Analysis
- user interaction
yes - max time kernel
13s - max time network
12s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 08:16
Behavioral task
behavioral1
Sample
SetupExitLag_v4286 [PeskTop.com].exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target SetupExitLag_v4286 [PeskTop.com].exe
- Size 20.1MB
- Sample260808-j6bbwsce33
- SHA256 77fc1102262f289fa67f215ae0958c3743bc12e4b584aa6ecb3c4709a22aad3b
- MD5 9f9b861c55ed61b91c3f4e4c327e0728
- SHA1 5ff07b4227f22b439973fe68020934c4568769f9
- SHA512 eab42fd76b64847871a2c59e7c9d60cad101684b6b1fa296dc65b98461d7189870c067a648dcb2466bbf1d73a16352ebc0853306e4c79ba8cdbcdb2606a6c3f8
- SSDEEP 393216:ZOKwdj3OwcloOVb5D8HrjzfOxNNVQAAASMjPoYgLO:Z5wdbOwcloub5mPfOxNNsAS6n7
- TLSH T1FE27333BB258653EC45E0A3E45FF92109A7B7A62B416CC1E17F0384FCF620611E7A65B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4356 SetupExitLag_v4286 [PeskTop.com].tmp 1272 DriverCacheCleaner.exe 3464 snetcfg.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag_lwf.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\SET4780.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\SET4781.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\SET477F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\ndextlag_lwf.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\ndextlag.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\SET477F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\SET4780.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\SET4781.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6159877-3bec-f14b-a982-fe99d3ff7790}\ndextlag.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2.ini DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log snetcfg.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupExitLag_v4286 [PeskTop.com].exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupExitLag_v4286 [PeskTop.com].tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DriverCacheCleaner.exe - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/3848-0-0x0000000000400000-0x00000000004E6000-memory.dmp innosetup behavioral2/memory/3848-38-0x0000000000400000-0x00000000004E6000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3848 wrote to memory of 4356 3848 SetupExitLag_v4286 [PeskTop.com].exe 89 PID 4356 wrote to memory of 1272 4356 SetupExitLag_v4286 [PeskTop.com].tmp 90 PID 4356 wrote to memory of 3464 4356 SetupExitLag_v4286 [PeskTop.com].tmp 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupExitLag_v4286 [PeskTop.com].exe"C:\Users\Admin\AppData\Local\Temp\SetupExitLag_v4286 [PeskTop.com].exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\is-EUULE.tmp\SetupExitLag_v4286 [PeskTop.com].tmp"C:\Users\Admin\AppData\Local\Temp\is-EUULE.tmp\SetupExitLag_v4286 [PeskTop.com].tmp" /SL5="$4010E,20195266,887296,C:\Users\Admin\AppData\Local\Temp\SetupExitLag_v4286 [PeskTop.com].exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\DriverCacheCleaner.exe"C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\DriverCacheCleaner.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WinpkFilter\lwf\win10\amd64\snetcfg.exe"C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WinpkFilter\lwf\win10\amd64\snetcfg.exe" -v -l ndextlag_lwf.inf -c s -i nt_ndextlag3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3464
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{080f5f95-ca19-3f4f-b4f1-acd2c8532185}\ndextlag_lwf.inf" "9" "4894f4bbf" "0000000000000138" "WinSta0\Default" "00000000000000DC" "208" "C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WinpkFilter\lwf\win10\amd64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-EUULE.tmp\SetupExitLag_v4286 [PeskTop.com].tmp
- Size 3.1MB
- SHA256 cb54f93756504ef792e534b77689d62c0a3722fee283d3c43da6518d8596d53a
- MD5 96f6c91e0ae4d5a3c5a0db76771d0eca
- SHA1 ed65ecce25973e4f471312d9e8093e438247e8cf
- SHA512 97d144f87ea259480a4ac193b6436a6b58fa7c639bbb5f05ea9de2cdd6db28d394f00d5ba0f09f4e0049cceffdc2e2ddd50e0299037108a69fe5847030c2ed43
- SSDEEP 49152:hWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTb0333TV:jtLutqgwh4NYxtJpkxhGr333R
- TLSH T10FE55B17F28C713ED06B3A3A4AB781909837F6616912CC2797FC794C8F365942A3E647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\DriverCacheCleaner.exe
- Size 200KB
- SHA256 0bf38436e43ab87ae7a0317ff164b42623296321d07f7b6141277ebbcccfe05b
- MD5 25cc15669ea9e8587ca89d011d77d435
- SHA1 ea1a32dfc61412accdefaf2a03faf3666cb4f7f8
- SHA512 247465a3b0ac4e1deaec7060e18e8d3e520fb987183f678291b12fc9434406df74c3a828e3b7080cd73827b789d78962e0368040ec50101cacc9b72e4dde9fb1
- SSDEEP 3072:jBzhgug0mncSYsdVKu9HzNJfhvuCxlt4KWempGeqkECUk38OAg0Fuj0sXrNalzCc:1zh6HVP9/fkCtFWZpfqkFAOZRaI83
- TLSH T111147D50B4D1C473D533053108F8E6B85A7EFD614A619ABB67D84B7E0F34381EA31AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WINPKF~1\lwf\win10\amd64\ndextlag.cat
- Size 11KB
- SHA256 476005d1e2be816c06cf62fa18715dd50d9a09bc7984d0ae33cf917288174917
- MD5 41ce1b9d8fb8432898d8b086753139a9
- SHA1 88fa6a06942242d3f05ff316e444efa4734bcb47
- SHA512 73bb5d2893cea2f421cf32245a822728f7bd42924bb0f78099c0893fd67d6be868932848d77c1edb0e1f9992a6ea3703788e9ceeccbbe9152b6137d7d3e1ffc6
- SSDEEP 192:uoT9HAJCL2XJEwiSpJhI1hYCTQxey60ODX01k9z3Ar3bh8O:9AZxXhI1h3036zR9zq3dh
- TLSH T12D3229A29A6D4182FCB7BCA053F8ED473C3977CB680056AA629EF6240C573C4E72417D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WINPKF~1\lwf\win10\amd64\ndextlag.sys
- Size 58KB
- SHA256 70013fcd32f4745347cbd45c1cc911c0d6939048727f1c8dbcc1da36edf20fa9
- MD5 4bbbac5d7cb5e2e65ac400f01bf267fd
- SHA1 318a2b1dfb4871c72ec27fffafe8488b7f0453a5
- SHA512 86aa1a9ff8f0df4feec57f4d2d1572a4e0fbea0de5cafc88c728a5737c77d80ad98926ab9d3c5cd5817dbf9f49e63179895fd1d6199a72996783b65505f1b6b0
- SSDEEP 1536:3tEjCJyzRVEOAARIUfFWFRZ8rfvbKtKXRM2z4q:3tEjCSmOfK2FWOfvbVXH
- TLSH T11B439E925AB404C3FA56CC74C2F2E647FEB1B986171856DF6320D1261F6B7D06A3A32C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WinpkFilter\lwf\win10\amd64\snetcfg.exe
- Size 15KB
- SHA256 516c5643cf378bdbc28191db75f85aed6988f21fe176c6d198ec21e76540c944
- MD5 58266a610bbc7c7eb924c6918edea151
- SHA1 d247099c5f3c9ad0b16f6ecbebcd8b1e54bcdd5f
- SHA512 99bfe3856e27afe1c966342ec05fb4f59941207fb6c3235d95095cf340fd31f9fc8f9999585c512f2afa1c6cf57a9416d2b835dc121b5dd44001d465a26a216c
- SSDEEP 192:EzcBX7QcEks4EvZHLTCcmelUzAuQ7tdx4HlwBzxVR8fG2:wcx7QcEksHBHLTCxzYtdx4HKxVRqG2
- TLSH T1A0627151E3F90228F1F2AE7459F21121CA7B3C50EA70DBCF019554092EF6A90DEB9F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-U65FS.tmp\WinpkFilter\lwf\win7\i386\ndextlag_lwf.inf
- Size 2KB
- SHA256 b75793dc1c6665778a2371e2c5ee57052d61a94ce6163103fb3867b710f9b12a
- MD5 f37e8cc0eabac5e065277ba82818bd44
- SHA1 4b0d23da6f357406ed21187a99462fde36e36b40
- SHA512 c31a5c2c4bae9e07fbf4de18c94196c1f81969d4e46dd03a35db948fad2f287ae4528f051a3f1ab1639093076e983795ace8a19475d65cb049706bf8aa4c7467
- TLSH T1475155840ED9873036F7D3997B062CE3E33C2544959C41F8F2ECA2A357C689C721D969
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2.ini
- Size 428B
- SHA256 f67bf7db8ac2bd76b90aa14d4aa19f41dbdf5e3b8b5d770b41bcf4058b7529e7
- MD5 36094590b10cbb54ba97c95ae4deb0a0
- SHA1 ed85740c0dd2d7840ffc3dfd7385c2ef5679ff6e
- SHA512 59b35e0b5db5be74fabd7b5f790259db789177d89deea7105522d45273f58b069cfa4c78571b5e798856bcc1f3e5303fdd9321edd0c8576ef77d19f73e9ec7bf
- TLSH T1BCE05C8215E6D59D7A48265FAB5A19749204610A0B272CF6F62066018FCCD1D159E953
- MD5 SHA1 SHA512 TLSH