0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334

Analysis

user interaction
yes
max time kernel
70s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MBSetup-3.3.exe
Size 2.7MB
Sample260705-wlpp1aew6x
SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
MD5 b2416edb738fa965cc0d0405322a24c1
SHA1 d09de4354bafc2026084c1d3a8f59514a1d430f3
SHA512 a4409884cefb389bf12f2f8ab2f0b74539e1a1c8b63f885728f4424091886450facf4e18e137bc6e5cb1e92329957de57099ad04c0433e9a4bc086e5a1238a76
SSDEEP 49152:yg9zAA9HY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LC:BdAA9HY1AeKtwnW2f
TLSH
T112D59E31B2D18020D5B39270297EA7EB5B79BC256F7640CF32D8B6390B725C0AD75B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-3.3.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-3.3.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
40	1468	MBSetup-3.3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\mbamtestfile.dat	MBSetup-3.3.exe
File created	C:\Program Files (x86)\mbamtestfile.dat	MBSetup-3.3.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\ac54d11e-288e-45b6-b2a7-6270a383892d	MBSetup-3.3.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	MBSetup-3.3.exe
File created	C:\Program Files\Malwarebytes\9b6c48ef789b11f1b3fa5e09a530fe4d	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\9b6c48f0789b11f1a1e45e09a530fe4d	MBAMInstallerService.exe

Executes dropped EXE 1 IoCs

pid	Process
2492	MBAMInstallerService.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBSetup-3.3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	MBSetup-3.3.exe
1468	MBSetup-3.3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	MBSetup-3.3.exe

C:\Users\Admin\AppData\Local\Temp\MBSetup-3.3.exe
"C:\Users\Admin\AppData\Local\Temp\MBSetup-3.3.exe"
1⤵
- Drops file in Drivers directory
- Downloads MZ/PE file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1468

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MBAMInstallerService.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
Size 10.6MB
SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
MD5 cdd8c06c1f88f57727813906e3a58fb5
SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
TLSH
T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download