Analysis
- user interaction
yes - max time kernel
901s - max time network
467s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 15:16
General
- Target MedalSetup.NzQyODI0NTIyLDEsbm9yZWY=.exe
- Size 145.1MB
- Sample260816-snsmwsdn2x
- SHA256 1cf67957d0c3ca8c047f698b98ea9c63a8e59253a67f856abf357a995a57774b
Malware Config
Signatures
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to get system information.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MedalSetup.NzQyODI0NTIyLDEsbm9yZWY=.exe"C:\Users\Admin\AppData\Local\Temp\MedalSetup.NzQyODI0NTIyLDEsbm9yZWY=.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Squirrel.exe"C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe"C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe" --squirrel-install 2633.392.13⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exeC:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad --url=https://sentry.medal.tv/api/1378175/minidump/?sentry_key=c8a362b2878242408b487aafa89be8a7 "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2633.392.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=40.1.0 --initial-client-data=0x490,0x498,0x49c,0x46c,0x4a0,0x7ff66b6976b4,0x7ff66b6976c0,0x7ff66b6976d04⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKCU\Software\Medal /v UUID5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 5bf43dd0-ddb5-4574-aaa7-9f8e4c0b6bf0 /f"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Medal /v UUID /t REG_SZ /d 5bf43dd0-ddb5-4574-aaa7-9f8e4c0b6bf0 /f5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\fsutil.exefsutil dirty query C:4⤵
-
-
C:\Users\Admin\AppData\Local\Medal\Update.exeC:\Users\Admin\AppData\Local\Medal\Update.exe --createShortcut=Medal.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HKLM\Software\Microsoft\Cryptography /v MachineGuid5⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe"C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2280,i,13695401165036726611,5410751739878721895,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2276 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe"C:\Users\Admin\AppData\Local\Medal\app-2633.392.1\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2280,i,13695401165036726611,5410751739878721895,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2308 /prefetch:114⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Medal.exe
D3DCompiler_47.dll
chrome_100_percent.pak
chrome_200_percent.pak
icudtl.dat
libegl.dll
libglesv2.dll
en-US.pak
resources.pak
index.js
main.min.js
index.js
buffer-util.js
constants.js
event-target.js
extension.js
limiter.js
permessage-deflate.js
receiver.js
sender.js
stream.js
subprotocol.js
validation.js
websocket-server.js
websocket.js
package.json
package.json
squirrel.exe
v8_context_snapshot.bin
RELEASES
Update.exe
background.gif
setupIcon.ico
Preferences
Preferences~RFe59b56b.TMP
default.exc
memory/1864-81-0x000000001BBF0000-0x000000001BC2E000-memory.dmp
memory/1864-82-0x00000000033E0000-0x00000000033EE000-memory.dmp
memory/1864-11-0x0000000000B40000-0x0000000000D16000-memory.dmp
memory/2372-1685-0x000001D4AA4C0000-0x000001D4AA4DE000-memory.dmp
memory/2372-1714-0x000001D4AA5E0000-0x000001D4AA604000-memory.dmp
memory/2372-1659-0x000001D4922F0000-0x000001D492312000-memory.dmp
memory/2372-1711-0x000001D4AA5E0000-0x000001D4AA60A000-memory.dmp
memory/2372-1697-0x000001D4AA5A0000-0x000001D4AA5AA000-memory.dmp
memory/2372-1686-0x000001D4AA4E0000-0x000001D4AA592000-memory.dmp
memory/3424-1682-0x0000000002C70000-0x0000000002C90000-memory.dmp
memory/4944-1624-0x00000000001A0000-0x00000000003AA000-memory.dmp