Analysis
- user interaction
yes - max time kernel
150s - max time network
163s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Set-up.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Set-up.exe
- Size 7.3MB
- Sample260823-ds91eadp8x
- SHA256 4460dd8114b5609ea4e9644a659de0f5b188696d27dc8846d633628b3ade7c31
- MD5 41f159509017d234e08eb4f820bab935
- SHA1 1c27a70f922a95f66f58d8e4b7e91d92c84da6e3
- SHA512 0fdbad1473708fbf1116638195881026caab40a5b64ab31ca25a027af81189bf94af403d5b1c35c5561970adaeef648b8ed5ef8c3ba63b163e931787e82636ab
- SSDEEP 98304:wz16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX025:wz16gBrd3gu/XmDZiF0t5
- TLSH T1F376F94162D58064F1B22675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Set-up.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Set-up.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Set-up.exe = "11001" Set-up.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 956 taskmgr.exe Token: SeSystemProfilePrivilege 956 taskmgr.exe Token: SeCreateGlobalPrivilege 956 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe 956 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 956 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:6032
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3896
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2796