Overview

overview

8

Static

static

3

WOMicClientSetup.exe

windows11-21h2-x64

Resubmissions

02/07/2026, 17:14

260702-vsbahsfx3p8

02/07/2026, 17:07

260702-vnd6lsfw2q8

Analysis

  • user interaction
    yes
  • max time kernel
    34s
  • max time network
    36s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/07/2026, 17:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    WOMicClientSetup.exe
  • Size 3.9MB
  • Sample260702-vsbahsfx3p
  • SHA256 a3fbaee712763afa9b15cc3574eaab525b8c423c794dced70bcbd80bd031207d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 5 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 56 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WOMicClientSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\WOMicClientSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Users\Admin\AppData\Local\Temp\is-CWVJ58TQG8.tmp\WOMicClientSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CWVJ58TQG8.tmp\WOMicClientSetup.tmp" /SL5="$90272,2855141,838656,C:\Users\Admin\AppData\Local\Temp\WOMicClientSetup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "& { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\82gjpv' -ErrorAction SilentlyContinue }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4452
      • C:\Users\Admin\AppData\Local\82gjpv\SystemSettings.exe
        "C:\Users\Admin\AppData\Local\82gjpv\SystemSettings.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3036
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping -n 45 127.0.0.1 >nul & del /f /q "C:\Users\Admin\AppData\Local\82gjpv\SystemSettings.exe" & rmdir /q "C:\Users\Admin\AppData\Local\82gjpv"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\system32\PING.EXE
          ping -n 45 127.0.0.1
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4796
      • C:\Program Files\WOMicClientSetup\WOMicClientSetup.exe
        "C:\Program Files\WOMicClientSetup\WOMicClientSetup.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=in action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=UDP
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:232
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=in action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=TCP
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4156
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=out action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=UDP
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2440
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=out action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=TCP
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:972
        • C:\Program Files (x86)\WOMic\driver\devcon.exe
          devcon.exe install womic.inf Root\WOMic
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3428
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0f594034-d145-8044-809a-9a3ccdc67c8a}\womic.inf" "9" "46d27e6e7" "0000000000000150" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\womic\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:464
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11fdcda04c:InstallWOMic:2.1.0.0:root\womic," "46d27e6e7" "0000000000000150" "95df"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:800
  • C:\PROGRA~2\WOMic\WOMicClient.exe
    C:\PROGRA~2\WOMic\WOMICC~1.EXE
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4640
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3556

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Resource_en.dll
        • Path C:\PROGRA~2\WOMic\Resource_en.dll
        • Size 256KB
        • SHA256 98549d94b3cbdb7a905a83fab84bbd393ddd18af5a4455bb5cdb04919bb0c104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOMicClient.exe
        • Path C:\Program Files (x86)\WOMic\WOMicClient.exe
        • Size 158KB
        • SHA256 9e07dbce584991a821ea7030bc8228271d1d2aa8ce3d4bf8f1d2309796d7ebcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        devcon.exe
        • Path C:\Program Files (x86)\WOMic\driver\devcon.exe
        • Size 80KB
        • SHA256 7b76bac391c62c5884332bd606b6026aecba8ce57c919cc1f142ef2a052dbc08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        womic.inf
        • Path C:\Program Files (x86)\WOMic\driver\womic.inf
        • Size 5KB
        • SHA256 8f2f3339a3cfd98742295b9c5864ce40922c1f6c783aaf70ce31a8defc720764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOMicClientSetup.exe
        • Path C:\Program Files\WOMicClientSetup\WOMicClientSetup.exe
        • Size 1.4MB
        • SHA256 c7c7227a636b4c612cdf3f3d803be3ef1cf8f9aedad1c5d6620e0b9f6e0931a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SystemSettings.exe
        • Path C:\Users\Admin\AppData\Local\82gjpv\SystemSettings.exe
        • Size 607KB
        • SHA256 324f5c5411951d4468f37229842784790c4a575f8c7f5b600c14546f10d790ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_5ipinrm3.dvc.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ipinrm3.dvc.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        WOMicClientSetup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-CWVJ58TQG8.tmp\WOMicClientSetup.tmp
        • Size 4.1MB
        • SHA256 d79f1e0bc7c1a9b8fb35a2c7fe9d3f4851e859d904adade55e14e9d4d704159f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LangDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsw6137.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 f577b66492e97c7b8bf515398d8deb745abafd74f56fc03e67fce248ebbeb873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsw6137.tmp\System.dll
        • Size 11KB
        • SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modern-wizard.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nsw6137.tmp\modern-wizard.bmp
        • Size 25KB
        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsw6137.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 aedb5122c12037bcf5c79c2197d1474e759cf47c67c37cdb21cf27428854a55b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsw6137.tmp\nsExec.dll
        • Size 6KB
        • SHA256 ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        womic.sys
        • Path \??\c:\PROGRA~2\womic\driver\womic.sys
        • Size 49KB
        • SHA256 75f080f206ff0c13701ff66388c4a404529d9ec71b2ba0f1fadd4b71481c0475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        womic.cat
        • Path \??\c:\program files (x86)\womic\driver\womic.cat
        • Size 10KB
        • SHA256 24ae3420b9ef53b55b6d5da957b11fdd526d35c28033fc967ea27155b374d200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3964-0-0x00000000006F0000-0x00000000007CB000-memory.dmp
        Download

        memory/3964-68-0x00000000006F0000-0x00000000007CB000-memory.dmp
        Download

        memory/4452-30-0x000001F3724D0000-0x000001F3724E0000-memory.dmp
        Download

        memory/4452-23-0x000001F372410000-0x000001F372432000-memory.dmp
        Download

        memory/4452-45-0x000001F375730000-0x000001F375736000-memory.dmp
        Download

        memory/4452-21-0x000001F3724D0000-0x000001F3724E0000-memory.dmp
        Download

        memory/4452-44-0x000001F375720000-0x000001F375728000-memory.dmp
        Download

        memory/4452-22-0x000001F3724D0000-0x000001F3724E0000-memory.dmp
        Download

        memory/4452-43-0x000001F375760000-0x000001F37577A000-memory.dmp
        Download

        memory/4452-42-0x000001F3753E0000-0x000001F3753EA000-memory.dmp
        Download

        memory/4452-41-0x000001F375740000-0x000001F37575C000-memory.dmp
        Download

        memory/4452-40-0x000001F3753D0000-0x000001F3753DA000-memory.dmp
        Download

        memory/4452-39-0x000001F375410000-0x000001F3754C3000-memory.dmp
        Download

        memory/4452-38-0x000001F3753F0000-0x000001F37540C000-memory.dmp
        Download

        memory/4452-31-0x00007FF431040000-0x00007FF431050000-memory.dmp
        Download

        memory/4452-46-0x000001F375780000-0x000001F37578A000-memory.dmp
        Download

        memory/4872-67-0x0000000000F20000-0x0000000001356000-memory.dmp
        Download

        memory/4872-55-0x0000000000B90000-0x0000000000B91000-memory.dmp
        Download

        memory/4872-5-0x0000000000B90000-0x0000000000B91000-memory.dmp
        Download