Resubmissions
27/07/2026, 23:34
260727-3kvyysfq6y27/07/2026, 23:26
260727-3e33dafq21727/07/2026, 23:12
260727-2624qatyg17Analysis
- geolocation tags
- user interaction
yes - max time kernel
119s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20260513-uk - resource tags
- submitted
27/07/2026, 23:26
General
- Target incy-windows-setup.exe
- Size 121.9MB
- Sample260727-3e33dafq21
- SHA256 69524a0dfbfee03c5b533f694ad3ebdc18ad159089866b08831e2e22c6249b78
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 19 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Program Files directory 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 3 IoCs
- Modifies registry class 13 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AAPEAZ7NQ6.tmp\incy-windows-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-AAPEAZ7NQ6.tmp\incy-windows-setup.tmp" /SL5="$6025A,126533890,893440,C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM incy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM hev-socks5-tunnel.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM xray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\INCY\incy.exe"C:\Program Files\INCY\incy.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\INCY\incy.exe"C:\Program Files\INCY\incy.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Classes\incy /ve /d "URL:incy Protocol" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Classes\incy /v "URL Protocol" /d "" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Classes\incy\shell\open\command /ve /d "C:\Program Files\INCY\incy.exe" "%1" /f5⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "for %I in ("C:\Users\Admin\AppData\Local\incy\incy.db") do @echo %~sI"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Users\Admin\AppData\Local\incy\incy.db /inheritance:r /grant:r *S-1-5-21-3053180483-1881419501-3594244048-1000:F5⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\incy\.secrets /inheritance:r /grant:r *S-1-5-21-3053180483-1881419501-3594244048-1000:(OI)(CI)F5⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\reg.exereg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid5⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\incy\.secrets /inheritance:r /grant:r *S-1-5-21-3053180483-1881419501-3594244048-1000:(OI)(CI)F5⤵
- Modifies file permissions
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
animation-core-desktop-1.10.3-a94bab3d67a320ccdc2cc2c2c973bc4.jar
animation-desktop-1.10.3-d75724d6eb8bef26a6affbebcbada5.jar
annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
atomicfu-jvm-0.23.2-5e4f88ed1c37222d791f5dcadf481498.jar
collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar
core-3.5.4-23cc13611f7f222b9988220fa28a115.jar
core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar
desktop-jvm-1.10.3-98023295d6f48188e5b98b192b9a30.jar
foundation-desktop-1.10.3-70d7b34e8681a374ed1ed640c3ba8c11.jar
foundation-layout-desktop-1.10.3-8510263615bf71e2ede4f9451f89f7dd.jar
incy-desktop-3.3.7.jar
incy.cfg
jai-imageio-core-1.4.0-6978d733bfb55ca82639f724fe5f3bb.jar
javase-3.5.4-55e7296ac9a75d4e974e536e1d2e65f.jar
jbr-api-1.5.0-377e771977886f74954db4278394c51.jar
jcommander-1.85-8e65d693e8a8bfbf6488898a4b6473d.jar
jdbc-driver-2.0.2-1410add33fb6f6a4946f9a8f4f69fa8.jar
jna-5.17.0-8fc1e1f239ec4511e8d9e5a433f6244.jar
json-20251224-fec4b08b6ae3b07aa34ff719ee7a5cc3.jar
jspecify-1.0.0-9133aba420d0ca3b01dbb6ae9992cf6.jar
koin-core-jvm-4.2.0-d16eea42d1f7fc3357be624550f3d51e.jar
kotlin-stdlib-2.3.20-17212d4ae1611e51ce4c3c4ba28717fa.jar
kotlin-stdlib-jdk7-2.2.20-b62df9d3ec629ebc7658228fe49529.jar
kotlin-stdlib-jdk8-2.2.20-c2573686563f7aaca6f7ce98ec9a8b6.jar
kotlinx-coroutines-core-jvm-1.10.2-16bb58d0777fca3b2efde66862478c.jar
kotlinx-coroutines-swing-1.10.2-b9cd9ab0c3f429acd698981c43dd6a2f.jar
kotlinx-datetime-jvm-0.7.1-70b44e22ebc7eebfa53f7d1941af072.jar
kotlinx-serialization-core-jvm-1.9.0-b84dd8f79d9415c243324bd22d7c3cc5.jar
kotlinx-serialization-json-jvm-1.9.0-1e81a9f08daa85e116eb8551d2f3bc0.jar
lifecycle-common-jvm-2.9.4-6430746dbcfa6c26a0d997b9c76f84c.jar
lifecycle-runtime-compose-desktop-2.9.4-8f8fe81afd5ce7cf3e8a38142f8aa2.jar
lifecycle-runtime-compose-desktop-2.9.6-497e8fcabac8a5f5ee68cb2a1c8e70a4.jar
lifecycle-runtime-desktop-2.9.4-c2c1ed6e1ecd2d037e07bfe64884c5.jar
lifecycle-viewmodel-desktop-2.9.4-df36d8fe3a9c84b3bd8529b166e73d0.jar
lifecycle-viewmodel-savedstate-desktop-2.9.4-cf8139ef2d41e155eece234f1b2a358.jar
incy.exe
java.dll
jimage.dll
jli.dll
msvcp140.dll
net.dll
nio.dll
jvm.dll
vcruntime140.dll
vcruntime140_1.dll
zip.dll
is-3RYNOKNM89.tmp
is-BMCIOZHF7O.tmp
is-OJOTAU7HVI.tmp
jvm.cfg
tzdb.dat
tzmappings
__PSScriptPolicyTest_qlaj4s43.ii0.ps1
incy-windows-setup.tmp
incy.db
memory/5036-551-0x0000000000890000-0x0000000000CD3000-memory.dmp
memory/5036-517-0x0000000000890000-0x0000000000CD3000-memory.dmp
memory/5036-11-0x0000000000890000-0x0000000000CD3000-memory.dmp
memory/5036-8-0x0000000000890000-0x0000000000CD3000-memory.dmp
memory/5036-9-0x0000000001460000-0x0000000001461000-memory.dmp
memory/5036-5-0x0000000001460000-0x0000000001461000-memory.dmp
memory/5036-44-0x0000000000890000-0x0000000000CD3000-memory.dmp
memory/5748-7-0x0000000000DB0000-0x0000000000E99000-memory.dmp
memory/5748-0-0x0000000000DB0000-0x0000000000E99000-memory.dmp
memory/5748-562-0x0000000000DB0000-0x0000000000E99000-memory.dmp
memory/5936-662-0x000001F2FF9F0000-0x000001F2FFA12000-memory.dmp
memory/5960-714-0x0000019C77E70000-0x0000019C77E71000-memory.dmp
memory/5960-713-0x0000019C77E70000-0x0000019C77E71000-memory.dmp
memory/5960-712-0x0000019C77E70000-0x0000019C77E71000-memory.dmp
memory/5960-748-0x00007FFBD2130000-0x00007FFBD2225000-memory.dmp
memory/5960-747-0x0000019C48910000-0x0000019C4C8C2000-memory.dmp
memory/5960-815-0x0000019C48910000-0x0000019C4C8C2000-memory.dmp