05baac7a0225e5fccef9bb30c5969c1bb2c48520e1ccd6b1159ea339fe22147d

Resubmissions

09/08/2026, 14:30

260809-rvda4sgm7w

09/08/2026, 14:28

260809-rtfd3sgm6t7

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 2.7MB
Sample260809-rtfd3sgm6t
SHA256 05baac7a0225e5fccef9bb30c5969c1bb2c48520e1ccd6b1159ea339fe22147d
MD5 bb4b8f90a10a1b8687625c5551528439
SHA1 b3aa95e54bcd84512dab9328801129c66cfb527f
SHA512 2ba6f364f7e7407aabb8d0787fb893ab061648edc3ac39630f5922d175fea443df3ddd0315628c40489156b77c0488649fe2f3b2a0e363e93f35cecb95880440
SSDEEP 49152:X1DYjo/j1ryJVYTFVbpoapK89Yj3J+SQUl2cXbLgfYk/J3afQ0f:XpYc/jXTHbqapjKl3VXbLaVcQ0
TLSH
T12AD51261B4E4C1E1D02B70B5CD5578F6A2F27E52CF609E8F1C003E653E766A96878E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3764	cmd.exe
3804	cmd.exe
4624	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4220	2024	setup.exe	86
PID 4220 wrote to memory of 3764	4220	setup.exe	87
PID 3152 wrote to memory of 3808	3152	setup.exe	105
PID 3808 wrote to memory of 3804	3808	setup.exe	106
PID 4284 wrote to memory of 900	4284	setup.exe	109
PID 900 wrote to memory of 4624	900	setup.exe	110

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe" -sfxwaitall:1 "cmd" /c IF EXIST "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" ( REN "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe" "C:\Program Files\Maxon Cinema 4D 2024" )
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c IF EXIST "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" ( REN "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe" "C:\Program Files\Maxon Cinema 4D 2024" )
    3⤵
    - Executes a command shell one-liner
    PID:3764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1360

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe" -sfxwaitall:1 "cmd" /c IF EXIST "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" ( REN "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe" "C:\Program Files\Maxon Cinema 4D 2024" )
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c IF EXIST "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" ( REN "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe" "C:\Program Files\Maxon Cinema 4D 2024" )
    3⤵
    - Executes a command shell one-liner
    PID:3804

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe" -sfxwaitall:1 "cmd" /c IF EXIST "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" ( REN "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe" "C:\Program Files\Maxon Cinema 4D 2024" )
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c IF EXIST "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" ( REN "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe" "C:\Program Files\Maxon Cinema 4D 2024" )
    3⤵
    - Executes a command shell one-liner
    PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cinema 4D.exe

Path C:\Users\Admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exe
Size 2.6MB
SHA256 daeb175f6a1111b52fa005ce1f1bc1a85e73f03f3e92a671fba2149b7eb0b7a5
MD5 2005904e44c82a7e474fb74c28ff29ee
SHA1 80b2f54d58f6f91ef0f129c688774a0c49cc1af4
SHA512 37c84510ba654303b20e88de1cca99faa3febc11e28e77f18b8723204c283dc88b78566841727ba78d89f04294a9188835e65ff9d51c72e68674d915c9e0df89
SSDEEP 49152:9qhTe1JiAbU3aSUVFpT2dMW7Hmy2hG5/WjJAgpGfPaFEBpoLJWYjB:924U3YFT2dMW7HmXhG5/aJAgpGfyFaof
TLSH
T1AED52392B77D05EAC1EE95388992970AE672BC51A7A1838F0160B37E1F333E4ED17711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download