Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 18:09
General
- Target b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.exe
- Size 7.2MB
- Sample260813-wrt7nscd94
- SHA256 b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.exe"C:\Users\Admin\AppData\Local\Temp\b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H1MOJRL8CM.tmp\b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.tmp"C:\Users\Admin\AppData\Local\Temp\is-H1MOJRL8CM.tmp\b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.tmp" /SL5="$4017C,5862141,838656,C:\Users\Admin\AppData\Local\Temp\b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-112F8DGZ2T.tmp\EnumerateVirtualMachineProviders.ps1"3⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {57AE4D16-2ABA-499A-93CF-CC1119030579}4⤵
- Drops file in Windows directory
-
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes3⤵
- System Time Discovery
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes3⤵
- System Time Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
EnumerateVirtualMachineProviders.ps1
b9f02ac837c0d784d509b20b0ed8162a472226b431e3a808064cb7e3358808dd.tmp
dism.log
memory/1632-47-0x00000000007F0000-0x00000000008CB000-memory.dmp
memory/1632-0-0x00000000007F0000-0x00000000008CB000-memory.dmp
memory/3544-24-0x000001FEEAF00000-0x000001FEEAF28000-memory.dmp
memory/3544-29-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-11-0x000001FEEA9B0000-0x000001FEEA9D2000-memory.dmp
memory/3544-16-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-20-0x000001FEEAAA0000-0x000001FEEAB52000-memory.dmp
memory/3544-19-0x000001FEEAA80000-0x000001FEEAA9E000-memory.dmp
memory/3544-21-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-22-0x000001FEEAA70000-0x000001FEEAA7A000-memory.dmp
memory/3544-23-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-10-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-28-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-14-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/3544-9-0x00007FFFAD8EF000-0x00007FFFAD8F0000-memory.dmp
memory/3544-44-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp
memory/4184-6-0x0000000001840000-0x0000000001841000-memory.dmp
memory/4184-48-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-49-0x0000000001840000-0x0000000001841000-memory.dmp
memory/4184-51-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-53-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-55-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-59-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-61-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-67-0x0000000000D50000-0x0000000001185000-memory.dmp
memory/4184-69-0x0000000000D50000-0x0000000001185000-memory.dmp