3a5f25ce5f79c11d19bbee0ed3300993c1175f77b0520c03d5bd185c309f87e5

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 799KB
Sample260708-lmt11ady7x
SHA256 3a5f25ce5f79c11d19bbee0ed3300993c1175f77b0520c03d5bd185c309f87e5
MD5 6d815a45e6d19460da44a8184e55d5c6
SHA1 4c6bd08f7a7c7e7352420978c56e888ed94e5f6e
SHA512 82d83fe362f2c3bbe5436b0946b9cbfd0bcf57e2b90a237bd9b6d66114c0d7f5882d6ddc2d8a6865b41c27affc8769a22e313cf19d3a788b9d2462ce402066d4
SSDEEP 12288:vubj5je69oqAmj5oMqKyKAuqOAP0wuXeMb01JQntLOCI1no0Hg:vqhe29AmjkKuuXemI1nxA
TLSH
T1F705522A56D8B969E3F69B307FF252D3BB69BC523834CC0E11D103090975A52FDA076E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\asbi..tion_47870ca88fc321 = 687474703a2f2f63646e30312e746e622e6f72672e74722f757967756c616d612f6172746573626179692f41736269732e6170706c69636174696f6e2341736269732e6170706c69636174696f6e2c2056657273696f6e3d322e332e3136392e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343738373063613838666333323164362c2070726f636573736f724172636869746563747572653d783836	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\asbi..tion_47870ca88fc321 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d00220068007400740070003a002f002f00630064006e00300031002e0074006e0062002e006f00720067002e00740072002f0075007900670075006c0061006d0061002f006100720074006500730062006100790069002f00410073006200690073002e006100700070006c00690063006100740069006f006e002300410073006200690073002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0032002e0033002e003100360039002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0034003700380037003000630061003800380066006300330032003100640036002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d007800380036002f00410073006200690073002e006500780065002c002000560065007200730069006f006e003d0032002e0033002e003100360039002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0034003700380037003000630061003800380066006300330032003100640036002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d007800380036002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e005300650074002000760065007200730069006f006e003d002200310022000d000a0063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e004e0061006d00650064005000650072006d0069007300730069006f006e0053006500740022000d000a004e0061006d0065003d0022004c006f00630061006c0049006e007400720061006e006500740022000d000a004400650073006300720069007000740069006f006e003d002200440065006600610075006c0074002000720069006700680074007300200067006900760065006e00200074006f0020006100700070006c00690063006100740069006f006e00730020006f006e00200074006800650020006c006f00630061006c00200069006e007400720061006e006500740022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d002200280068007400740070007c006800740074007000730029003a002f002f00630064006e00300031005c002e0074006e0062005c002e006f00720067005c002e00740072002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300031003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "9WWNZ3RRNT4WZ1WMHOL5J08O"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\asbi..tion_47870ca88fc321	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "56OTRZ6DYOQAEZVR7H36CWV9"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "642DXMGT7QG9T2WC247KX8RG"	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1780	1840	setup.exe	88

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tnbAsbis.ico

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0P3MJ62W.NAK\J20GM5NJ.VMD\Resources\Images\tnbAsbis.ico
Size 97KB
SHA256 62c4690289e31a5d81d754c7c6688f66138024f36fa75fd94f74e8c4b89f6116
MD5 b977757196949f5c2415a38315fad45a
SHA1 f3a868502066fce3adf90d0e3a33d79a6c14b7a4
SHA512 5e91a188553231fa90d14d4cd8783f96af47c0aa5a43233b3e10d2d4a01424732a4ebe5d536c81e8dc1063cf7979256c38ecb14c36e347faa54381fc7d6022a9
SSDEEP 1536:MRg+H82xMYuourlRhl992ltgUN8A4l1pv9/l3sPrInNcDB9exNabNc/AJHbSHbHJ:N+veNYsMuwPD7mHXd
TLSH
T193A373A1ACA75948FC50577807338EB69123BEB5EBB0706DE9AB753D0BF33811011E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q7XK3O3Q.JCC.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\BM87J1HE.MXR\Q7XK3O3Q.JCC.application
Size 19KB
SHA256 2319206f6f4dde5d414cfd688526a2576d6abd2fe89d4f5a4c222f17733aab7c
MD5 dba967030d65c7c58aecfa91bb9065ad
SHA1 29258425e81546ae0b8bcb63febbad90c1c443ac
SHA512 48721b1a43345fd8f6bce28d7a6ddf2f51388c3ca3ef87d6bedf4648f921b2bad844c2b0600fb781fef87542040e99b3e91e6fc03e03e92b463c5ae37127efb6
SSDEEP 384:hZhrD1kht5IvkhvtB0khooBlAM7YpMls39qk2fNZT1JfQq1q0MU:lw9vLTJh0Yaw3f1qzU
TLSH
T1C592904A8E886D929303E520BAE3960D755C27A344FC40EC3DB87D0ED748EF166A25DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1780-12-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-13-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-7-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-8-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-10-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-11-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-3-0x0000021471FA0000-0x0000021471FA8000-memory.dmp

Download

memory/1780-6-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-14-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-15-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-16-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-5-0x0000021474700000-0x0000021474888000-memory.dmp

Download

memory/1780-19-0x0000021478BF0000-0x0000021478C40000-memory.dmp

Download

memory/1780-4-0x00007FF83A41F000-0x00007FF83A420000-memory.dmp

Download

memory/1780-48-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

memory/1780-51-0x00007FF83A290000-0x00007FF83AC34000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads