
SHA1 0325b8b010dbc86d833b6e659fdb9608ec10cf38
SHA512 da86cd10394d478cc197d81bd6ed0c05496876637c21d09bfb7f71cfb1a8c019dba1ceb9ed3cfa2ed7dc0718b93f464fc908b830bc82b917455703f46c423853
SSDEEP 1536:HKy/21U/I4GZ1v196AhKISLcFl3gKmqznoFpOq6FBVQyzD:zuUA4GZ1v1zhwq3nmqznIgqOBV3P
TLSH
T193937C87E26811C2DE97D534D2E846B7EE30B48C5710AADF0AA4C5751E13FD16E3A32E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPU-Z.exe

Path C:\Users\Admin\AppData\Local\Temp\GPU-Z.exe
Size 11.1MB
SHA256 6cb0ef29682452de81a9576808881685161411a1fad00938ba04131159979c29
MD5 07185a3f697919e4a32d335ee5074f89
SHA1 da84d2ccdf2eb4d619315812d5f0d1a79bddd2f5
SHA512 98de5f7d6ae0120906de4efe4f483c8a4d38357a0fe940da127eba83f7d96a110ad61e4d0b42249d881037c94eafcb90b5fda30cdad51bc954e0441b6f26dd33
SSDEEP 196608:l/Z+sZqmshmds8iFZWc9q9wvxlZaXpm0p7HcmY0yafQFOkqPrukFw:lNoZl7xlv0HY0yTGrukK
TLSH
T171C63374A832C486D8F79479B4E12EC762778ACCE8FA13D74BC1604E9F0B9F45A18635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpuz_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
Size 1.6MB
SHA256 62500028679e8185f79752006da88de9229c438bbd225b1dc1f2f04a47ebb115
MD5 44c0627b72a8eb2ce199345d2aa27214
SHA1 7e0ea4e58ba1d32dbb11ceed0b1e27b805488915
SHA512 f2bde7bf7efff6a99b35418724b0ff37498e5ff715a687ec35f6eb10450867e8ee11102e2efb3550f7a2dfb3cfdadbb1c93dcd0319430a5be3f399f52749ce83
SSDEEP 24576:O7FUDowAyrTVE3U5F/Nl6Kic6QL3E2vVsjECUAQT45deRV9RY:OBuZrEUv6KIy029s4C1eH9S
TLSH
T19675BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpuz_installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RVIBH.tmp\gpuz_installer.tmp
Size 3.1MB
SHA256 ff02cd92b07585423ef7bdd0a873374922767fe21f93fcebc24181a5ee2111fa
MD5 4c9111b5058cb0a71da1c566e6b15de5
SHA1 cdf0963572c509ecc8651a7081dd5aca44886007
SHA512 3dc28a3f0a1404b67dd5374e2c5e13f1c1b0250c1e07666dbbd4bf31b400ee549c3beb7b872dd7d10dd54ce401b01a362a59bca54b2c7209cbedd97caa7cea46
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
TLSH
T19EE53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-38-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1604-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1604-41-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1836-40-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1836-39-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/4876-0-0x0000000000020000-0x00000000033C7000-memory.dmp

Download

memory/4876-14-0x0000000000020000-0x00000000033C7000-memory.dmp

Download

memory/4876-43-0x0000000000020000-0x00000000033C7000-memory.dmp

Download

memory/4876-1-0x00000000033C5000-0x00000000033C6000-memory.dmp

Download

memory/5112-52-0x0000000000AF0000-0x0000000003E97000-memory.dmp

Download