Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 23:47
General
- Target Kaspersky4Win.exe
- Size 6.7MB
- Sample260708-3s9gbabw21
- SHA256 b05f9cf4aa1fdf416712609cea858cef6766a10f3c28ad7918064becf075d7e3
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 33 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaspersky4Win.exe"C:\Users\Admin\AppData\Local\Temp\Kaspersky4Win.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\D18285E672B71F1118D3E4E69C10C80B\Kaspersky4Win.exe"C:\Windows\temp\D18285E672B71F1118D3E4E69C10C80B\Kaspersky4Win.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky4Win.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5136E7E672B71F1118D3E4E69C10C80B\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\5136E7E672B71F1118D3E4E69C10C80B\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAABtfCkLoF1YEeRA9LDTDUvxApAAACgN//+oGi9ObUtGci4AGAAHAEYAcABqAGgAcgBzAGgAdgAAAAcAMQAwAC4AMQAyADcALgAwAC4ANgA3AAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
Kaspersky4Win.exe
memory/2320-0-0x0000000077280000-0x0000000077290000-memory.dmp
memory/2320-1-0x0000000077280000-0x0000000077290000-memory.dmp
memory/2320-2-0x0000000077280000-0x0000000077290000-memory.dmp
memory/3368-4-0x0000000077290000-0x00000000772A0000-memory.dmp
memory/3368-5-0x0000000077290000-0x00000000772A0000-memory.dmp
memory/3368-6-0x0000000077290000-0x00000000772A0000-memory.dmp
memory/4520-85-0x0000000006E20000-0x00000000073DA000-memory.dmp
memory/4520-45-0x0000000072790000-0x0000000072F4C000-memory.dmp
memory/4520-90-0x0000000006A70000-0x0000000006A96000-memory.dmp
memory/4520-84-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/4520-94-0x0000000006B60000-0x0000000006C14000-memory.dmp
memory/4520-83-0x00000000064B0000-0x0000000006858000-memory.dmp
memory/4520-99-0x0000000008030000-0x0000000008078000-memory.dmp
memory/4520-79-0x0000000005DE0000-0x0000000005DF6000-memory.dmp
memory/4520-75-0x0000000005C30000-0x0000000005C98000-memory.dmp
memory/4520-103-0x0000000008000000-0x0000000008016000-memory.dmp
memory/4520-50-0x0000000005A40000-0x0000000005A90000-memory.dmp
memory/4520-107-0x0000000007FF0000-0x0000000008000000-memory.dmp
memory/4520-111-0x00000000080A0000-0x00000000080BC000-memory.dmp
memory/4520-86-0x00000000068A0000-0x00000000068DE000-memory.dmp
memory/4520-123-0x00000000080C0000-0x00000000080E0000-memory.dmp
memory/4520-44-0x0000000072790000-0x0000000072F4C000-memory.dmp
memory/4520-119-0x0000000008200000-0x00000000082B4000-memory.dmp
memory/4520-41-0x0000000005530000-0x000000000553E000-memory.dmp
memory/4520-115-0x0000000008100000-0x0000000008134000-memory.dmp
memory/4520-124-0x000000000C3F0000-0x000000000C482000-memory.dmp
memory/4520-38-0x00000000727A2000-0x00000000727A3000-memory.dmp
memory/4520-128-0x000000000C490000-0x000000000C4F0000-memory.dmp
memory/4520-129-0x000000000C3D0000-0x000000000C3D8000-memory.dmp
memory/4520-130-0x000000000C530000-0x000000000C53E000-memory.dmp
memory/4520-141-0x00000000727A2000-0x00000000727A3000-memory.dmp
memory/4520-142-0x0000000000460000-0x0000000000515000-memory.dmp
memory/4520-143-0x0000000072790000-0x0000000072F4C000-memory.dmp