Resubmissions
25/08/2026, 18:13
260825-wt5fesdk7v725/08/2026, 18:03
260825-wm4wbadj8x725/08/2026, 17:56
260825-wh6jcatvdx7Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SINIX_Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
SINIX_Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target SINIX_Setup.exe
- Size 425KB
- Sample260825-wt5fesdk7v
- SHA256 ec2db64c31faaaf10cbf2db48b5bc35265276768e7905a78b3b550fa9f8da3ef
- MD5 0382381886acc220e12c6fbadd11f521
- SHA1 f5eb0bb45ff9a26eddc9fbd80349622951bbd8fb
- SHA512 ebafa2115670b30cb7dbc6112815d69784a7c49c07786589e4cd9d6ffaf72a273fcb4689c60ffacc07e8f4e9d4c2c01acd835a20e1465647cf115a41a5f23b6d
- SSDEEP 6144:F+K9dXyx43Irml9/fU45KNPoZn7URWB9X5kvV/0vdTyeryHbaNUG:FNXyEf97UG9X5Tv4moa7
- TLSH T1D3945D107941D036E5B3087789FE8E7E5A2DBC910B5469CBA3841EFE8F349D0BB3564A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation SINIX_Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation SINIX_Setup.exe - Executes dropped EXE 2 IoCs
pid Process 1692 system_update.exe 2848 system_update.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinixUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SINIX_Setup.exe" SINIX_Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinixUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SINIX_Setup.exe" SINIX_Setup.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Desktop\desktop.ini system_update.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SINIX_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system_update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SINIX_Setup.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3384 taskmgr.exe Token: SeSystemProfilePrivilege 3384 taskmgr.exe Token: SeCreateGlobalPrivilege 3384 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe 3384 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4680 wrote to memory of 1692 4680 SINIX_Setup.exe 88 PID 2516 wrote to memory of 2848 2516 SINIX_Setup.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SINIX_Setup.exe"C:\Users\Admin\AppData\Local\Temp\SINIX_Setup.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\system_update.exe"C:\Users\Admin\AppData\Local\Temp\system_update.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\SINIX_Setup.exeC:\Users\Admin\AppData\Local\Temp\SINIX_Setup.exe1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\system_update.exe"C:\Users\Admin\AppData\Local\Temp\system_update.exe"2⤵
- Executes dropped EXE
PID:2848
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3384
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\system_update.exe
- Size 234KB
- SHA256 710d58f2395cdeed2d9f1f943da0e03a18fe76fd29416fe5c7992f051637046b
- MD5 263aeb8fc6e34a192865fadaadf64d36
- SHA1 b1667c439e6a40c5f352430c1d8fcebe51c34d9d
- SHA512 61ece24965a909b166137888d1402cbdca68e7a688f650e44955175e2d071da14264b7909e56219ceaa9045dc696bb5c5fe36678d40ed9af5b67dbae2f6ae3e2
- SSDEEP 3072:BTK78/wbOqEL1UTdVYcHtxYAQBTRGu55kvJH+u+80vKALfI6qE2C0jeEb60kQBcP:xZn7URWB9X5kvV/0vdTyeryHba
- TLSH T1E3346C107951D436E9B3087789FE4E6E9A2DAC81075469CBA3841DFECF349E0BB3560A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\LISEZ_MOI.txt
- Size 69B
- SHA256 515dcaa1015c82afe2c38c68a378964755e54defa92108c9bb85e781a990c1fb
- MD5 0adb81ccd5ef04a95651739740c9dbf5
- SHA1 ef92ffe38de7921a0b94bd4384e58ee07b66dfea
- SHA512 3bbbdc8319376c0e3b72e3121bab78321d96966675066b991d3c88293fb3a6f058729291a482434596cfb92c3a61cad92e5c03cb0a05f1235fa26e8a7c95563e
- TLSH T11AA022CCA3C082003C3388B0020003E0800CACCC8C08C302C30CC02000033E0A20320F
- MD5 SHA1 SHA512 TLSH