Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/08/2026, 17:14
General
- Target pixgrep_0.3.0_x64-setup.exe
- Size 4.5MB
- Sample260815-vr2fbagh42
- SHA256 df5178e2d5b3038e8c41adc16b6ded16ccd93220cb425d1444742d6835b02138
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pixgrep_0.3.0_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\pixgrep_0.3.0_x64-setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "try { if (-not (Get-WindowsCapability -Online -Name Language.OCR~~~ja-JP~0.0.1.0).State -eq \"Installed\") { Add-WindowsCapability -Online -Name Language.OCR~~~ja-JP~0.0.1.0 -ErrorAction Stop | Out-Null } } catch { }"2⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EF859123-3EAC-4D90-B8B7-569012B552B9\dismhost.exeC:\Users\Admin\AppData\Local\Temp\EF859123-3EAC-4D90-B8B7-569012B552B9\dismhost.exe {17D85B3E-764E-4E33-95F6-E9A687D3F361}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AppxProvider.dll
AssocProvider.dll
CbsProvider.dll
DismCore.dll
DismCorePS.dll
DismHost.exe
DismProv.dll
DmiProvider.dll
FfuProvider.dll
FolderProvider.dll
GenericProvider.dll
IBSProvider.dll
ImagingProvider.dll
IntlProvider.dll
LogProvider.dll
MsiProvider.dll
OSProvider.dll
OfflineSetupProvider.dll
ProvProvider.dll
SetupPlatformProvider.dll
SmiProvider.dll
SysprepProvider.dll
TransmogProvider.dll
UnattendProvider.dll
VhdProvider.dll
WimProvider.dll
AppxProvider.dll.mui
AssocProvider.dll.mui
CbsProvider.dll.mui
DismCore.dll.mui
DmiProvider.dll.mui
FfuProvider.dll.mui
FolderProvider.dll.mui
GenericProvider.dll.mui
IBSProvider.dll.mui
ImagingProvider.dll.mui
IntlProvider.dll.mui
LogProvider.dll.mui
MsiProvider.dll.mui
OSProvider.dll.mui
OfflineSetupProvider.dll.mui
ProvProvider.dll.mui
SetupPlatformProvider.dll.mui
SmiProvider.dll.mui
SysprepProvider.dll.mui
TransmogProvider.dll.mui
UnattendProvider.dll.mui
VhdProvider.dll.mui
WimProvider.dll.mui
dismprov.dll.mui
__PSScriptPolicyTest_qgi1kxfx.v4s.ps1
System.dll
nsDialogs.dll
nsExec.dll
nsis_tauri_utils.dll
dism.log
dism.log
memory/3248-55-0x0000000006290000-0x00000000062AE000-memory.dmp
memory/3248-43-0x0000000005730000-0x0000000005D58000-memory.dmp
memory/3248-59-0x00000000704B0000-0x00000000704FC000-memory.dmp
memory/3248-58-0x0000000007240000-0x0000000007272000-memory.dmp
memory/3248-57-0x000000007EEE0000-0x000000007EEF0000-memory.dmp
memory/3248-56-0x00000000062D0000-0x000000000631C000-memory.dmp
memory/3248-69-0x0000000007220000-0x000000000723E000-memory.dmp
memory/3248-54-0x0000000005D60000-0x00000000060B4000-memory.dmp
memory/3248-67-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-46-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/3248-45-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/3248-70-0x0000000007290000-0x0000000007333000-memory.dmp
memory/3248-44-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/3248-68-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-42-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-41-0x0000000002950000-0x0000000002986000-memory.dmp
memory/3248-40-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-71-0x0000000007C20000-0x000000000829A000-memory.dmp
memory/3248-72-0x00000000075E0000-0x00000000075FA000-memory.dmp
memory/3248-73-0x0000000007650000-0x000000000765A000-memory.dmp
memory/3248-298-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-299-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-300-0x000000007EEE0000-0x000000007EEF0000-memory.dmp
memory/3248-302-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-301-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/3248-74-0x00000000077E0000-0x0000000007806000-memory.dmp