Analysis
- user interaction
yes - max time kernel
45s - max time network
47s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
15/08/2026, 21:29
General
- Target ShowCockpit_Setup_v4.11.2.exe
- Size 38.8MB
- Sample260815-1cd95atfpg
- SHA256 1df8bcdcb86b16c2745ca0f72ecfec3f380211fce6cb059200d654d91356d27f
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 22 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- ConfuserEx .NET packer 6 IoCs
Detects ConfuserEx .NET packer.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ShowCockpit_Setup_v4.11.2.exe"C:\Users\Admin\AppData\Local\Temp\ShowCockpit_Setup_v4.11.2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7OKHV.tmp\ShowCockpit_Setup_v4.11.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-7OKHV.tmp\ShowCockpit_Setup_v4.11.2.tmp" /SL5="$502A6,39811670,899072,C:\Users\Admin\AppData\Local\Temp\ShowCockpit_Setup_v4.11.2.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2013.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2013.x86.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2013.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2013.x86.exe" /install /passive /norestart -burn.unelevated BurnPipe.{03C13007-3C88-4F6E-9118-ACB7DF874D2A} {C02A5525-842D-4072-B105-183D4C23E4EC} 41644⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2015-2019.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2015-2019.x86.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{C4FBD160-01ED-45E0-A852-E947286D461D}\.cr\vc_redist_2015-2019.x86.exe"C:\Windows\Temp\{C4FBD160-01ED-45E0-A852-E947286D461D}\.cr\vc_redist_2015-2019.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2015-2019.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /passive /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2015-2019.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2015-2019.x64.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{A9A0A338-6A50-416C-A5CD-280EC4136569}\.cr\vc_redist_2015-2019.x64.exe"C:\Windows\Temp\{A9A0A338-6A50-416C-A5CD-280EC4136569}\.cr\vc_redist_2015-2019.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-RRIEV.tmp\vc_redist_2015-2019.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=692 /install /passive /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\ShowCockpit\ShowCockpit.exe"C:\Program Files (x86)\ShowCockpit\ShowCockpit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" -burn.unelevated BurnPipe.{2B9734D5-9EAA-401C-9467-C67AE6CF0CD6} {D31307C0-73BA-49A6-A74E-E2B55F12E2B6} 35403⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\ShowCockpit\ShowCockpit.exe"C:\Program Files (x86)\ShowCockpit\ShowCockpit.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DBDesign.PosiStageDotNet.dll
MetroFramework.dll
Midi.dll
Newtonsoft.Json.dll
ShowCockpit.Drivers.AbletonLink.Core.dll
ShowCockpit.Drivers.Martin.dll
ShowCockpit.Shared.dll
ShowCockpit.exe
ShowCockpit.exe.config
state.rsm
ShowCockpit_Setup_v4.11.2.tmp
vc_redist_2013.x86.exe
vc_redist_2015-2019.x64.exe
vc_redist_2015-2019.x86.exe
logo.png
thm.wxl
wixstdba.dll
vcredist_x86.exe
wixstdba.dll
vc_redist_2015-2019.x64.exe
vc_redist_2015-2019.x86.exe
memory/3172-165-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/3172-0-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/3172-332-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/3448-331-0x0000000000400000-0x0000000000724000-memory.dmp
memory/3448-5-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/3448-179-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/3448-178-0x0000000000400000-0x0000000000724000-memory.dmp
memory/4624-325-0x00000000064E0000-0x0000000006572000-memory.dmp
memory/4624-344-0x0000000006D60000-0x0000000006D7A000-memory.dmp
memory/4624-329-0x0000000006630000-0x00000000066E0000-memory.dmp
memory/4624-336-0x0000000006B50000-0x0000000006B6A000-memory.dmp
memory/4624-324-0x0000000006080000-0x00000000060B4000-memory.dmp
memory/4624-340-0x0000000006D00000-0x0000000006D36000-memory.dmp
memory/4624-320-0x000000000AB70000-0x000000000B116000-memory.dmp
memory/4624-330-0x00000000067E0000-0x0000000006846000-memory.dmp
memory/4624-351-0x0000000006E80000-0x0000000006F08000-memory.dmp
memory/4624-319-0x0000000005E50000-0x0000000005EE2000-memory.dmp
memory/4624-318-0x0000000000FC0000-0x000000000156C000-memory.dmp
memory/4624-358-0x0000000075090000-0x00000000750C1000-memory.dmp
memory/4624-359-0x0000000006D80000-0x0000000006DB1000-memory.dmp
memory/4740-357-0x0000000005670000-0x000000000567A000-memory.dmp