Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 01:04
General
- Target 男子捡尸成瘾，7月性侵4人全程偷拍！.exe
- Size 5.1MB
- Sample260805-bfebvsvfjd
- SHA256 0dd4471c677f9c7f7097d1ecc5588285d3f2dc547a870b2eaa1dcf9417547f99
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\男子捡尸成瘾，7月性侵4人全程偷拍！.exe"C:\Users\Admin\AppData\Local\Temp\男子捡尸成瘾，7月性侵4人全程偷拍！.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6IEHNQUV86.tmp\男子捡尸成瘾，7月性侵4人全程偷拍！.tmp"C:\Users\Admin\AppData\Local\Temp\is-6IEHNQUV86.tmp\男子捡尸成瘾，7月性侵4人全程偷拍！.tmp" /SL5="$400A8,4164524,893952,C:\Users\Admin\AppData\Local\Temp\男子捡尸成瘾，7月性侵4人全程偷拍！.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\run.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\gameoverlayui.exe"C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\gameoverlayui.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\ksolaunch.exe"C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\ksolaunch.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2.zip
auto_update.exe
gameoverlayui.exe
ksolaunch.exe
run.vbs
男子捡尸成瘾，7月性侵4人全程偷拍！.tmp
memory/1728-6-0x0000000001310000-0x0000000001311000-memory.dmp
memory/1728-48-0x0000000001310000-0x0000000001311000-memory.dmp
memory/1728-47-0x0000000000360000-0x00000000007AB000-memory.dmp
memory/1728-64-0x0000000000360000-0x00000000007AB000-memory.dmp
memory/2872-0-0x0000000000C80000-0x0000000000D69000-memory.dmp
memory/2872-46-0x0000000000C80000-0x0000000000D69000-memory.dmp
memory/2872-65-0x0000000000C80000-0x0000000000D69000-memory.dmp