Overview
overview
8Static
static
3ipscan-3.9...up.exe
windows10-2004-x64
7ipscan-3.9...up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
8$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
899s - max time network
462s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ipscan-3.9.3-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
900 seconds
Behavioral task
behavioral2
Sample
ipscan-3.9.3-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target ipscan-3.9.3-setup.exe
- Size 21.1MB
- Sample260803-3chnnassct
- SHA256 91d77c63169249e8fcdd2d912963d4d5cd143d87b65352fc62ba8113fb49f9f5
- MD5 e204e4d2528ea8b4d4c56da9e8078a61
- SHA1 f5bfce1c7e32387eb7334844335ffd89f802c281
- SHA512 db873c09b1a4b0d10028caa6149d089f52cc1730c5b04416694eb1fd64287e3953aa0f4d10260bb33b35bd3040eea73aabd4901efe51c91dae7739e1d51672f3
- SSDEEP 393216:H8Dsq8vvHIrey6de90pTVxs36Fnzi0P1n+MPTonmIf5qZtVQ7oBr54x/0UZ0nl:H8z8XMItVxOoP1+MCmqqZtC5xm
- TLSH T1152733E8D612C2C5D422B4F0A3BB9C8065390CFF3769579B1B78361AE373532865EE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 5912 ipscan-3.9.3-setup.exe 5912 ipscan-3.9.3-setup.exe 5912 ipscan-3.9.3-setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Angry IP Scanner\jre\bin\client\jvm.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\jvm.lib ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\cacerts ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-console-l1-2-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\unlimited\default_US_export.policy ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-file-l2-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-process-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\java.policy ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\tzdb.dat ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\tzmappings ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-file-l1-2-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-conio-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\msvcp140.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\public_suffix_list.dat ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-handle-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-environment-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-string-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\ucrtbase.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\limited\default_US_export.policy ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-util-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-private-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\blocked.certs ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-datetime-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-timezone-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\jrt-fs.jar ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\ipscan.exe ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\license.txt ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-string-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-synch-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-utility-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\logging.properties ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\jvm.cfg ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-profile-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-math-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\nio.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\vcruntime140_1.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\limited\exempt_local.policy ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\default.policy ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-convert-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\verify.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\java.security ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\javaw.exe ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-debug-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-file-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-synch-l1-2-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-heap-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-locale-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\java.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-fibers-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-crt-time-l1-1-0.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\net.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\vcruntime140.dll ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\jaxp.properties ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\README.txt ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\classlist ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\icon.ico ipscan-3.9.3-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\api-ms-win-core-memory-l1-1-0.dll ipscan-3.9.3-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipscan-3.9.3-setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ipscan-3.9.3-setup.exe"C:\Users\Admin\AppData\Local\Temp\ipscan-3.9.3-setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5880
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\UserInfo.dll
- Size 4KB
- SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
- MD5 2f69afa9d17a5245ec9b5bb03d56f63c
- SHA1 e0a133222136b3d4783e965513a690c23826aec9
- SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
- TLSH T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 8416e0209e7c1497ef84173f52b623eb38d86bab59886fe99317d8f557bf66f8
- MD5 571986bb6e3eed28c772e9dfa1b2d87e
- SHA1 c2e7574f8713def6d8647a780d4b5d6fb54843a4
- SHA512 2d2d5ec9e9627a0f7e3e3741bdfab4429cabffc0ab71c5968b87595d41be28ad29ae0dc5142710ad5718c6ef04cf76dee7a9b158d8b34c7a7d59eeaa7f66cf2a
- SSDEEP 3072:yBbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxrxxxxxxxxxxxxxxxxxxy:Yxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4
- TLSH T1A7E38A9DA179CED2F22B1DBE18B95050743B2ECE2040EDE7C251AD5DA3BC8041F65B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH