Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 08:39
General
- Target setup_magicdisc106.exe
- Size 1.3MB
- Sample260807-kkktwa1bmd
- SHA256 8c6616461292d2a426a775a6356b8d71312be22a7b11fa1ec7e93f987147af41
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_magicdisc106.exe"C:\Users\Admin\AppData\Local\Temp\setup_magicdisc106.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\pcaui.exe"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {db66356f-53c5-4b13-a9de-77616c859e02} -a "Magic ISO Maker/MagicDisc" -v "MagicISO, Inc." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 0 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\setup_magicdisc106.exe"2⤵
-