Analysis
- max time kernel
298s - max time network
290s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10ltsc2021-20260513-en
9 signatures
300 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win11-20260513-en
8 signatures
300 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
9 signatures
300 seconds
General
- Target setup.exe
- Size 545KB
- Sample260819-ampkqstdmb
- SHA256 8e4c5d232d6a1d98d88a52565379f1c8e85fe297910fc4d4f526a0f0375932a5
- MD5 a8f68066b2e990d00aafc93f7b5f6156
- SHA1 fe9a45c7562567ba191ff6c79a375c7ee8af3a65
- SHA512 c2eab5571f5519069849b529827237572be0fd1ed30e74c6ba833330d97e08888de8a9824c2db4aa49ec94f73a1c9b02b81a841a734d702179b7cd0c3810df87
- SSDEEP 12288:6b971VO6Ym9FT0CrZXt9HmlZs/ekTODtA:y77ZZ9TXmie5A
- TLSH T15CC4F106F75904E9D029C1B9959A1666B7F37C019B20A5EF03A4864B2F27BC46F3EF24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Python310\uncyuacs setup.exe File opened for modification C:\Program Files\untold\snoiantsards setup.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3200 setup.exe 3200 setup.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3200 setup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3200 wrote to memory of 3232 3200 setup.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3200
-