Analysis
- max time kernel
603s - max time network
486s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 16:45
General
- Target Video_recorded_iPhone15.mp4 Drive.google.exe
- Size 656.5MB
- Sample260730-t9ll5sdk2x
- SHA256 692a523870704ef4333b1b8a4e5d8339a1143290b8660f1a6bfefcd930028a77
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Video_recorded_iPhone15.mp4 Drive.google.exe"C:\Users\Admin\AppData\Local\Temp\Video_recorded_iPhone15.mp4 Drive.google.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FSMHD.tmp\Video_recorded_iPhone15.mp4 Drive.google.tmp"C:\Users\Admin\AppData\Local\Temp\is-FSMHD.tmp\Video_recorded_iPhone15.mp4 Drive.google.tmp" /SL5="$401B6,687355438,1158656,C:\Users\Admin\AppData\Local\Temp\Video_recorded_iPhone15.mp4 Drive.google.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Video_recorded_iPhone15.mp4 Drive.google.tmp
memory/1968-0-0x0000000000250000-0x0000000000379000-memory.dmp
memory/1968-8-0x0000000000250000-0x0000000000379000-memory.dmp
memory/5104-6-0x0000000002960000-0x0000000002961000-memory.dmp
memory/5104-9-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-10-0x0000000002960000-0x0000000002961000-memory.dmp
memory/5104-12-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-14-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-16-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-18-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-20-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-22-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-28-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-30-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-32-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-34-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-36-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-38-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-40-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-42-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-44-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-46-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-48-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-50-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-52-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-54-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-56-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-58-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-60-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-62-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-64-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-66-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-68-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-70-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-72-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-74-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-76-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-79-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-81-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-83-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-85-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-87-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-89-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-91-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-93-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-95-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-97-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-99-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-101-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-103-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-107-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-109-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-111-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-113-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-115-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-117-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-119-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-121-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-123-0x0000000000FD0000-0x0000000001380000-memory.dmp
memory/5104-125-0x0000000000FD0000-0x0000000001380000-memory.dmp