Analysis
- user interaction
yes - max time kernel
141s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 15:01
General
- Target Installer-1.0.7.exe
- Size 9.8MB
- Sample260808-sdz9zss1bs
- SHA256 48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Modifies registry key 1 TTPs 7 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.7.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-BF9F3734-57F5-409F-BD16-F1B74571EB1F\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-BF9F3734-57F5-409F-BD16-F1B74571EB1F\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exeC:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\dotnet\dotnet.exedotnet.exe --list-runtimes4⤵
- System Time Discovery
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$sig = Get-AuthenticodeSignature -LiteralPath 'C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe'; if ($sig.Status -eq 'Valid') { exit 0 }; exit 1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Madium.exe.download
install.ps1
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
__PSScriptPolicyTest_drs2k3sp.xnw.ps1
memory/204-47-0x000002321AF80000-0x000002321B000000-memory.dmp
memory/204-46-0x000002321AF80000-0x000002321B000000-memory.dmp
memory/1264-77-0x00000139DE000000-0x00000139DE01E000-memory.dmp
memory/1264-76-0x00000139DDAB0000-0x00000139DDB62000-memory.dmp
memory/2272-55-0x0000025375860000-0x0000025375912000-memory.dmp
memory/2272-54-0x0000025375840000-0x000002537585E000-memory.dmp
memory/2272-56-0x0000025375920000-0x000002537592A000-memory.dmp
memory/2272-51-0x00000253755A0000-0x00000253755C2000-memory.dmp
memory/3800-22-0x00000216347C0000-0x0000021634D19000-memory.dmp
memory/3800-29-0x0000021634E00000-0x0000021634E80000-memory.dmp
memory/3800-24-0x00000216347C0000-0x0000021634D19000-memory.dmp
memory/3800-28-0x0000021634E00000-0x0000021634E80000-memory.dmp
memory/3800-23-0x00000216347C0000-0x0000021634D19000-memory.dmp
memory/3800-25-0x0000021634760000-0x0000021634761000-memory.dmp
memory/3800-21-0x0000021634750000-0x0000021634751000-memory.dmp