Analysis
- max time kernel
900s - max time network
503s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 12:34
General
- Target setup-Happ.x64 (2).exe
- Size 113.1MB
- Sample260808-pryfrsfl5w
- SHA256 619f6b29e0485d35fbf2f40414d29e92d113b8afeb96bb9aa4e03c0a809faa6e
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup-Happ.x64 (2).exe"C:\Users\Admin\AppData\Local\Temp\setup-Happ.x64 (2).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4QQG2X06QV.tmp\setup-Happ.x64 (2).tmp"C:\Users\Admin\AppData\Local\Temp\is-4QQG2X06QV.tmp\setup-Happ.x64 (2).tmp" /SL5="$400AE,117269072,893440,C:\Users\Admin\AppData\Local\Temp\setup-Happ.x64 (2).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Z72KAYQDA8.tmp\vcredist2022_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-Z72KAYQDA8.tmp\vcredist2022_x64.exe" /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1F801FAF-D1CC-46B4-A1C7-3670453ECB45}\.cr\vcredist2022_x64.exe"C:\Windows\Temp\{1F801FAF-D1CC-46B4-A1C7-3670453ECB45}\.cr\vcredist2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-Z72KAYQDA8.tmp\vcredist2022_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /passive /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{A52DB085-3A61-4DD4-8961-58B5CD85CCC0}\.be\VC_redist.x64.exe"C:\Windows\Temp\{A52DB085-3A61-4DD4-8961-58B5CD85CCC0}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D142B244-9717-47F0-A613-93341BB9E392} {BE8B4569-61D4-49E9-BF5C-4BC4D51CFADA} 15365⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
setup-Happ.x64 (2).tmp
vcredist2022_x64.exe
vcredist2022_x64.exe
logo.png
wixstdba.dll
memory/4708-0-0x0000000000100000-0x00000000001E9000-memory.dmp
memory/4708-9-0x0000000000100000-0x00000000001E9000-memory.dmp
memory/5068-128-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-140-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-13-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-15-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-62-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-10-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-64-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-86-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-89-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-91-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-93-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-95-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-97-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-100-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-102-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-104-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-106-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-108-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-110-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-112-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-114-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-116-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-118-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-120-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-122-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-124-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-126-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-6-0x0000000003160000-0x0000000003161000-memory.dmp
memory/5068-130-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-132-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-11-0x0000000003160000-0x0000000003161000-memory.dmp
memory/5068-134-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-154-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-136-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-142-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-144-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-146-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-148-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-150-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-152-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-138-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-158-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-160-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-162-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-164-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-166-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-168-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-170-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-172-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-174-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-176-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-178-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-180-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-182-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-184-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-186-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-188-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-190-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-192-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-194-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-196-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-198-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-200-0x0000000000B70000-0x0000000000FBB000-memory.dmp
memory/5068-202-0x0000000000B70000-0x0000000000FBB000-memory.dmp