Analysis
- user interaction
yes - max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 02:23
General
- Target setup.exe
- Size 3.5MB
- Sample260804-cvkmvsen8v
- SHA256 aa56fc65f7a38300c0e0a935491ff05fef3b43949336857d87ac2a7b77b0de1a
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KBASL.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KBASL.tmp\setup.tmp" /SL5="$501AC,2886685,411136,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Games\Marvel Cosmic Invasion\unins000.exe"C:\Games\Marvel Cosmic Invasion\unins000.exe" /VERYSILENT /NODELSAVE3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Marvel Cosmic Invasion\unins000.exe" /FIRSTPHASEWND=$60214 /VERYSILENT /NODELSAVE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
unins000.dat
unins000.exe
_shfoldr.dll
ISDone.dll
_iscrypt.dll
callbackctrl.dll
wintb.dll
setup.tmp
memory/1756-0-0x0000000000400000-0x000000000046F000-memory.dmp
memory/1756-41-0x0000000000400000-0x000000000046F000-memory.dmp
memory/1756-99-0x0000000000400000-0x000000000046F000-memory.dmp
memory/2496-75-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-20-0x0000000003CC0000-0x0000000003D37000-memory.dmp
memory/2496-47-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-49-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/2496-51-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-55-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-77-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/2496-43-0x0000000003CC0000-0x0000000003D37000-memory.dmp
memory/2496-76-0x0000000003CC0000-0x0000000003D37000-memory.dmp
memory/2496-42-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-7-0x0000000002260000-0x0000000002261000-memory.dmp
memory/2496-45-0x0000000002260000-0x0000000002261000-memory.dmp
memory/2496-44-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/2496-98-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-96-0x0000000003CC0000-0x0000000003D37000-memory.dmp
memory/2496-95-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2496-97-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/2528-92-0x0000000000400000-0x0000000000572000-memory.dmp
memory/2528-85-0x0000000002260000-0x0000000002261000-memory.dmp
memory/3368-93-0x0000000000400000-0x0000000000572000-memory.dmp