Analysis
- max time kernel
20s - max time network
39s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 10:38
General
- Target MacroRecorderSetup.exe
- Size 46.3MB
- Sample260708-mpv7hset9v
- SHA256 89d9a6a8a00bdebae267f65339a5015c3d84273f8be91e37acde1f9cf02788fa
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ME3DT.tmp\MacroRecorderSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ME3DT.tmp\MacroRecorderSetup.tmp" /SL5="$50218,47430593,881664,C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh" advfirewall firewall add rule name="MacroRecorder" dir=in action=allow program="C:\Users\Admin\AppData\Local\Programs\MacroRecorder\MacroRecorder.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\MacroRecorder\MacroRecorder.exe"C:\Users\Admin\AppData\Local\Programs\MacroRecorder\MacroRecorder.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
MacroRecorder.exe
mrkey.dll
MacroRecorderSetup.tmp
_isdecmp.dll
memory/3268-13-0x00000000008D0000-0x00000000009B7000-memory.dmp
memory/3268-0-0x00000000008D0000-0x00000000009B7000-memory.dmp
memory/3268-70-0x00000000008D0000-0x00000000009B7000-memory.dmp
memory/3968-67-0x0000000000C10000-0x0000000000C41000-memory.dmp
memory/5728-15-0x0000000002560000-0x0000000002561000-memory.dmp
memory/5728-14-0x0000000000380000-0x00000000006F3000-memory.dmp
memory/5728-60-0x0000000000380000-0x00000000006F3000-memory.dmp
memory/5728-6-0x0000000002560000-0x0000000002561000-memory.dmp
memory/5728-69-0x0000000000380000-0x00000000006F3000-memory.dmp