Analysis
- user interaction
yes - max time kernel
148s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/08/2026, 03:51
General
- Target Kaspersky Installer.exe
- Size 4.5MB
- Sample260816-eepyracn7v
- SHA256 bc8526519ba3ab695fa8659774f5c93d7d12fe0af43402f2f60682f30c7cefb3
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe"C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\CAD53F7C52991F11B8CCEE17269E9D74\Kaspersky Installer.exe"C:\Windows\temp\CAD53F7C52991F11B8CCEE17269E9D74\Kaspersky Installer.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe"2⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F5E4E18C52991F11B8CCEE17269E9D74\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\F5E4E18C52991F11B8CCEE17269E9D74\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAAMMJpJgchbgoESKYqsxahuAkQAAFQJ//8yokJb8JmnhS8AGQAHAEUAeAB1AGEAbgBrAHEAaAAAAAcAMQAwAC4AMQAyADcALgAwAC4AMQA4ADcAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_E12790F3-9925-11F1-8BCC-EE7162E9D947\startup.exe"C:\ProgramData\Kaspersky Lab Setup Files\KFA21.26.4.406.0.66.0\au_setup_E12790F3-9925-11F1-8BCC-EE7162E9D947\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" /-self_remove -l=es-MX -xpos=804 -ypos=300 -prevsetupver=21.20.8.505.0.74.03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\E19AB9AE52991F11B8CCEE17269E9D74\startup.exe"C:\Windows\temp\E19AB9AE52991F11B8CCEE17269E9D74\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Installer.exe" /-self_remove -l=es-MX -xpos=804 -ypos=300 -prevsetupver=21.20.8.505.0.74.04⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CD2697BE52991F11B8CCEE17269E9D74\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\CD2697BE52991F11B8CCEE17269E9D74\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAAUVJ0AhjjwOIVHLZdChR3dAvwAAGgP//8Nay81p7NTfi8AGQAHAEUAeAB1AGEAbgBrAHEAaAAAAAcAMQAwAC4AMQAyADcALgAwAC4AMQA4ADcAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\temp\CAD53F7C52991F11B8CCEE17269E9D74\Kaspersky Installer.exe"C:\Windows\temp\CAD53F7C52991F11B8CCEE17269E9D74\Kaspersky Installer.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\F5E4E18C52991F11B8CCEE17269E9D74;2388"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
kdscrl.rdb
dynamic.ini
startup.exe
static.ini
kdscrl.rdb.z
GuiStrings.loc
GuiStrings_KFA.loc
GuiStrings_es-MX_KFA.loc
downloader_neutral_KFA.ini
kl.setup.ui.interoplayer.dll
setup.dll
setup_ui.exe
downloader_es-MX.ini
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
discovery.cfg
Kaspersky Installer.exe
memory/1232-397-0x0000000077990000-0x00000000779A0000-memory.dmp
memory/1232-398-0x0000000077990000-0x00000000779A0000-memory.dmp
memory/1232-399-0x0000000077990000-0x00000000779A0000-memory.dmp
memory/2388-8-0x00000000779A0000-0x00000000779B0000-memory.dmp
memory/2388-6-0x00000000779A0000-0x00000000779B0000-memory.dmp
memory/2388-7-0x00000000779A0000-0x00000000779B0000-memory.dmp
memory/3944-199-0x00000000779B0000-0x00000000779C0000-memory.dmp
memory/3944-200-0x00000000779B0000-0x00000000779C0000-memory.dmp
memory/3944-201-0x00000000779B0000-0x00000000779C0000-memory.dmp
memory/4496-283-0x0000000007A00000-0x0000000007A34000-memory.dmp
memory/4496-285-0x00000000079C0000-0x00000000079E0000-memory.dmp
memory/4496-277-0x0000000006D80000-0x0000000006E36000-memory.dmp
memory/4496-279-0x0000000007930000-0x0000000007978000-memory.dmp
memory/4496-272-0x00000000065E0000-0x00000000069B4000-memory.dmp
memory/4496-271-0x0000000005CA0000-0x0000000005CB6000-memory.dmp
memory/4496-270-0x0000000005D50000-0x0000000005DB8000-memory.dmp
memory/4496-265-0x0000000005C50000-0x0000000005CA0000-memory.dmp
memory/4496-263-0x0000000005760000-0x000000000576E000-memory.dmp
memory/4496-281-0x00000000078F0000-0x0000000007900000-memory.dmp
memory/4496-280-0x0000000007900000-0x0000000007916000-memory.dmp
memory/4496-289-0x0000000000650000-0x000000000071C000-memory.dmp
memory/4496-286-0x000000000BCE0000-0x000000000BD24000-memory.dmp
memory/4496-276-0x0000000006C90000-0x0000000006CB6000-memory.dmp
memory/4496-282-0x00000000079A0000-0x00000000079BC000-memory.dmp
memory/4496-284-0x0000000007B00000-0x0000000007BB4000-memory.dmp
memory/4532-188-0x0000000077990000-0x00000000779A0000-memory.dmp
memory/4532-189-0x0000000077990000-0x00000000779A0000-memory.dmp
memory/4532-190-0x0000000077990000-0x00000000779A0000-memory.dmp
memory/4636-2-0x00000000779C0000-0x00000000779D0000-memory.dmp
memory/4636-1-0x00000000779C0000-0x00000000779D0000-memory.dmp
memory/4636-0-0x00000000779C0000-0x00000000779D0000-memory.dmp
memory/5044-94-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/5044-142-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/5044-141-0x00000000007F0000-0x0000000000895000-memory.dmp
memory/5044-140-0x000000000B790000-0x000000000B79E000-memory.dmp
memory/5044-139-0x000000000B7D0000-0x000000000B808000-memory.dmp
memory/5044-138-0x000000000B2D0000-0x000000000B2D8000-memory.dmp
memory/5044-137-0x000000000B2E0000-0x000000000B322000-memory.dmp
memory/5044-117-0x0000000007080000-0x00000000070B2000-memory.dmp
memory/5044-121-0x0000000007320000-0x00000000073D6000-memory.dmp
memory/5044-125-0x0000000007100000-0x000000000711E000-memory.dmp
memory/5044-133-0x0000000007280000-0x0000000007292000-memory.dmp
memory/5044-129-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/5044-113-0x0000000006EE0000-0x0000000006F72000-memory.dmp
memory/5044-108-0x0000000006DD0000-0x0000000006E0A000-memory.dmp
memory/5044-112-0x0000000006E10000-0x0000000006E36000-memory.dmp
memory/5044-103-0x0000000006340000-0x00000000063EE000-memory.dmp
memory/5044-99-0x0000000006270000-0x0000000006286000-memory.dmp
memory/5044-95-0x0000000006560000-0x0000000006B06000-memory.dmp
memory/5044-93-0x0000000005C50000-0x0000000005FAE000-memory.dmp
memory/5044-306-0x00000000007F0000-0x0000000000895000-memory.dmp
memory/5044-85-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/5044-89-0x00000000055D0000-0x00000000055E6000-memory.dmp
memory/5044-84-0x0000000005410000-0x000000000546E000-memory.dmp
memory/5044-51-0x0000000005240000-0x0000000005288000-memory.dmp
memory/5044-46-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/5044-43-0x00000000011F0000-0x00000000011FE000-memory.dmp
memory/5044-40-0x0000000004EE0000-0x0000000004EF0000-memory.dmp