Analysis
- user interaction
yes - max time kernel
95s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 00:48
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target setup.exe
- Size 958KB
- Sample260905-a5w3jabb45
- SHA256 7c8aa85cac8406d1e6c27bbde98421b8c88a9a5dcaf3dac12ad2e330a2965a0f
- MD5 4dcd5fa5b1004001dbf3eb63f920ef7c
- SHA1 66b364da8b628e462c82fc967f33c008634c430b
- SHA512 c665cb26bf00186b5447670e2611f94025baa72b4dbc88033ad27a99b4b8e8a73e68adf60ae22f3239c820c9e7302c67e05460ff655b21015e158ecb02c5f530
- SSDEEP 24576:MMjhXH0dGhPDdjfbAZfngywbVcJQY1aXE68muNZ:vt0cAfn7wh0QIaUrZ
- TLSH T10C251302F3C34432F46405799C56D1AC6C23BA792AE594662EF8CB4F09BD2C359BBB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2972-0-0x0000000000400000-0x000000000042D000-memory.dmp innosetup behavioral2/memory/2972-3-0x0000000000400000-0x000000000042D000-memory.dmp innosetup behavioral2/memory/2972-4-0x0000000000400000-0x000000000042D000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 648 taskmgr.exe Token: SeSystemProfilePrivilege 648 taskmgr.exe Token: SeCreateGlobalPrivilege 648 taskmgr.exe Token: 33 648 taskmgr.exe Token: SeIncBasePriorityPrivilege 648 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe 648 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2972
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:648
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4668
-
C:\Windows\System32\xvdcp7.exe"C:\Windows\System32\xvdcp7.exe"1⤵PID:4840