Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 16:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
anyburn_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
anyburn_setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target anyburn_setup.exe
- Size 5.5MB
- Sample260804-t8cb3svfna
- SHA256 3b261e1bf56be6b18ca0d877859f1b931bf1f40f040a8d9c107244b0b9661a22
- MD5 c68f35c2f067c16deb69a8226e92acb4
- SHA1 f415f24cdf93167415245eac0afbe982fbb9acc7
- SHA512 4bb1261b2a594a5624a2fad208223ba6c759a814d9803d35a26d6c801ba1aa99c0dd4339ad5122540f5ea6f374892bb5b39ccecf5cb4a2c1bce990da6886f087
- SSDEEP 98304:H4TqrJZqAA3sZWLvlsL0uPUbDK8qU8EHLmwpBVzF/RBLLcfhtLW5Sr6gc:VZjO7s0usbDKXpEawpBNFZBLQfhtLVm7
- TLSH T13B46332048B55256F54B8A709BF7AE73A8B5AE2FD3BF51BB3FDA3602E0602411C0551F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2444 anyburn_setup.exe 2444 anyburn_setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 39 IoCs
description ioc Process File created C:\Program Files\AnyBurn\Lang\Italian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Swedish.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\PortugueseBrazil.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Finnish.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Romanian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Slovenian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Russian.ini anyburn_setup.exe File opened for modification C:\Program Files\AnyBurn\AnyBurn.exe anyburn_setup.exe File created C:\Program Files\AnyBurn\libFLAC.dll anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\SimpChinese.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Dutch.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Hungarian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Croatian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Japanese.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\lame_enc.dll anyburn_setup.exe File created C:\Program Files\AnyBurn\abcmd.exe anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\TradChinese.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Arabic.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\EnglishUK.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Danish.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Czech.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\uninstall.exe anyburn_setup.exe File created C:\Program Files\AnyBurn\MACDll.dll anyburn_setup.exe File created C:\Program Files\AnyBurn\Readme.txt anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\French.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Greek.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\libvorbis.dll anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Polish.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Turkish.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Bulgarian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\7z-x64.dll anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\German.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Spanish.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Korean.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\PortuguesePortugal.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\License.txt anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\English.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Ukrainian.ini anyburn_setup.exe File created C:\Program Files\AnyBurn\Lang\Indonesian.ini anyburn_setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language anyburn_setup.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsl3745.tmp\InstOpt.dll
- Size 8KB
- SHA256 313648b948243e992f08eec6e567aca26c2131ca6b9d307dd11071470521baf7
- MD5 a9b4e84b5c71be9aad7cbe44506a6b4e
- SHA1 d3a7b3bed2f4f3cc3edc85e202d202a1a535d62f
- SHA512 0c78a4d8c0c129c26fd3d99e8b04e4598e5d844d0d9f213dd318ae873ffd23db1cb06c0fec636ad7ac8a6f9306dbcae58cf4d8e7d33dca2b7a3a31e6ad36bab8
- SSDEEP 96:S1+HVx8GJYcudkED74Kx2otnc12lDIvyYUJjlMYXJIuT+f9yFGTp:SsPulD74uh2XUtlMwIuqEFGT
- TLSH T16FF155E4A3D17DB7F7BB0B323AE2A3F5DB19BD055E1040446F73025D6435591CA68362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl3745.tmp\System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH