d6f6fd3fe8eba8ccee31a270ba3fc6b6a7a1de58f4c9b45f40a9f322a84f8b1f

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DE_ProPlus2024_x64Bit/setup.exe
Size 7.2MB
Sample260722-apdk9agg89
SHA256 d6f6fd3fe8eba8ccee31a270ba3fc6b6a7a1de58f4c9b45f40a9f322a84f8b1f
MD5 13199a06f646dd1e82d9a6e2dfde62e3
SHA1 3847f7be74be45066c493b7b71c52d50649f8fa0
SHA512 93f3da9560bdfc21256741c06974dff81b34cafda0d33a7b13c82f6339c6307a37583f7cfaeb00a592546afdcd7f021cfcb4baa9433081dfbe99c822ee0be50f
SSDEEP 196608:AtuzFd2Lo2ux/CwQtfSkSW1QG6pXyXC4tUzQB+/D2tzaI6HMaJTtGbw:XRL2uEwefhoyZtE
TLSH
T157767B2267E78736F5F20230AE7DFB15D6BABE710931813F7388264D1B719829925723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 3308	6044	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\DE_ProPlus2024_x64Bit\setup.exe
"C:\Users\Admin\AppData\Local\Temp\DE_ProPlus2024_x64Bit\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\Temp\DE_ProPlus2024_x64Bit\setup.exe
  setup.exe RELAUNCHED
  2⤵
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads