Analysis
- user interaction
yes - max time kernel
899s - max time network
581s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 14:58
General
- Target Macro Recorder Enterprise 4.0.51 FileCR/MacroRecorderSetup.exe
- Size 46.3MB
- Sample260727-scm82abf39
- SHA256 89d9a6a8a00bdebae267f65339a5015c3d84273f8be91e37acde1f9cf02788fa
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Macro Recorder Enterprise 4.0.51 FileCR\MacroRecorderSetup.exe"C:\Users\Admin\AppData\Local\Temp\Macro Recorder Enterprise 4.0.51 FileCR\MacroRecorderSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PH30D.tmp\MacroRecorderSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-PH30D.tmp\MacroRecorderSetup.tmp" /SL5="$901EA,47430593,881664,C:\Users\Admin\AppData\Local\Temp\Macro Recorder Enterprise 4.0.51 FileCR\MacroRecorderSetup.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh" advfirewall firewall add rule name="MacroRecorder" dir=in action=allow program="C:\Users\Admin\AppData\Local\Programs\MacroRecorder\MacroRecorder.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\MacroRecorder\MacroRecorder.exe"C:\Users\Admin\AppData\Local\Programs\MacroRecorder\MacroRecorder.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
MacroRecorder.exe
mrkey.dll
mrocr.dll
mrzbar.dll
_isdecmp.dll
MacroRecorderSetup.tmp
memory/700-12-0x0000000000390000-0x0000000000477000-memory.dmp
memory/700-66-0x0000000000390000-0x0000000000477000-memory.dmp
memory/700-0-0x0000000000390000-0x0000000000477000-memory.dmp
memory/1556-70-0x0000000000400000-0x0000000000431000-memory.dmp
memory/1556-69-0x00000000007C0000-0x0000000002383000-memory.dmp
memory/1556-71-0x00000000007C0000-0x0000000002383000-memory.dmp
memory/1556-83-0x0000000000400000-0x0000000000431000-memory.dmp
memory/1556-82-0x00000000007C0000-0x0000000002383000-memory.dmp
memory/5092-13-0x0000000000F60000-0x00000000012D3000-memory.dmp
memory/5092-59-0x0000000000F60000-0x00000000012D3000-memory.dmp
memory/5092-14-0x0000000000F50000-0x0000000000F51000-memory.dmp
memory/5092-65-0x0000000000F60000-0x00000000012D3000-memory.dmp
memory/5092-5-0x0000000000F50000-0x0000000000F51000-memory.dmp