7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260711-ejs6zadt8z
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5552	powershell.exe
5272	powershell.exe
4756	powershell.exe
4312	powershell.exe
5784	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4756	powershell.exe
4756	powershell.exe
4312	powershell.exe
4312	powershell.exe
5784	powershell.exe
5784	powershell.exe
5552	powershell.exe
5552	powershell.exe
5272	powershell.exe
5272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeIncreaseQuotaPrivilege	4756	powershell.exe
Token: SeSecurityPrivilege	4756	powershell.exe
Token: SeTakeOwnershipPrivilege	4756	powershell.exe
Token: SeLoadDriverPrivilege	4756	powershell.exe
Token: SeSystemProfilePrivilege	4756	powershell.exe
Token: SeSystemtimePrivilege	4756	powershell.exe
Token: SeProfSingleProcessPrivilege	4756	powershell.exe
Token: SeIncBasePriorityPrivilege	4756	powershell.exe
Token: SeCreatePagefilePrivilege	4756	powershell.exe
Token: SeBackupPrivilege	4756	powershell.exe
Token: SeRestorePrivilege	4756	powershell.exe
Token: SeShutdownPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeSystemEnvironmentPrivilege	4756	powershell.exe
Token: SeRemoteShutdownPrivilege	4756	powershell.exe
Token: SeUndockPrivilege	4756	powershell.exe
Token: SeManageVolumePrivilege	4756	powershell.exe
Token: 33	4756	powershell.exe
Token: 34	4756	powershell.exe
Token: 35	4756	powershell.exe
Token: 36	4756	powershell.exe
Token: SeIncreaseQuotaPrivilege	4756	powershell.exe
Token: SeSecurityPrivilege	4756	powershell.exe
Token: SeTakeOwnershipPrivilege	4756	powershell.exe
Token: SeLoadDriverPrivilege	4756	powershell.exe
Token: SeSystemProfilePrivilege	4756	powershell.exe
Token: SeSystemtimePrivilege	4756	powershell.exe
Token: SeProfSingleProcessPrivilege	4756	powershell.exe
Token: SeIncBasePriorityPrivilege	4756	powershell.exe
Token: SeCreatePagefilePrivilege	4756	powershell.exe
Token: SeBackupPrivilege	4756	powershell.exe
Token: SeRestorePrivilege	4756	powershell.exe
Token: SeShutdownPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeSystemEnvironmentPrivilege	4756	powershell.exe
Token: SeRemoteShutdownPrivilege	4756	powershell.exe
Token: SeUndockPrivilege	4756	powershell.exe
Token: SeManageVolumePrivilege	4756	powershell.exe
Token: 33	4756	powershell.exe
Token: 34	4756	powershell.exe
Token: 35	4756	powershell.exe
Token: 36	4756	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeIncreaseQuotaPrivilege	4312	powershell.exe
Token: SeSecurityPrivilege	4312	powershell.exe
Token: SeTakeOwnershipPrivilege	4312	powershell.exe
Token: SeLoadDriverPrivilege	4312	powershell.exe
Token: SeSystemProfilePrivilege	4312	powershell.exe
Token: SeSystemtimePrivilege	4312	powershell.exe
Token: SeProfSingleProcessPrivilege	4312	powershell.exe
Token: SeIncBasePriorityPrivilege	4312	powershell.exe
Token: SeCreatePagefilePrivilege	4312	powershell.exe
Token: SeBackupPrivilege	4312	powershell.exe
Token: SeRestorePrivilege	4312	powershell.exe
Token: SeShutdownPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeSystemEnvironmentPrivilege	4312	powershell.exe
Token: SeRemoteShutdownPrivilege	4312	powershell.exe
Token: SeUndockPrivilege	4312	powershell.exe
Token: SeManageVolumePrivilege	4312	powershell.exe
Token: 33	4312	powershell.exe
Token: 34	4312	powershell.exe
Token: 35	4312	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4568	Setup.exe
4568	Setup.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2524	4568	Setup.exe	86
PID 4568 wrote to memory of 5888	4568	Setup.exe	88
PID 4568 wrote to memory of 2232	4568	Setup.exe	90
PID 4568 wrote to memory of 3752	4568	Setup.exe	92
PID 3752 wrote to memory of 4756	3752	cmd.exe	94
PID 4568 wrote to memory of 5184	4568	Setup.exe	96
PID 5184 wrote to memory of 4312	5184	cmd.exe	98
PID 4568 wrote to memory of 4144	4568	Setup.exe	99
PID 4144 wrote to memory of 5784	4144	cmd.exe	101
PID 4568 wrote to memory of 252	4568	Setup.exe	102
PID 252 wrote to memory of 5552	252	cmd.exe	104
PID 4568 wrote to memory of 2036	4568	Setup.exe	105
PID 2036 wrote to memory of 5272	2036	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 99e064668a29a8cc72cfb8afbc5d16fca88f0e2ec7b252b0cdf05862e782a6a2
MD5 5a6da234a87bbab18c4f4764bf50b3dd
SHA1 6366e83284eaa6fdfe0b44bb9ef2143fb5ced417
SHA512 1ace42a5ee85d479ab57a5c106c9dc2df9c789b5190404d1b9af99210ef5c87a797a71b5527391c5cbc03fef8649e76a1442bf68b562ddf8410735aae820e762
TLSH
T14F219833F3DC8214CC9A403A10DDAC1036B6C7DB40DECF9B6B81E159A42F699CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c11ba17dffd1ec3a5a6a5007ff7d65ce3e4b45a168312f3ee8fd0ba259e721c1
MD5 a260df5887ad9dd47cacaff566fe9f3e
SHA1 465bc8987b1dfa7bde36052af2e143a5b7558c8d
SHA512 4a375038e82e9beff9898f7c02d384ea50df84708c39f26d955cc2e1bb8e0fe09106e22919423d20c70e79fb4ee9ac7fb51754537a40d691c8d48adea77fcd30
TLSH
T13C217633B3DC8624C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d83ef103a8e4d8af561f78bc3df5bdf5c71c54e7098c9ef7f9fdf46faba1b3e5
MD5 9cc6fcdc364b6a3a0c3552b46087bc1e
SHA1 118bd308512179395ed2bc7bfb7a43c24d070daf
SHA512 5ff9e79101c5683aa8aeabe491454128a45f0bf4a19124cedcca31b960b9746f4ea6928992a5112c31d15921459b5b94990bb610caf2d870b3d4f6f1c704b524
TLSH
T1C2217633B3DD8624C899013A10DDAC1036B6C7CB40DECF9B6B81E159A82F698DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5n2t2ihi.y4t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5n2t2ihi.y4t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/4312-287-0x000001EAB6630000-0x000001EAB66E2000-memory.dmp

Download

memory/4756-268-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-281-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-274-0x00000258F14B0000-0x00000258F1562000-memory.dmp

Download

memory/4756-273-0x00000258F1210000-0x00000258F122E000-memory.dmp

Download

memory/4756-275-0x00000258F1230000-0x00000258F123A000-memory.dmp

Download

memory/4756-277-0x00000258F1270000-0x00000258F1294000-memory.dmp

Download

memory/4756-276-0x00000258F1270000-0x00000258F129A000-memory.dmp

Download

memory/4756-279-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-278-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-270-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-269-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-260-0x00007FFBCA0FF000-0x00007FFBCA100000-memory.dmp

Download

memory/4756-267-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-266-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-265-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-264-0x00007FFBC9F70000-0x00007FFBCA914000-memory.dmp

Download

memory/4756-263-0x00000258F1160000-0x00000258F1182000-memory.dmp

Download