17774de56e1a797c8bc65ce34df447ca5672667593cb4949ca4fcba60286dc39

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MBSetup-1.1.exe
Size 2.8MB
Sample260806-ms7pqattcs
SHA256 17774de56e1a797c8bc65ce34df447ca5672667593cb4949ca4fcba60286dc39
MD5 3d088b6f584c14f22b8418c7781cb397
SHA1 50514bbc6dd253d3a622a2bd22c8e37330ced2f2
SHA512 81047da42f8b9a6120e55b65ad7a71e34558bd36abef255626f329e38d58810990766c8deb72bb13d12c8fedb7816dfb29a3e87cb320da1a0011fe08720733c0
SSDEEP 49152:RZbqCBYy8XtNnM2wAeyfvE0Z3R0vnxn1o2d5XQ5:rOCBYy8XtUAeKtEnW2fk
TLSH
T1ABD59E31B2D18120D1B3D270297EB7EA5B75BC256F76408F32D8BA390B725C09D75B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-1.1.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-1.1.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MBSetup-1.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MBSetup-1.1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Malwarebytes\Anti-Malware\eb8c6ce1-7364-4f73-950f-a914753a0e48	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\d2a7734c-d7a2-4c1a-ac0f-489d71f6c2e8	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\5305c7da-fc0b-4a25-977a-d1ed4aa45896	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\f8ef93d2-0559-4a12-959a-93152d74de59	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\cd373281-1cd7-4725-af03-67c26267be58	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\6a42f789-9d58-41cd-b5ed-a91807cf0324	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\389d5e4a-d095-4fea-b437-2b0fd1f00138	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\5f60ea75-c9ff-461e-b7ec-23a82402f34c	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\89fec4f6-29c2-46b3-a556-0b097bae5522	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\4c0835c0-dcc0-40a4-8bef-a16dd17cb632	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\bdce1fba-d4d6-4f94-87e9-93e11f56c16e	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\a35e7804-1bf8-498e-9ec5-e502465b053b	MBSetup-1.1.exe
File opened for modification	C:\Program Files (x86)\mbamtestfile.dat	MBSetup-1.1.exe
File created	C:\Program Files (x86)\mbamtestfile.dat	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\533e6d9e-1669-49b8-ac1d-3515c0ed874d	MBSetup-1.1.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\d7d50aad-4c16-45b4-baa0-60793f8a53e1	MBSetup-1.1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBSetup-1.1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5204	MBSetup-1.1.exe
5204	MBSetup-1.1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5204	MBSetup-1.1.exe

C:\Users\Admin\AppData\Local\Temp\MBSetup-1.1.exe
"C:\Users\Admin\AppData\Local\Temp\MBSetup-1.1.exe"
1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads