Analysis
- user interaction
yes - max time kernel
899s - max time network
448s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/08/2026, 11:17
General
- Target setup.exe
- Size 2.3MB
- Sample260810-ndvbhsgj91
- SHA256 b755ed69f460da15ab33145fef6caceda31a9f05c592ff93c865c495e3bb089d
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 9 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 27 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 8 IoCs
Inno Setup installer
- Modifies registry class 36 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-YBCXS060DD.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-YBCXS060DD.tmp\setup.tmp" /SL5="$700F0,890825,842240,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\FeedbackClient\FeedbackClient.exe"C:\Program Files (x86)\FeedbackClient\FeedbackClient.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\FeedbackClient\Updater.exe"C:\Program Files (x86)\FeedbackClient\Updater.exe" "https://jamestheakston.pages.dev/assets/projects/feedbackclient/setup.exe" 4064 "C:\Program Files (x86)\FeedbackClient\FeedbackClient.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\feedbackclient-setup.exe"C:\Users\Admin\AppData\Local\Temp\feedbackclient-setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KU8R7G4RFY.tmp\feedbackclient-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KU8R7G4RFY.tmp\feedbackclient-setup.tmp" /SL5="$E0216,890825,842240,C:\Users\Admin\AppData\Local\Temp\feedbackclient-setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files (x86)\FeedbackClient\FeedbackClient.exe"C:\Program Files (x86)\FeedbackClient\FeedbackClient.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\FeedbackClient\Updater.exe"C:\Program Files (x86)\FeedbackClient\Updater.exe" "https://jamestheakston.pages.dev/assets/projects/feedbackclient/setup.exe" 1984 "C:\Program Files (x86)\FeedbackClient\FeedbackClient.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\feedbackclient-setup.exe"C:\Users\Admin\AppData\Local\Temp\feedbackclient-setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-W64XZSZPM5.tmp\feedbackclient-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-W64XZSZPM5.tmp\feedbackclient-setup.tmp" /SL5="$A024E,890825,842240,C:\Users\Admin\AppData\Local\Temp\feedbackclient-setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
FeedbackClient.exe
Updater.exe
icon.ico
ratings.fbf
smiley.png
unins000.dat
unins000.dat
unins000.exe
Feedback Client.lnk
Feedback Client.lnk
Uninstall Tool.lnk
Uninstall Tool.lnk
FeedbackClient.exe.log
feedbackclient-setup.exe
setup.tmp
Feedback Client.lnk
Feedback Client.lnk
memory/1160-99-0x0000000000560000-0x0000000000A65000-memory.dmp
memory/1284-54-0x0000000000070000-0x0000000000078000-memory.dmp
memory/1288-8-0x0000000000860000-0x0000000000D65000-memory.dmp
memory/1288-9-0x0000000001330000-0x0000000001331000-memory.dmp
memory/1288-13-0x0000000000860000-0x0000000000D65000-memory.dmp
memory/1288-11-0x0000000000860000-0x0000000000D65000-memory.dmp
memory/1288-41-0x0000000000860000-0x0000000000D65000-memory.dmp
memory/1288-40-0x0000000000860000-0x0000000000D65000-memory.dmp
memory/1288-15-0x0000000000860000-0x0000000000D65000-memory.dmp
memory/1288-5-0x0000000001330000-0x0000000001331000-memory.dmp
memory/2488-157-0x00000000002E0000-0x00000000007E5000-memory.dmp
memory/3224-42-0x0000000000B30000-0x0000000000C0C000-memory.dmp
memory/3224-7-0x0000000000B30000-0x0000000000C0C000-memory.dmp
memory/3224-1-0x0000000000B30000-0x0000000000C0C000-memory.dmp
memory/3520-100-0x0000000000AB0000-0x0000000000B8C000-memory.dmp
memory/3520-65-0x0000000000AB0000-0x0000000000B8C000-memory.dmp
memory/4064-45-0x0000000000990000-0x000000000099E000-memory.dmp
memory/4624-123-0x00000000008C0000-0x000000000099C000-memory.dmp
memory/4624-158-0x00000000008C0000-0x000000000099C000-memory.dmp