320511bd6b44879e921b0c5d48c2092a55ae531a2150365a8b3427a60454893e

Analysis

max time kernel
53s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProjectLightningInstaller-v5.exe
Size 372.6MB
Sample260828-qldd3sda82
SHA256 320511bd6b44879e921b0c5d48c2092a55ae531a2150365a8b3427a60454893e
MD5 265ef51310825769a484a39300d5918e
SHA1 9b5317410d3bd08bea221b2d4667d6f1e2455c54
SHA512 96bda390c11d6fedea5daf787a30cd1ad20a7beefff63eb9dc4c1d1fd59234a2bf674b1a88d352baf7ddf5d7a5ac91e7447e212d74d854d204c18e5620a08ea8
SSDEEP 6291456:chO1yQGK/jRPWJmqSnL+TkXmqpDsgqCzSnNfacNZnObsHZj/KwAPLp0RlyQ:chqyQGK/jNLOqpgg5WnNf97n6sd/fEOr
TLSH
T1F0193335D495AB3CF0265A330AFBE9834B7EA501691D4A5606F4013C8F2A1B6CF7F74A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5684	ProjectLightningInstaller-v5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller-v5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller-v5.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2656-0-0x0000000000990000-0x0000000000A6D000-memory.dmp	innosetup
behavioral2/memory/2656-10-0x0000000000990000-0x0000000000A6D000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5684	ProjectLightningInstaller-v5.tmp
5684	ProjectLightningInstaller-v5.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5684	ProjectLightningInstaller-v5.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5684	ProjectLightningInstaller-v5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 5684	2656	ProjectLightningInstaller-v5.exe	86

C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe
"C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\is-3Q82DNO36D.tmp\ProjectLightningInstaller-v5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3Q82DNO36D.tmp\ProjectLightningInstaller-v5.tmp" /SL5="$502D4,389157392,842240,C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProjectLightningInstaller-v5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3Q82DNO36D.tmp\ProjectLightningInstaller-v5.tmp
Size 4.2MB
SHA256 390f4167a970e3992e0d61bd419a00f693ec514d043ba01e26ededeb0fe88087
MD5 92d9076bdfa8879e6638aa42bbb9cad5
SHA1 96ba2d31bea1ec2113d95dbd8e60cc82e710744c
SHA512 e29426e20308d43d59ebb489e17ce44e2aa40c87d4545599e3ad603fa4d92f1e8ec238422492bc7fb7830cdee2253a35faa3d46b0c3c73f349f98660369ea19c
SSDEEP 49152:d3yGw7V2h9z2lqSvM0/WtmueejA0JuDeT4q3ZCNW7Iu9ReR9nc4NDR5mo4333lwr:ds7Y8/7ueejA0JuDeT4eZyuaNHm13334
TLSH
T1AC267C13B389613FD06A2B3A7837A254993F76703916CDDB6BF41A4C8E351807D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-XM1R1XH52P.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\is-XM1R1XH52P.tmp
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

is-06U66VLW97.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-06U66VLW97.tmp
Size 219B
SHA256 68843541e7bf5b3ba766d3cbaf26c8f4ab7c9d090ba746feff32b9d35ce25417
MD5 2d4f76db6175ff5f7f28f0d923a66654
SHA1 123d7c009f8e0cc29ac86e971ba15b782d65a51e
SHA512 f56a47f7bc60e04136f70ae848e31421b839453fdb01dfd0303a06256ebfb0955a16720cf84a3d35ab0e3fdc90323e97282daa36430e568e283b10990f76766a
TLSH
T1D1D002C7B70D65D43D57743CC7C604D1958DA03501F0905AB7EE862DF4C640888B132D
MD5 SHA1 SHA512 TLSH

Submit Download

is-X10YCM0SYN.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-X10YCM0SYN.tmp
Size 219B
SHA256 a18fcc24552c8abcee4cc9e324056971dc92e06208d33ca5e2f01495a910d6a5
MD5 03cacdf6a68cebc65d28bd6bbb462b34
SHA1 94a75b98100a70f06a562598800bc2d88a1cbfdf
SHA512 1c932a5155f25051fc0ac473a197bb89c988907f2012f8c6782e798dce13a977eeb12f421dfbc96ef5b5e51934da07f7c0eb13d44c6e4b852cbb347b33a2dd63
TLSH
T123D002D7B70D54D43953603CC7C644D0958D913501F1909AF3EA863DF4CA41884F132D
MD5 SHA1 SHA512 TLSH

Submit Download

is-LCY08ODSQS.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\pip-26.2.dist-info\licenses\src\pip\_vendor\packaging\is-LCY08ODSQS.tmp
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-Z49OFJCUVI.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\pip-26.2.dist-info\licenses\src\pip\_vendor\tomli\is-Z49OFJCUVI.tmp
Size 1KB
SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
MD5 aaaaf0879d17df0110d1aa8c8c9f46f5
SHA1 9da6ca26337a886fb3e8d30efd4aeda623dc9ade
SHA512 eecd0c29febf51adefb02f970e66efe7e24d573686dfdb3beea63cefea012a79ce3c49a899b4f26e9b67dc27176b397f6041909227281f9866beedc97389095c
TLSH
T11411755E725147B618AB13605978ACD9F23BB25F7A6F2A84246DF345233A06CC6FF840
MD5 SHA1 SHA512 TLSH

Submit Download

is-MK8DDJELEZ.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\playwright-1.62.0.dist-info\is-MK8DDJELEZ.tmp
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

is-J834XFOPNY.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\playwright\driver\package\lib\vite\traceViewer\is-J834XFOPNY.tmp
Size 78KB
SHA256 0f1d5219934e96e83b8db162d60b4d8c09b5de1e7d38031cbafe4a3c0f2889c9
MD5 cb7f0a51c106a33fb4abab8c454373d8
SHA1 e7c7d0f0e86371aa5e93a0200f395c5d37967e2e
SHA512 377e45744f8a7dcf4f706df9f6e420c2504180107a0f31c584ee220ebfe5a33889f0d4c6d58f1ef3dac4bd391de11ab383c64d4e3a8b9f8637d9cd6cb7d3cd4d
SSDEEP 1536:vMFZ2CRbK0INA8nc3sMVUdrulGhHjOuYWibNuuwzSf0WUZ1eB:vMf2CRbXGRc8MVUZ4uobAzSf0gB
TLSH
T136739D06D389DF2BE393CA7D4C65935B42A1844977DB1F43AA3D7EA4D4A2BC90CA43C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-BQMCX36ATE.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Scripts\is-BQMCX36ATE.tmp
Size 105KB
SHA256 a896f1cfa736f092873a2af32f540bccfef6ae715b41ae9eceba46a831ee4ed1
MD5 86f9c8d583f5857b2a77a1289ef705ca
SHA1 81d8a3176396bb25b36b299a1bee2785013bff22
SHA512 eb41322e4b5d4c67d221da8e535b8ae011a8d0131bfd17a89267efd1446e78fce4075ba56a4774721f5ab94e8fc63e25e10be34726870a71f884f605734306f9
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GIC:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+lC
TLSH
T18CB36A0A33D420FDD0675274CDB68A15D3B2BC2A4274934F27A47B6A1F733926D2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-579FNPNBNK.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium-1234\chrome-win64\locales\is-579FNPNBNK.tmp
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

is-EP73J9OV2O.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\is-EP73J9OV2O.tmp
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

is-WTG4CJ0S1S.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\is-WTG4CJ0S1S.tmp
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

is-YUEDV1C3W9.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\is-YUEDV1C3W9.tmp
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-JMO47F5DQ9.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\is-JMO47F5DQ9.tmp
Size 449KB
SHA256 ffe0c645274d73c10a0d60d2c53c9b928151d828d211253b10ea6807c96f9ae8
MD5 2a3178158622d30c1e84cae4e7e57cd8
SHA1 920c5df8b4bae44b41c3cecacc00324db18d37f2
SHA512 c1f053daa0fad251380c6b9536519ccd351e6bae97dc8f1c79ba26f15f5a55159a2180130693a7b39e41de2419a5120a636e759415a926907d9e2f4c07b99f03
SSDEEP 6144:Z+cJPab9TfpocD588jeei3Cap5651zs4bcFlyfJ2X+O:KicD5/eeap5651zs8cFlya+
TLSH
T197A47D05B7D548BCD077C1388A538647EBB178560B61EAEF03A0E2792F77BE41A7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-10-0x0000000000990000-0x0000000000A6D000-memory.dmp

Download

memory/2656-0-0x0000000000990000-0x0000000000A6D000-memory.dmp

Download

memory/5684-4252-0x00000000004F0000-0x000000000095A000-memory.dmp

Download

memory/5684-3926-0x00000000004F0000-0x000000000095A000-memory.dmp

Download

memory/5684-1314-0x00000000004F0000-0x000000000095A000-memory.dmp

Download

memory/5684-11-0x00000000004F0000-0x000000000095A000-memory.dmp

Download

memory/5684-12-0x00000000014F0000-0x00000000014F1000-memory.dmp

Download

memory/5684-4992-0x00000000004F0000-0x000000000095A000-memory.dmp

Download

memory/5684-5-0x00000000014F0000-0x00000000014F1000-memory.dmp

Download