Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 18:24
General
- Target Shift - PDF_x8j60o.exe
- Size 8.6MB
- Sample260826-w2fr2avanh
- SHA256 5f123a9b77fffd5152f1046e1bce961e83f88ea4842c5065f4896432e4828a1e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x8j60o.exe"C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x8j60o.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RRVQ5.tmp\Shift - PDF_x8j60o.tmp"C:\Users\Admin\AppData\Local\Temp\is-RRVQ5.tmp\Shift - PDF_x8j60o.tmp" /SL5="$400B8,7465275,1214464,C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x8j60o.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
is-VIO6T.tmp
Shift - PDF_x8j60o.tmp
Win32Library.dll
_is7z.dll
checkmark-11-light.png
en.json
min-pressed.bmp
shift-pdf.png
shift.png
memory/704-98-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-107-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/704-30-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-28-0x0000000075530000-0x0000000075544000-memory.dmp
memory/704-27-0x0000000007690000-0x00000000076A4000-memory.dmp
memory/704-23-0x0000000073D02000-0x0000000073D03000-memory.dmp
memory/704-20-0x0000000004530000-0x0000000004540000-memory.dmp
memory/704-91-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-92-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-93-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-94-0x0000000073CF0000-0x00000000744AC000-memory.dmp
memory/704-95-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-96-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-101-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-100-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-254-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-99-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-97-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-104-0x0000000073CF0000-0x00000000744AC000-memory.dmp
memory/704-252-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-106-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-32-0x00000000098E0000-0x0000000009972000-memory.dmp
memory/704-111-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-115-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-114-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-110-0x0000000004F60000-0x00000000050A0000-memory.dmp
memory/704-113-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-6-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/704-229-0x0000000004530000-0x0000000004540000-memory.dmp
memory/704-230-0x0000000073D02000-0x0000000073D03000-memory.dmp
memory/704-232-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-234-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-236-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-238-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-240-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-242-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-244-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-246-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-248-0x0000000000150000-0x0000000000547000-memory.dmp
memory/704-250-0x0000000000150000-0x0000000000547000-memory.dmp
memory/4104-105-0x0000000000710000-0x0000000000848000-memory.dmp
memory/4104-0-0x0000000000710000-0x0000000000848000-memory.dmp