Resubmissions
27/07/2026, 23:34
260727-3kvyysfq6y27/07/2026, 23:26
260727-3e33dafq21727/07/2026, 23:12
260727-2624qatyg17Analysis
- geolocation tags
- max time kernel
120s - max time network
68s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-uk - resource tags
- submitted
27/07/2026, 23:26
General
- Target incy-windows-setup.exe
- Size 121.9MB
- Sample260727-3e33dafq21
- SHA256 69524a0dfbfee03c5b533f694ad3ebdc18ad159089866b08831e2e22c6249b78
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 18 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Program Files directory 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 3 IoCs
- Modifies registry class 13 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-XBMWR5R2OQ.tmp\incy-windows-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-XBMWR5R2OQ.tmp\incy-windows-setup.tmp" /SL5="$401E0,126533890,893440,C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM incy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM hev-socks5-tunnel.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM xray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\INCY\incy.exe"C:\Program Files\INCY\incy.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\INCY\incy.exe"C:\Program Files\INCY\incy.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Classes\incy /ve /d "URL:incy Protocol" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Classes\incy /v "URL Protocol" /d "" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Classes\incy\shell\open\command /ve /d "C:\Program Files\INCY\incy.exe" "%1" /f5⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "for %I in ("C:\Users\Admin\AppData\Local\incy\incy.db") do @echo %~sI"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Users\Admin\AppData\Local\incy\incy.db /inheritance:r /grant:r *S-1-5-21-3611646547-550105268-947503007-1000:F5⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\incy\.secrets /inheritance:r /grant:r *S-1-5-21-3611646547-550105268-947503007-1000:(OI)(CI)F5⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\reg.exereg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid5⤵
- Modifies registry key
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\incy\.secrets /inheritance:r /grant:r *S-1-5-21-3611646547-550105268-947503007-1000:(OI)(CI)F5⤵
- Modifies file permissions
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
animation-core-desktop-1.10.3-a94bab3d67a320ccdc2cc2c2c973bc4.jar
animation-desktop-1.10.3-d75724d6eb8bef26a6affbebcbada5.jar
annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
atomicfu-jvm-0.23.2-5e4f88ed1c37222d791f5dcadf481498.jar
collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar
core-3.5.4-23cc13611f7f222b9988220fa28a115.jar
core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar
desktop-jvm-1.10.3-98023295d6f48188e5b98b192b9a30.jar
foundation-desktop-1.10.3-70d7b34e8681a374ed1ed640c3ba8c11.jar
foundation-layout-desktop-1.10.3-8510263615bf71e2ede4f9451f89f7dd.jar
incy-desktop-3.3.7.jar
incy.cfg
jai-imageio-core-1.4.0-6978d733bfb55ca82639f724fe5f3bb.jar
javase-3.5.4-55e7296ac9a75d4e974e536e1d2e65f.jar
jbr-api-1.5.0-377e771977886f74954db4278394c51.jar
jcommander-1.85-8e65d693e8a8bfbf6488898a4b6473d.jar
jdbc-driver-2.0.2-1410add33fb6f6a4946f9a8f4f69fa8.jar
jna-5.17.0-8fc1e1f239ec4511e8d9e5a433f6244.jar
json-20251224-fec4b08b6ae3b07aa34ff719ee7a5cc3.jar
jspecify-1.0.0-9133aba420d0ca3b01dbb6ae9992cf6.jar
koin-core-jvm-4.2.0-d16eea42d1f7fc3357be624550f3d51e.jar
kotlin-stdlib-2.3.20-17212d4ae1611e51ce4c3c4ba28717fa.jar
kotlin-stdlib-jdk7-2.2.20-b62df9d3ec629ebc7658228fe49529.jar
kotlin-stdlib-jdk8-2.2.20-c2573686563f7aaca6f7ce98ec9a8b6.jar
kotlinx-coroutines-core-jvm-1.10.2-16bb58d0777fca3b2efde66862478c.jar
kotlinx-coroutines-swing-1.10.2-b9cd9ab0c3f429acd698981c43dd6a2f.jar
kotlinx-datetime-jvm-0.7.1-70b44e22ebc7eebfa53f7d1941af072.jar
kotlinx-serialization-core-jvm-1.9.0-b84dd8f79d9415c243324bd22d7c3cc5.jar
kotlinx-serialization-json-jvm-1.9.0-1e81a9f08daa85e116eb8551d2f3bc0.jar
lifecycle-common-jvm-2.9.4-6430746dbcfa6c26a0d997b9c76f84c.jar
lifecycle-runtime-compose-desktop-2.9.4-8f8fe81afd5ce7cf3e8a38142f8aa2.jar
lifecycle-runtime-compose-desktop-2.9.6-497e8fcabac8a5f5ee68cb2a1c8e70a4.jar
lifecycle-runtime-desktop-2.9.4-c2c1ed6e1ecd2d037e07bfe64884c5.jar
lifecycle-viewmodel-desktop-2.9.4-df36d8fe3a9c84b3bd8529b166e73d0.jar
lifecycle-viewmodel-savedstate-desktop-2.9.4-cf8139ef2d41e155eece234f1b2a358.jar
incy.exe
VCRUNTIME140.dll
java.dll
jimage.dll
jli.dll
msvcp140.dll
net.dll
nio.dll
jvm.dll
vcruntime140_1.dll
zip.dll
is-IQ9WEUQB9U.tmp
is-RKQ24NJHCQ.tmp
is-XBBSLSDAXX.tmp
jvm.cfg
tzdb.dat
tzmappings
incy-windows-setup.tmp
incy.db
memory/2592-661-0x000001DC9E940000-0x000001DC9E962000-memory.dmp
memory/3480-801-0x00007FFCE6340000-0x00007FFCEA2F2000-memory.dmp
memory/3480-710-0x00007FFCE6340000-0x00007FFCEA2F2000-memory.dmp
memory/3480-711-0x00007FFCF7A30000-0x00007FFCF7B25000-memory.dmp
memory/3480-701-0x000001AF6A4C0000-0x000001AF6A4C1000-memory.dmp
memory/3480-699-0x000001AF6A4C0000-0x000001AF6A4C1000-memory.dmp
memory/4168-550-0x0000000000FF0000-0x0000000001433000-memory.dmp
memory/4168-6-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/4168-10-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/4168-9-0x0000000000FF0000-0x0000000001433000-memory.dmp
memory/4168-12-0x0000000000FF0000-0x0000000001433000-memory.dmp
memory/4168-99-0x0000000000FF0000-0x0000000001433000-memory.dmp
memory/4168-545-0x0000000000FF0000-0x0000000001433000-memory.dmp
memory/5184-8-0x0000000000490000-0x0000000000579000-memory.dmp
memory/5184-0-0x0000000000490000-0x0000000000579000-memory.dmp
memory/5184-551-0x0000000000490000-0x0000000000579000-memory.dmp