Overview

overview

6

Static

static

1

MacroRecor...up.exe

windows10-2004-x64

6

MacroRecor...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/07/2026, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MacroRecorderSetup.exe
  • Size 46.3MB
  • Sample260708-mpv7hset9v
  • SHA256 89d9a6a8a00bdebae267f65339a5015c3d84273f8be91e37acde1f9cf02788fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 28 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\is-H7SM2.tmp\MacroRecorderSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-H7SM2.tmp\MacroRecorderSetup.tmp" /SL5="$B01C4,47430593,881664,C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"
      2⤵
      • Checks for any installed AV software in registry
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh" advfirewall firewall add rule name="MacroRecorder" dir=in action=allow program="C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4896
      • C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe
        "C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MacroRecorder.exe
        • Path C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe
        • Size 27.6MB
        • SHA256 c6a55c854821edec33f94039be71a3e45c3f749e7c220c43dd4e9b97a2fef4f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mrkey.dll
        • Path C:\Program Files (x86)\MacroRecorder\mrkey.dll
        • Size 156KB
        • SHA256 e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mrocr.dll
        • Path C:\Program Files (x86)\MacroRecorder\mrocr.dll
        • Size 2.5MB
        • SHA256 811577bf493b4b878985e72a766d7e2c9a2e785578f36bccf832fd38ed5776ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mrzbar.dll
        • Path C:\Program Files (x86)\MacroRecorder\mrzbar.dll
        • Size 1.1MB
        • SHA256 a886aa1df02a51ce61159a91ffc3fc38fecd71527b23979d806d8aab4a49fb14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isdecmp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-3EDQ6.tmp\_isetup\_isdecmp.dll
        • Size 28KB
        • SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MacroRecorderSetup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-H7SM2.tmp\MacroRecorderSetup.tmp
        • Size 3.4MB
        • SHA256 52163799bf2ba7276a51b2ab72d86f7a89abb32b988edff2ed0846210efe3e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2112-67-0x0000000000A70000-0x0000000002633000-memory.dmp
        Download

        memory/2112-68-0x0000000000400000-0x0000000000431000-memory.dmp
        Download

        memory/2320-55-0x0000000000B00000-0x0000000000BE7000-memory.dmp
        Download

        memory/2320-0-0x0000000000B00000-0x0000000000BE7000-memory.dmp
        Download

        memory/2320-64-0x0000000000B00000-0x0000000000BE7000-memory.dmp
        Download

        memory/4988-57-0x00000000012A0000-0x00000000012A1000-memory.dmp
        Download

        memory/4988-63-0x0000000000520000-0x0000000000893000-memory.dmp
        Download

        memory/4988-56-0x0000000000520000-0x0000000000893000-memory.dmp
        Download

        memory/4988-5-0x00000000012A0000-0x00000000012A1000-memory.dmp
        Download