Analysis
- max time kernel
601s - max time network
441s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 11:42
General
- Target Kaspersky Internet Security 2016 v16.0.0.614 Build 8529 [TechTools.NET]/offline KIS16.0.0.614en-US.exe
- Size 166.5MB
- Sample260905-nt53yszzfs
- SHA256 c6a1cd5d5e3b9ae7a97b2d778db224ba3a854509ee0133a45ddae971fe36bd2c
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaspersky Internet Security 2016 v16.0.0.614 Build 8529 [TechTools.NET]\offline KIS16.0.0.614en-US.exe"C:\Users\Admin\AppData\Local\Temp\Kaspersky Internet Security 2016 v16.0.0.614 Build 8529 [TechTools.NET]\offline KIS16.0.0.614en-US.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\pcaui.exe"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {6474097c-d029-42e3-9019-a58c7692f1b6} -a "Kaspersky Internet Security" -v "Kaspersky" -s "Your PC requires the latest version of this app. Click Learn More for information on how to update this app." -n 2 -f 2166256 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\Kaspersky Internet Security 2016 v16.0.0.614 Build 8529 [TechTools.NET]\offline KIS16.0.0.614en-US.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵