Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 18:13
General
- Target pixgrep_0.3.0_x64-setup.exe
- Size 4.5MB
- Sample260815-wt2drs1fmg
- SHA256 df5178e2d5b3038e8c41adc16b6ded16ccd93220cb425d1444742d6835b02138
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pixgrep_0.3.0_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\pixgrep_0.3.0_x64-setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "try { if (-not (Get-WindowsCapability -Online -Name Language.OCR~~~ja-JP~0.0.1.0).State -eq \"Installed\") { Add-WindowsCapability -Online -Name Language.OCR~~~ja-JP~0.0.1.0 -ErrorAction Stop | Out-Null } } catch { }"2⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {36CA9982-9089-4153-B5BF-A234BFB36ED7}3⤵
- Drops file in Windows directory
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsis_tauri_utils.dll
dism.log
dism.log
memory/912-55-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/912-61-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-46-0x0000000005990000-0x00000000059B2000-memory.dmp
memory/912-47-0x00000000060A0000-0x0000000006106000-memory.dmp
memory/912-48-0x0000000006110000-0x0000000006176000-memory.dmp
memory/912-51-0x0000000006240000-0x000000000659B000-memory.dmp
memory/912-52-0x0000000006780000-0x000000000679E000-memory.dmp
memory/912-53-0x00000000067C0000-0x000000000680C000-memory.dmp
memory/912-54-0x0000000007750000-0x0000000007786000-memory.dmp
memory/912-44-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-58-0x0000000006D70000-0x0000000006D90000-memory.dmp
memory/912-59-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-60-0x0000000007A40000-0x0000000007AE3000-memory.dmp
memory/912-45-0x00000000059E0000-0x000000000602A000-memory.dmp
memory/912-62-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-64-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/912-63-0x0000000008170000-0x00000000087EC000-memory.dmp
memory/912-65-0x0000000007B60000-0x0000000007B6A000-memory.dmp
memory/912-66-0x0000000007DA0000-0x0000000007E36000-memory.dmp
memory/912-67-0x0000000072ED2000-0x0000000072ED3000-memory.dmp
memory/912-68-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-69-0x0000000007D60000-0x0000000007D8A000-memory.dmp
memory/912-43-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-42-0x0000000005280000-0x00000000052B6000-memory.dmp
memory/912-87-0x0000000072EC0000-0x000000007367C000-memory.dmp
memory/912-41-0x0000000072ED2000-0x0000000072ED3000-memory.dmp