Analysis
- max time kernel
300s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 04:42
General
- Target _Silent Install.cmd
- Size 1KB
- Sample260712-fb6b1acz2k
- SHA256 fa3884292dfbf75ac05955d0ad91369a917e3e6bff6c96377df291d33e3d39d5
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 48 IoCs
- Runs .reg file with regedit 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Silent Install.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Movavi Video Editor 25.3.0.exe"Movavi Video Editor 25.3.0.exe" /SILENT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KABF4.tmp\Movavi Video Editor 25.3.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-KABF4.tmp\Movavi Video Editor 25.3.0.tmp" /SL5="$A0184,130482642,67072,C:\Users\Admin\AppData\Local\Temp\Movavi Video Editor 25.3.0.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"4⤵
- Runs .reg file with regedit
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ISTask.dll
VclStylesInno.dll
Movavi Video Editor 25.3.0.tmp
is-C5BG4.tmp
is-IPL8L.tmp
is-4FCCO.tmp
is-3EDLT.tmp
is-8V0IM.tmp
is-18IHC.tmp
is-SU27I.tmp
is-T4NDI.tmp
is-9T5KK.tmp
is-9UR28.tmp
is-6HM4D.tmp
is-7M283.tmp
version.xml
is-10GUO.tmp
memory/4072-393-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4072-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4140-55-0x0000000008500000-0x0000000008501000-memory.dmp
memory/4140-67-0x0000000008540000-0x0000000008541000-memory.dmp
memory/4140-72-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-71-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-69-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-66-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-65-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-63-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-62-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-57-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-56-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-54-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-53-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-51-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-50-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-48-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-47-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-45-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-44-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-82-0x0000000008590000-0x0000000008591000-memory.dmp
memory/4140-73-0x0000000008560000-0x0000000008561000-memory.dmp
memory/4140-70-0x0000000008550000-0x0000000008551000-memory.dmp
memory/4140-68-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-64-0x0000000008530000-0x0000000008531000-memory.dmp
memory/4140-60-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-58-0x0000000008510000-0x0000000008511000-memory.dmp
memory/4140-59-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-75-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-38-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-36-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-35-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-32-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-33-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-30-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-46-0x00000000084D0000-0x00000000084D1000-memory.dmp
memory/4140-43-0x00000000084C0000-0x00000000084C1000-memory.dmp
memory/4140-42-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-74-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-41-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-61-0x0000000008520000-0x0000000008521000-memory.dmp
memory/4140-40-0x00000000084B0000-0x00000000084B1000-memory.dmp
memory/4140-39-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-37-0x0000000002670000-0x0000000002671000-memory.dmp
memory/4140-28-0x0000000002640000-0x0000000002641000-memory.dmp
memory/4140-52-0x00000000084F0000-0x00000000084F1000-memory.dmp
memory/4140-29-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-49-0x00000000084E0000-0x00000000084E1000-memory.dmp
memory/4140-26-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-31-0x0000000002650000-0x0000000002651000-memory.dmp
memory/4140-27-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-25-0x0000000002630000-0x0000000002631000-memory.dmp
memory/4140-88-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-89-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-90-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-91-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-92-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-95-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-97-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-96-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-223-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-332-0x0000000002300000-0x0000000002301000-memory.dmp
memory/4140-87-0x00000000081EE000-0x00000000081EF000-memory.dmp
memory/4140-77-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-80-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-81-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-83-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-84-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-78-0x0000000008370000-0x00000000084B0000-memory.dmp
memory/4140-79-0x0000000008580000-0x0000000008581000-memory.dmp
memory/4140-76-0x0000000008570000-0x0000000008571000-memory.dmp
memory/4140-34-0x0000000002660000-0x0000000002661000-memory.dmp
memory/4140-23-0x0000000008050000-0x000000000836A000-memory.dmp
memory/4140-17-0x0000000002390000-0x00000000023A6000-memory.dmp
memory/4140-6-0x0000000002300000-0x0000000002301000-memory.dmp
memory/4140-533-0x0000000008050000-0x000000000836A000-memory.dmp