Overview

overview

6

Static

static

1

Install_PVKiosk.exe

windows10-2004-x64

6

Install_PVKiosk.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    213s
  • max time network
    236s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 04:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Install_PVKiosk.exe
  • Size 442.0MB
  • Sample260814-ele25acl21
  • SHA256 c6f979d070460013befd80bd52408957f21d025f9cd1b42c6bcfc2fa7f4bd0d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutioninstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 54 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install_PVKiosk.exe
    "C:\Users\Admin\AppData\Local\Temp\Install_PVKiosk.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Users\Admin\AppData\Local\Temp\is-R7R5776XVA.tmp\Install_PVKiosk.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R7R5776XVA.tmp\Install_PVKiosk.tmp" /SL5="$400B2,462222001,893440,C:\Users\Admin\AppData\Local\Temp\Install_PVKiosk.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C dotnet --list-runtimes > "C:\Users\Admin\AppData\Local\Temp\is-JAJC5YC5J2.tmp\dotnet.txt" 2>&1
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Program Files\dotnet\dotnet.exe
          dotnet --list-runtimes
          4⤵
          • System Time Discovery
          PID:3944
      • C:\Users\Admin\AppData\Local\Temp\is-JAJC5YC5J2.tmp\windowsdesktop-runtime-8.0.23-win-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-JAJC5YC5J2.tmp\windowsdesktop-runtime-8.0.23-win-x64.exe" /passive
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5284
        • C:\Windows\Temp\{606E5EB6-5879-4647-8465-22CD453215BC}\.cr\windowsdesktop-runtime-8.0.23-win-x64.exe
          "C:\Windows\Temp\{606E5EB6-5879-4647-8465-22CD453215BC}\.cr\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-JAJC5YC5J2.tmp\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /passive
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3116
          • C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\.be\windowsdesktop-runtime-8.0.23-win-x64.exe
            "C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\.be\windowsdesktop-runtime-8.0.23-win-x64.exe" -q -burn.elevated BurnPipe.{56F46A70-9FC7-46FE-BE14-A8D48B10E300} {0059E626-BF2A-4B34-A56A-F4CEB6D6D2FA} 3116
            5⤵
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:4864
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 968
            5⤵
            • Program crash
            PID:4112
  • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
    "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
      "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031824.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
        "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031824.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6044
        • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
          "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" -q -burn.elevated BurnPipe.{78DED45A-4B63-4464-8F87-44DF60759B35} {0A44D1C7-6985-4954-9020-5498338BC5B4} 6044
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1880
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 1028
          4⤵
          • Program crash
          PID:3268
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 364B3F4EA1E50AAA455AAACABE40491F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3412
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D7AFC518CE43A0D0B1EF9F8ADF14CE12
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:6060
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 534E5242985F5E775028E3122AAE5971
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5756
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 891E0F5B33941E72D1ACEDD794818DD2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2312
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3116 -ip 3116
    1⤵
      PID:4520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6044 -ip 6044
      1⤵
        PID:3256

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Accessibility Features

            1
            T1546.008

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Accessibility Features

            1
            T1546.008

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a2fcf.rbs
            • Path C:\Config.Msi\e5a2fcf.rbs
            • Size 48KB
            • SHA256 cb0338a3be3485dc4e4370c979b07e8e088da1d4f513de7d5d5dcb23f3fc64c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a2fd4.rbs
            • Path C:\Config.Msi\e5a2fd4.rbs
            • Size 9KB
            • SHA256 ef4255df9ae3c991baa43aef8f86ff38fb26fa59a91d60d79be7f10b1636336d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a2fd9.rbs
            • Path C:\Config.Msi\e5a2fd9.rbs
            • Size 11KB
            • SHA256 eaca1bee323b1148bc3fe61c3189043105a4f03a1bed5030b621499452d16065
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a2fde.rbs
            • Path C:\Config.Msi\e5a2fde.rbs
            • Size 8KB
            • SHA256 b2ef28639bc10c15c62a6adfb03a9592fd8acfe93e2661534f35913bcbf7520c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a2fdf.rbf
            • Path C:\Config.Msi\e5a2fdf.rbf
            • Size 143KB
            • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a2fe0.rbf
            • Path C:\Config.Msi\e5a2fe0.rbf
            • Size 3B
            • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
            • MD5 SHA1 SHA512
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\state.rsm
            • Size 1KB
            • SHA256 a8d7c2cf9d96e3bc5fd333b20fbec01b6a6e94e689b8d69f5bce7163d8a7ab43
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031824.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031824.log
            • Size 10KB
            • SHA256 e1f553660a3b695ace2f7868ef6f12e4e07247483c3940b6bc35ac6e55ff0c65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031824_000_dotnet_runtime_8.0.23_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031824_000_dotnet_runtime_8.0.23_win_x64.msi.log
            • Size 3KB
            • SHA256 e391b4c28f04d5f51fe832dec6621c4058ff5304a1a49aabac261ca7e1435340
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dotnet.txt
            • Path C:\Users\Admin\AppData\Local\Temp\is-JAJC5YC5J2.tmp\dotnet.txt
            • Size 552B
            • SHA256 3a540187aba2047118a389c22152a488c215f21766cd75e59c187f7c414bddb1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Install_PVKiosk.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-R7R5776XVA.tmp\Install_PVKiosk.tmp
            • Size 4.2MB
            • SHA256 fd417243e02823655f1f9fcab0ddd3dc4aa5910e01499e5e2823bf89b1873227
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI39AF.tmp
            • Path C:\Windows\Installer\MSI39AF.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{130555E7-F6A9-4D30-83E0-DD76ADAD3B86}\.ba\1033\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\dotnet_host_8.0.23_win_x64.msi
            • Size 708KB
            • SHA256 b9e8d1240cbad28c368e5c83ca87584678622573dda73b50998f4ddbc003727d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_hostfxr_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\dotnet_hostfxr_8.0.23_win_x64.msi
            • Size 776KB
            • SHA256 a8e69ac1e5b6ca7eafac1978ff32056ad7822dedb5de05256c9e776cf6fc4e36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\dotnet_runtime_8.0.23_win_x64.msi
            • Size 26.1MB
            • SHA256 5335709233149cba79ceae94477d2d89b6219cc6a6abf637f3d499ce018dd478
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{2419CF70-B726-4600-9822-93F97BE5708A}\windowsdesktop_runtime_8.0.23_win_x64.msi
            • Size 29.0MB
            • SHA256 d1adad0c9f2d2272926a61e9171df6b216e658a52962e46ada091561d9604985
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop-runtime-8.0.23-win-x64.exe
            • Path C:\Windows\Temp\{606E5EB6-5879-4647-8465-22CD453215BC}\.cr\windowsdesktop-runtime-8.0.23-win-x64.exe
            • Size 608KB
            • SHA256 e7355cfd7aa1900736771ef9669590f57d59d72f7eac8caa39198dd6eba7267f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3364-481-0x0000000000C60000-0x0000000000D49000-memory.dmp
            Download

            memory/3364-0-0x0000000000C60000-0x0000000000D49000-memory.dmp
            Download

            memory/3364-12-0x0000000000C60000-0x0000000000D49000-memory.dmp
            Download

            memory/4772-139-0x0000000000B10000-0x0000000000F5B000-memory.dmp
            Download

            memory/4772-14-0x0000000001AD0000-0x0000000001AD1000-memory.dmp
            Download

            memory/4772-6-0x0000000001AD0000-0x0000000001AD1000-memory.dmp
            Download

            memory/4772-474-0x0000000000B10000-0x0000000000F5B000-memory.dmp
            Download

            memory/4772-480-0x0000000000B10000-0x0000000000F5B000-memory.dmp
            Download

            memory/4772-13-0x0000000000B10000-0x0000000000F5B000-memory.dmp
            Download