73801e22e75b398e9c2bdee96d7b5b1c29761dcbd1350b795a9e9f341c874167

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SetupPoker.exe
Size 982KB
Sample260825-pg4j2asakc
SHA256 73801e22e75b398e9c2bdee96d7b5b1c29761dcbd1350b795a9e9f341c874167
MD5 c8a2c488c9881fc81366ba23265c19a7
SHA1 2319ac8db7ea0b09503adca5d34d67408ef48143
SHA512 856632ad2028437175489901e0bb30cafce22fd19a26cdf1af3a56cc32d2c79ed338ead283e89b6dcc33432df86eab138bd24efdd91ed7b788037bc34c4f9872
SSDEEP 12288:i1hKBS3HvxcduLSrzELRTg/mvdp1LF5vX4h40/JmkoiZDtSwE2gReIj9Bgu:kGS3vxcEDTnlpRF2FJmtyJSw/EbpBgu
TLSH
T11C256B607282E03BE6B201715A6C9AFA103BFF640F65A1DB57C57B6E1A705C24E31F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5588	3632	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupPoker.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	SetupPoker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	SetupPoker.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	SetupPoker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	SetupPoker.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	SetupPoker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	SetupPoker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	SetupPoker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	SetupPoker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	SetupPoker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	SetupPoker.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3632	SetupPoker.exe
3632	SetupPoker.exe
3632	SetupPoker.exe
3632	SetupPoker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3632	SetupPoker.exe
3632	SetupPoker.exe

C:\Users\Admin\AppData\Local\Temp\SetupPoker.exe
"C:\Users\Admin\AppData\Local\Temp\SetupPoker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 2748
  2⤵
  - Program crash
  PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3632 -ip 3632
1⤵
PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Installer_3632.log

Path C:\Users\Admin\AppData\Local\Temp\Installer_41354001EA8A4FDF94294C128290DE4C\Installer_3632.log
Size 6KB
SHA256 4fa5007923bb3453fb8e541fdbb9a5b0cf5e8df3028c1bfd72f162708bef49a4
MD5 8876dd1c94742c462fd8db52c42c97e2
SHA1 395d055f135d8b3ea11b6b16c89a85e75ac92b4c
SHA512 114231a4a35fd445c65b0ad214315bf22ce66b478f0f36dc47ea09830a18fc8999bb327d1e8a4bc6117adb4ff4b47da375c41bcd8cae206ba567c0f499a638ab
SSDEEP 96:bGGPmYfNxG8jPMYk/D+GsumxGzPHTq8gCHf/fLjNfL4m0vRxGls3+LgCSVroPM/N:aXjT3gEfLjNfLNgaMvQA5
TLSH
T1B1D190798446D1F9459414BFA068CFC6336444AFEA74EB68FF2B01C0B4EEB918B6E4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\Installer_41354001EA8A4FDF94294C128290DE4C\index.html
Size 451KB
SHA256 fa1191055aad65c2f7f3f21badd3e71174ec1f7ce555501ec328e892d1731866
MD5 84a41870e0616b1bf9549b8c7307a8e0
SHA1 10a91122d8591c56a8649b7f1f40bf1e578ae192
SHA512 774cb599151270abe19861311f6ef434b7cd16f4c8837727ac139a96c7aa098c7aff7a4ca3985e0f636fc8520672236da4725ffa147e8a1be792b0db4f0fe47f
SSDEEP 12288:fKTXjLKxPNOAgL6opPSv6UqcU6/MNKh+tp4P:fKTXjLKxPNOAgL6opPSiUvh+tK
TLSH
T183A46C4EB292A9376BE3121A005B25617133A4536D098424FBDDE89D1FBEB0D5233B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download