Analysis
- user interaction
yes - max time kernel
208s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 03:21
General
- Target jf_fsinsider_c152.exe
- Size 34.6MB
- Sample260702-dwapqabv4s
- SHA256 6ac30a432c2344c28d0dda4a0edbea0ca0d2d0192bf3f831b421cb3077457fba
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jf_fsinsider_c152.exe"C:\Users\Admin\AppData\Local\Temp\jf_fsinsider_c152.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{BAF8F850-9998-414B-A4AA-C41D27386675}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{BAF8F850-9998-414B-A4AA-C41D27386675}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89185E2F-0798-44EA-A6B9-2908726C331B}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{BAF8F850-9998-414B-A4AA-C41D27386675}\{E55250B8-D012-47A3-97E2-99FFBD0D3AD3}\Preview.exeC:\Users\Admin\AppData\Local\Temp\{BAF8F850-9998-414B-A4AA-C41D27386675}\{E55250B8-D012-47A3-97E2-99FFBD0D3AD3}\Preview.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
skinb7f1.rra
ISSetup.dll
data1.hdr
setup.isn
_Setup.dll
_isdel.ini
_ispackdel.ini
setup.ini
ISBEW64.exe
FontData.ini
Preview.exe
_IsRes.dll
boxsmall.bmp
isrt.dll
setup.inx
video.wmv
memory/5252-1595-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1583-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1615-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1613-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1614-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1553-0x0000000000900000-0x0000000000901000-memory.dmp
memory/5252-1612-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1611-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1610-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1555-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1556-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1557-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1558-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1560-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1559-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1561-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1562-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1564-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1563-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1565-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1566-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1567-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1568-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1569-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1570-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1571-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1572-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1573-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1574-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1575-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1576-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1578-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1577-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1580-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1579-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1582-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1581-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1609-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1584-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1585-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1586-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1587-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1588-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1589-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1590-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1591-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1592-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1594-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1593-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1596-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1608-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1597-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1598-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1599-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1600-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1601-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1602-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1604-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1603-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1606-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1605-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5252-1607-0x0000000005DD0000-0x0000000005DE0000-memory.dmp
memory/5896-63-0x0000000002360000-0x00000000023BA000-memory.dmp
memory/5896-836-0x0000000002800000-0x0000000002994000-memory.dmp
memory/5896-919-0x00000000068D0000-0x000000000695E000-memory.dmp
memory/5896-1550-0x0000000002800000-0x0000000002994000-memory.dmp
memory/5896-1551-0x00000000068D0000-0x000000000695E000-memory.dmp
memory/5896-882-0x0000000006B60000-0x0000000006BC6000-memory.dmp
memory/5896-855-0x0000000002800000-0x0000000002994000-memory.dmp
memory/5896-845-0x00000000068D0000-0x000000000695E000-memory.dmp
memory/5896-54-0x0000000002800000-0x0000000002994000-memory.dmp
memory/5896-57-0x0000000002992000-0x0000000002993000-memory.dmp
memory/5896-56-0x0000000002800000-0x0000000002994000-memory.dmp