Analysis
- max time kernel
133s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 17:16
General
- Target ImpactInstaller-0.9.5.exe
- Size 2.4MB
- Sample260705-vtdr2aet7s
- SHA256 c3ba9497d1a82fb5c8bdbf6fb5970934cb08c17e620f2918bdca8764e2862e70
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 45 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 43 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImpactInstaller-0.9.5.exe"C:\Users\Admin\AppData\Local\Temp\ImpactInstaller-0.9.5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\ImpactInstaller-0.9.5.exe;lib\installer-0.9.5.jar" io.github.ImpactDevelopment.installer.Installer2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
memory/716-214-0x0000000000400000-0x0000000000452000-memory.dmp
memory/2372-2-0x00000282C91E0000-0x00000282C9450000-memory.dmp
memory/2372-11-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-16-0x00000282C9450000-0x00000282C9460000-memory.dmp
memory/2372-18-0x00000282C9460000-0x00000282C9470000-memory.dmp
memory/2372-21-0x00000282C9470000-0x00000282C9480000-memory.dmp
memory/2372-22-0x00000282C9480000-0x00000282C9490000-memory.dmp
memory/2372-25-0x00000282C9490000-0x00000282C94A0000-memory.dmp
memory/2372-28-0x00000282C94A0000-0x00000282C94B0000-memory.dmp
memory/2372-30-0x00000282C94B0000-0x00000282C94C0000-memory.dmp
memory/2372-31-0x00000282C94C0000-0x00000282C94D0000-memory.dmp
memory/2372-33-0x00000282C91E0000-0x00000282C9450000-memory.dmp
memory/2372-34-0x00000282C94D0000-0x00000282C94E0000-memory.dmp
memory/2372-36-0x00000282C94E0000-0x00000282C94F0000-memory.dmp
memory/2372-39-0x00000282C94F0000-0x00000282C9500000-memory.dmp
memory/2372-38-0x00000282C9450000-0x00000282C9460000-memory.dmp
memory/2372-42-0x00000282C9500000-0x00000282C9510000-memory.dmp
memory/2372-41-0x00000282C9460000-0x00000282C9470000-memory.dmp
memory/2372-44-0x00000282C9470000-0x00000282C9480000-memory.dmp
memory/2372-45-0x00000282C9510000-0x00000282C9520000-memory.dmp
memory/2372-47-0x00000282C9480000-0x00000282C9490000-memory.dmp
memory/2372-49-0x00000282C9520000-0x00000282C9530000-memory.dmp
memory/2372-52-0x00000282C9530000-0x00000282C9540000-memory.dmp
memory/2372-55-0x00000282C9540000-0x00000282C9550000-memory.dmp
memory/2372-54-0x00000282C94A0000-0x00000282C94B0000-memory.dmp
memory/2372-50-0x00000282C9490000-0x00000282C94A0000-memory.dmp
memory/2372-56-0x00000282C94B0000-0x00000282C94C0000-memory.dmp
memory/2372-57-0x00000282C9550000-0x00000282C9560000-memory.dmp
memory/2372-60-0x00000282C94C0000-0x00000282C94D0000-memory.dmp
memory/2372-66-0x00000282C94E0000-0x00000282C94F0000-memory.dmp
memory/2372-65-0x00000282C9570000-0x00000282C9580000-memory.dmp
memory/2372-64-0x00000282C94D0000-0x00000282C94E0000-memory.dmp
memory/2372-62-0x00000282C9560000-0x00000282C9570000-memory.dmp
memory/2372-63-0x00000282C9580000-0x00000282C9590000-memory.dmp
memory/2372-68-0x00000282C9590000-0x00000282C95A0000-memory.dmp
memory/2372-71-0x00000282C95A0000-0x00000282C95B0000-memory.dmp
memory/2372-70-0x00000282C94F0000-0x00000282C9500000-memory.dmp
memory/2372-74-0x00000282C9500000-0x00000282C9510000-memory.dmp
memory/2372-75-0x00000282C95B0000-0x00000282C95C0000-memory.dmp
memory/2372-76-0x00000282C9510000-0x00000282C9520000-memory.dmp
memory/2372-77-0x00000282C95C0000-0x00000282C95D0000-memory.dmp
memory/2372-84-0x00000282C95D0000-0x00000282C95E0000-memory.dmp
memory/2372-83-0x00000282C9520000-0x00000282C9530000-memory.dmp
memory/2372-87-0x00000282C95E0000-0x00000282C95F0000-memory.dmp
memory/2372-86-0x00000282C9530000-0x00000282C9540000-memory.dmp
memory/2372-91-0x00000282C95F0000-0x00000282C9600000-memory.dmp
memory/2372-90-0x00000282C9540000-0x00000282C9550000-memory.dmp
memory/2372-93-0x00000282C9550000-0x00000282C9560000-memory.dmp
memory/2372-94-0x00000282C9600000-0x00000282C9610000-memory.dmp
memory/2372-97-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-100-0x00000282C9560000-0x00000282C9570000-memory.dmp
memory/2372-102-0x00000282C9610000-0x00000282C9620000-memory.dmp
memory/2372-101-0x00000282C9580000-0x00000282C9590000-memory.dmp
memory/2372-107-0x00000282C9620000-0x00000282C9630000-memory.dmp
memory/2372-106-0x00000282C9570000-0x00000282C9580000-memory.dmp
memory/2372-110-0x00000282C9590000-0x00000282C95A0000-memory.dmp
memory/2372-111-0x00000282C9630000-0x00000282C9640000-memory.dmp
memory/2372-115-0x00000282C95A0000-0x00000282C95B0000-memory.dmp
memory/2372-116-0x00000282C9640000-0x00000282C9650000-memory.dmp
memory/2372-118-0x00000282C95B0000-0x00000282C95C0000-memory.dmp
memory/2372-119-0x00000282C9650000-0x00000282C9660000-memory.dmp
memory/2372-121-0x00000282C95C0000-0x00000282C95D0000-memory.dmp
memory/2372-122-0x00000282C9660000-0x00000282C9670000-memory.dmp
memory/2372-128-0x00000282C9670000-0x00000282C9680000-memory.dmp
memory/2372-127-0x00000282C95D0000-0x00000282C95E0000-memory.dmp
memory/2372-132-0x00000282C9680000-0x00000282C9690000-memory.dmp
memory/2372-131-0x00000282C95E0000-0x00000282C95F0000-memory.dmp
memory/2372-135-0x00000282C9690000-0x00000282C96A0000-memory.dmp
memory/2372-134-0x00000282C95F0000-0x00000282C9600000-memory.dmp
memory/2372-137-0x00000282C9600000-0x00000282C9610000-memory.dmp
memory/2372-138-0x00000282C96A0000-0x00000282C96B0000-memory.dmp
memory/2372-139-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-142-0x00000282C96B0000-0x00000282C96C0000-memory.dmp
memory/2372-141-0x00000282C9610000-0x00000282C9620000-memory.dmp
memory/2372-145-0x00000282C96C0000-0x00000282C96D0000-memory.dmp
memory/2372-144-0x00000282C9620000-0x00000282C9630000-memory.dmp
memory/2372-148-0x00000282C9630000-0x00000282C9640000-memory.dmp
memory/2372-149-0x00000282C96D0000-0x00000282C96E0000-memory.dmp
memory/2372-153-0x00000282C96E0000-0x00000282C96F0000-memory.dmp
memory/2372-152-0x00000282C9640000-0x00000282C9650000-memory.dmp
memory/2372-155-0x00000282C9650000-0x00000282C9660000-memory.dmp
memory/2372-156-0x00000282C96F0000-0x00000282C9700000-memory.dmp
memory/2372-160-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-161-0x00000282C9660000-0x00000282C9670000-memory.dmp
memory/2372-162-0x00000282C9700000-0x00000282C9710000-memory.dmp
memory/2372-165-0x00000282C9710000-0x00000282C9720000-memory.dmp
memory/2372-164-0x00000282C9670000-0x00000282C9680000-memory.dmp
memory/2372-167-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-170-0x00000282C9720000-0x00000282C9730000-memory.dmp
memory/2372-169-0x00000282C9680000-0x00000282C9690000-memory.dmp
memory/2372-179-0x00000282C96A0000-0x00000282C96B0000-memory.dmp
memory/2372-178-0x00000282C9740000-0x00000282C9750000-memory.dmp
memory/2372-177-0x00000282C9730000-0x00000282C9740000-memory.dmp
memory/2372-176-0x00000282C9690000-0x00000282C96A0000-memory.dmp
memory/2372-182-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-184-0x00000282C96B0000-0x00000282C96C0000-memory.dmp
memory/2372-188-0x00000282C96C0000-0x00000282C96D0000-memory.dmp
memory/2372-187-0x00000282C9770000-0x00000282C9780000-memory.dmp
memory/2372-186-0x00000282C9760000-0x00000282C9770000-memory.dmp
memory/2372-190-0x00000282C9780000-0x00000282C9790000-memory.dmp
memory/2372-189-0x00000282C96D0000-0x00000282C96E0000-memory.dmp
memory/2372-185-0x00000282C9750000-0x00000282C9760000-memory.dmp
memory/2372-193-0x00000282C96E0000-0x00000282C96F0000-memory.dmp
memory/2372-206-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-212-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/2372-220-0x00000282C9080000-0x00000282C9081000-memory.dmp
memory/5004-236-0x0000016E83A50000-0x0000016E83A70000-memory.dmp
memory/5004-231-0x0000016E801E0000-0x0000016E802E0000-memory.dmp
memory/5004-233-0x0000016E801E0000-0x0000016E802E0000-memory.dmp
memory/5004-238-0x0000016E83E50000-0x0000016E83F50000-memory.dmp
memory/5004-245-0x0000016E83C90000-0x0000016E83CB0000-memory.dmp
memory/5004-255-0x0000016E946A0000-0x0000016E946C0000-memory.dmp