Overview

overview

6

Static

static

1

install.exe

windows10-2004-x64

6

install.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    901s
  • max time network
    874s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 09:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install.exe
  • Size 173.9MB
  • Sample260719-ljyj1sbs8w
  • SHA256 71473b4a29db4cbae31c2df4e63a7383e86e789b4c8e0e557ef6ef63f944047b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\install.exe
    "C:\Users\Admin\AppData\Local\Temp\install.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
      "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe" --veloapp-install 2026.711.0-lazer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5940
    • C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
      "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4380
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:3812
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3564
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5808
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:1648
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1736
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3540
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3560
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:5564

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft.Win32.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\Microsoft.Win32.Primitives.dll
            • Size 14KB
            • SHA256 190d9e13ec667b7c311c06213cbfae12e4b90528db2f032456f778891ac170ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NuGet.Versioning.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\NuGet.Versioning.dll
            • Size 63KB
            • SHA256 bfcba996b3fc59fbee4d67ae42cc86acae455cbe55119216cda2b84b4457256f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Realm.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\Realm.dll
            • Size 369KB
            • SHA256 710b1994f71488ef0438773e274d5f54f93c8b7019efa700f0efda09d0d978d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SDL3-CS.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\SDL3-CS.dll
            • Size 359KB
            • SHA256 8d631bfcddade47decd20dd3e95b2411dbee68fd39bd820ee8204eb5723dd568
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Sentry.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\Sentry.dll
            • Size 822KB
            • SHA256 9cf94b0b761c5b5a0a6b67cb8949baff8b45fff5e2c0c91d5309d27c3d0e60a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Immutable.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.Immutable.dll
            • Size 817KB
            • SHA256 f134239f34d90e805fd44c26d2b350f31915734b1dc1b008e5ccec89a39a90aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.NonGeneric.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.NonGeneric.dll
            • Size 101KB
            • SHA256 aba7167d2e95ee23a55a03586588eb01ca3e63942ff2e1392936692bc337c194
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.dll
            • Size 253KB
            • SHA256 f0fe3fc9cecf713d5c29a2fecdf6aafc50b41efb8130a56af54b8c9330c1ffc1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.ComponentModel.Primitives.dll
            • Size 77KB
            • SHA256 3dc8bfbf3b542c45646a7057d3e945374c7b85db69c37f2a16794e88091a5b06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.Process.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Diagnostics.Process.dll
            • Size 329KB
            • SHA256 4ca86970668d670a579db1c5733144048d1e52c2bb2e0892c86f665e39883f8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Linq.dll
            • Size 529KB
            • SHA256 1b81642c1ee4f21ebbb57213c14e50df59aabcd7bf91de2eebdf4c0d9f32845b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Memory.dll
            • Size 153KB
            • SHA256 4d6fe7d23c06b4e81748d83a1314218f31bb1e4ce9b6d1ebc7ba8a78a342833c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ObjectModel.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.ObjectModel.dll
            • Size 77KB
            • SHA256 015061c7fea90ceaaabe2669db8b8110249295e19a6a571363c8a581ad9ba7dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.CoreLib.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.CoreLib.dll
            • Size 12.6MB
            • SHA256 2127c8c1dbd9147205be92641cc6302e944ec49f002e51b4320599b765ed2f2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Uri.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Uri.dll
            • Size 253KB
            • SHA256 7ce81174fdba93a1e12c596ea3e1ad4bcc9e798710292e1629cbe827ee34458b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Xml.Linq.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.Linq.dll
            • Size 393KB
            • SHA256 3dfc8c3f32e242ee23a7d7c97a13c5e798248d1aec2212da8291be9898ff82f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Xml.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.dll
            • Size 7.6MB
            • SHA256 9f4783f9f82217dc44aae218a5d203b314313305b64ec97a0f8caf4fc53e7d86
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.InteropServices.dll
            • Size 93KB
            • SHA256 74a2dd12e1c0f3d9aca3f11e160a1de7a5bd4447ed8be3071377217a516f6874
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.dll
            • Size 42KB
            • SHA256 1b56f3da3567ff55f013332ae17796ac6cd067018878d8f322f8425b04b70720
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Encoding.Extensions.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Text.Encoding.Extensions.dll
            • Size 15KB
            • SHA256 e35568fcbddd90781f904f5bbb8d925a35f509c7e1ce626d24e7d43ea6ad2c0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.Thread.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.Thread.dll
            • Size 15KB
            • SHA256 565346c61faca21110027638e7af298e0162d587afc3f5bdcb993c80922a1cf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.dll
            • Size 81KB
            • SHA256 76900e5c96b72e6e74477a90897f86c9f8b78eb2169010298cd4aecec5466ae3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Xml.ReaderWriter.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.ReaderWriter.dll
            • Size 21KB
            • SHA256 32151d8d938eb388a6a0abc05ab955430f21aba92e960bdb6e5c6029a45d2f34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Xml.XDocument.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.XDocument.dll
            • Size 15KB
            • SHA256 d6f34c5ea1bbcc6b136110bf477d11d86d8220658996e321d36ce51a35bff159
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Velopack.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\Velopack.dll
            • Size 273KB
            • SHA256 5127ed96e84c85c98ba7c7112d849a8a844876b542ed258f013746e7698e28ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            clrjit.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\clrjit.dll
            • Size 1.7MB
            • SHA256 a4fd149cce5d20b8f09532dae07b8df761651088eb414c0dd7683d63184c207a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            coreclr.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\coreclr.dll
            • Size 4.3MB
            • SHA256 f896ff2163768dfb732ba52ebf090393135d236b4f5698f5a054540fda5a6088
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hostfxr.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\hostfxr.dll
            • Size 357KB
            • SHA256 99bdd77e4fe14ab284c4a335ac13affae11c840506b032462d26273143f0b767
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hostpolicy.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\hostpolicy.dll
            • Size 397KB
            • SHA256 a2f6f864b9a41c56ad22490ea882ece574539eb7b23f8913c943613990818e89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mscorlib.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\mscorlib.dll
            • Size 57KB
            • SHA256 8cc7442f997a6e0de9157b55058e5e85011fa240a903806f2c501f069e8a45a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            netstandard.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\netstandard.dll
            • Size 98KB
            • SHA256 b7c85ff82edc3db1424e9b387eed0517cbe2c59691951ed70b41d46f79397696
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu!.deps.json
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.deps.json
            • Size 208KB
            • SHA256 c80ea4618d34571454d141b090da7c4f7e50e43a17875a0388bfdf56991820d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu!.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.dll
            • Size 244KB
            • SHA256 e7707fff8643772606822fe53333e9f9becbab37e52a27fb67344e1f47745de1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu!.exe
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
            • Size 239KB
            • SHA256 8383f49b3dd3483ae429691d4473ac94a0750fe30523ec735ba456113ceaec7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu!.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.runtimeconfig.json
            • Size 412B
            • SHA256 ef068dddd08a346fbad35d1558393bee8f89163722734452d69518b67e5f6a6f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            osu.Framework.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Framework.dll
            • Size 3.8MB
            • SHA256 2d8e9637db98e09025e8f9199a22de7bdbfabdbbdbb9738b8e70dd81ed1861d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu.Game.Auth.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Auth.dll
            • Size 238KB
            • SHA256 9bc7b10823a3d9f1abe86aa104e424199ad5699f4d41db7196057838482e4588
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu.Game.Tournament.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Tournament.dll
            • Size 227KB
            • SHA256 7b1aa56612cc1858135095cba0a8aaca3c389e23700dc3f6456769e807c833e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osu.Game.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.dll
            • Size 6.5MB
            • SHA256 e452f7683c0e63d1900c2441c4e724fdf9b5c02123a4b9096e049a8d0d37b5f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            osuTK.dll
            • Path C:\Users\Admin\AppData\Local\osulazer\current\osuTK.dll
            • Size 6.1MB
            • SHA256 831ddce8dcec165e4212093279e22e047489c29b43e8832faffb3fb09b090371
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sq.version
            • Path C:\Users\Admin\AppData\Local\osulazer\current\sq.version
            • Size 541B
            • SHA256 dba361963b0b1dad7291ca16120033321a069cb5c0a41cfd43f95daac7d7eed1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AuthNative.dll
            • Path C:\Users\Admin\AppData\Roaming\osu\AuthNative.dll
            • Size 10.4MB
            • SHA256 36e033895b8a635151292c19804a112555b78d89cc0df6af1c50d76d4829cdfa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
            • Path C:\Users\Admin\AppData\Roaming\osu\files\a\a1\a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
            • Size 988B
            • SHA256 a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            1784453731.runtime.log
            • Path C:\Users\Admin\AppData\Roaming\osu\logs\1784453731.runtime.log
            • Size 6KB
            • SHA256 803446822bca54e3c66d67d1950c06c294d3165d53546cc7e1f30c0e02a4cf65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            desktop.ini
            • Path C:\Users\Admin\Videos\Captures\desktop.ini
            • Size 190B
            • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/3540-699-0x0000017900000000-0x0000017900100000-memory.dmp
            Download

            memory/3540-711-0x0000017903870000-0x0000017903890000-memory.dmp
            Download

            memory/3540-701-0x0000017900000000-0x0000017900100000-memory.dmp
            Download

            memory/3540-745-0x0000017903FF0000-0x0000017904010000-memory.dmp
            Download

            memory/3540-729-0x0000017903A70000-0x0000017903A90000-memory.dmp
            Download

            memory/3540-713-0x0000017903C50000-0x0000017903D50000-memory.dmp
            Download

            memory/3560-888-0x000001ECBC000000-0x000001ECBC691000-memory.dmp
            Download

            memory/4380-681-0x00007FFEFEB30000-0x00007FFEFF595000-memory.dmp
            Download

            memory/4380-516-0x00007FFEFEB30000-0x00007FFEFF595000-memory.dmp
            Download