Analysis
- max time kernel
63s - max time network
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 23:39
General
- Target NVCleanstall_1.19.0.exe
- Size 3.8MB
- Sample260802-3m96nahd83
- SHA256 9dd36ef956af927cf41fa441f91b329a7973e13965e4e7d70e6fa9c1df1cade6
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NVCleanstall_1.19.0.exe"C:\Users\Admin\AppData\Local\Temp\NVCleanstall_1.19.0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2808-0-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp
memory/2808-1-0x000001FABD440000-0x000001FABD812000-memory.dmp
memory/2808-2-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-3-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-4-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-6-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-5-0x000001FAD7EB0000-0x000001FAD8486000-memory.dmp
memory/2808-7-0x000001FABF480000-0x000001FABF4A2000-memory.dmp
memory/2808-8-0x000001FAD8950000-0x000001FAD8E1C000-memory.dmp
memory/2808-9-0x000001FABDC70000-0x000001FABDC76000-memory.dmp
memory/2808-10-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-11-0x000001FAD7E90000-0x000001FAD7E98000-memory.dmp
memory/2808-12-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-14-0x000001FAD8800000-0x000001FAD880E000-memory.dmp
memory/2808-13-0x000001FAD8840000-0x000001FAD887E000-memory.dmp
memory/2808-15-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-16-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-17-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-18-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-19-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-20-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-21-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/2808-22-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp