Analysis
- user interaction
yes - max time kernel
299s - max time network
279s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
06/07/2026, 01:26
General
- Target Procuracao_Digital.exe
- Size 62.9MB
- Sample260706-bt2djsg121
- SHA256 e0dae1a04b7a3b2ae07377b0fd00681e9633532788870b3709a9e149f3ccf0e0
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 14 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Procuracao_Digital.exe"C:\Users\Admin\AppData\Local\Temp\Procuracao_Digital.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5COQ0Q3D2I.tmp\Procuracao_Digital.tmp"C:\Users\Admin\AppData\Local\Temp\is-5COQ0Q3D2I.tmp\Procuracao_Digital.tmp" /SL5="$40230,64665588,887296,C:\Users\Admin\AppData\Local\Temp\Procuracao_Digital.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"3⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe" --type=gpu-process --field-trial-handle=1652,8607791270149952969,3184729449445364143,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,8607791270149952969,3184729449445364143,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe" --type=gpu-process --field-trial-handle=1652,8607791270149952969,3184729449445364143,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe" --type=gpu-process --field-trial-handle=1732,10363275585405904863,676345577857633984,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1740 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1732,10363275585405904863,676345577857633984,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2068 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe"C:\Users\Admin\AppData\Local\SuperPlusifySuperUtilware\Boost Note.exe" --type=gpu-process --field-trial-handle=1732,10363275585405904863,676345577857633984,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1524 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SearchHoverUnifiedTileModelCache.dat
SearchHoverUnifiedTileModelCache.dat
D3DCompiler_47.dll
chrome_100_percent.pak
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
en-US.pak
resources.pak
index.js
package.json
libEGL.dll
libglesv2.dll
v8_context_snapshot.bin
Procuracao_Digital.tmp
LICENSE_1ac153
LICENSE_3e3af4
LICENSE_541d35
LICENSE_a9b8a8
angular-sprintf.min.map
license_d653f0
license_f462d0
pako_inflate.js
updateInfo.js.map
daemon.log
memory/984-2416-0x0000000000720000-0x0000000000808000-memory.dmp
memory/984-0-0x0000000000720000-0x0000000000808000-memory.dmp
memory/2396-2565-0x0000022FD1030000-0x0000022FD13A3000-memory.dmp
memory/2396-2422-0x0000022FD1030000-0x0000022FD13A3000-memory.dmp
memory/2396-2523-0x0000022FD1030000-0x0000022FD13A3000-memory.dmp
memory/2396-2459-0x0000022FD1030000-0x0000022FD13A3000-memory.dmp
memory/2396-2421-0x0000022FD0BD0000-0x0000022FD102C000-memory.dmp
memory/3028-2417-0x00000000004A0000-0x00000000008ED000-memory.dmp
memory/3028-5-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3028-2418-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/5800-2420-0x000002D6F5470000-0x000002D6F57E3000-memory.dmp
memory/5800-2457-0x000002D6F5470000-0x000002D6F57E3000-memory.dmp
memory/5800-2419-0x000002D6F5010000-0x000002D6F546C000-memory.dmp
memory/5800-2521-0x000002D6F5470000-0x000002D6F57E3000-memory.dmp
memory/5800-2563-0x000002D6F5470000-0x000002D6F57E3000-memory.dmp
memory/5800-2392-0x00007FFC27030000-0x00007FFC27031000-memory.dmp