Overview
overview
7Static
static
3Acrobat/Ac...ll.exe
windows10-2004-x64
7DirectX9/DSETUP.dll
windows10-2004-x64
4dimap.dll
windows10-2004-x64
3dinput.dll
windows10-2004-x64
3dinput8.dll
windows10-2004-x64
3dmband.dll
windows10-2004-x64
3dmcompos.dll
windows10-2004-x64
3dmime.dll
windows10-2004-x64
3dmloader.dll
windows10-2004-x64
3dmscript.dll
windows10-2004-x64
3dmstyle.dll
windows10-2004-x64
3dmsynth.dll
windows10-2004-x64
3dmusic.dll
windows10-2004-x64
3dmusic16.dll
windows10-2004-x64
1DirectX9/dsetup32.dll
windows10-2004-x64
4amstream.dll
windows10-2004-x64
3d3d8.dll
windows10-2004-x64
3d3d8thk.dll
windows10-2004-x64
3d3d8thk.dll
windows10-2004-x64
3d3d9.dll
windows10-2004-x64
3d3dim.dll
windows10-2004-x64
3d3dim.dll
windows10-2004-x64
3d3dim700.dll
windows10-2004-x64
3d3dpmesh.dll
windows10-2004-x64
3d3dpmesh.dll
windows10-2004-x64
3d3dramp.dll
windows10-2004-x64
3d3dramp.dll
windows10-2004-x64
3DirectX9/dxsetup.exe
windows10-2004-x64
4DirectX9/m...st.msi
windows10-2004-x64
6Help/Game Help.pdf
windows10-2004-x64
3Setup.exe
windows10-2004-x64
7autorun.exe
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 13:00
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Acrobat/AcroReader51_ENU_full.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
DirectX9/DSETUP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
dimap.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
dinput.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
dinput8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
dmband.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
dmcompos.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
dmime.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
dmloader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
dmscript.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
dmstyle.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
dmsynth.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
dmusic.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
dmusic16.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
DirectX9/dsetup32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
amstream.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
d3d8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
d3d8thk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
d3d8thk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
d3d9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
d3dim.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
d3dim.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
d3dim700.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
d3dpmesh.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
d3dpmesh.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
d3dramp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
d3dramp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
DirectX9/dxsetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
DirectX9/mdxredist.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral30
Sample
Help/Game Help.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
autorun.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Setup.exe
- Size 164KB
- Sample260907-p8nb5avygx
- SHA256 fe95a9fc8b2cdb5add76fbd326b1a11801eaa43c7d908f20cbdf413fd4d8dfde
- MD5 fb6674a519505cc93e28cf600bbc23a3
- SHA1 d5dbd3dabc4872710d5bdabfb3829f976efe92c6
- SHA512 fd4e93d545a704bbc197bcbfd1731c24fffff7aa05db11ed4ad9bcac458253b8fb368d13e48df3d3d322044f4d4cc9e134c24cc7bee4079110f591623e988912
- SSDEEP 3072:SMssQNxJUJTp2E+qvFuIoF1PYUGQQEKGLY+q+XrNJd2/GP+oh:9QOpkpNJ
- TLSH T1B4F3FC116BFA8625FAF36F71FCB816910A7BBD56AE38C60E1300555D1C70A94DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4164 IKernel.exe 3040 IKernel.exe 2288 iKernel.exe - Loads dropped DLL 22 IoCs
pid Process 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 64 Setup.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe 3040 IKernel.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor8f89.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuse8fe7.rra IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000 Setup.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\core8f79.rra IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\obje8fd7.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\IScript\iscr9025.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe Setup.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\corecomp.ini IKernel.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKernel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKernel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iKernel.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC3-B5F0-11D2-80B9-00104B1F6CEA}\ = "ISetupComponent" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{251753FA-FB3B-11D2-8842-00C04F72F303}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupLogDB" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\ = "ISetupFileService" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94F4A332-A2AE-11D3-8378-00C04F59FBE9}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{251753FA-FB3B-11D2-8842-00C04F72F303} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80FDE82A-2CAA-11D3-88C3-00C04F72F303} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}\1.0\FLAGS IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" iKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEBEC920-1849-11D3-A8FE-00105A088FAC}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.User.1\CLSID\ = "{C9CD1A93-D7B4-11D2-80C5-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\ = "ISetupBasicFeature" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303}\ = "ISetupFilesCost" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C8D0880-1AC4-11D3-A8FF-00105A088FAC}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF8B49D-16D0-49A5-B133-ABE7DCC23DAF}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}\ = "ISetupReboot2" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4AAC3B1-C547-11D3-B289-00C04F59FBE9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDE94BF2-4FB9-11D5-ABAB-00B0D02332EB}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC5-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067DBAA0-38DF-11D3-BBB7-00105A1F0D68}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\ = "ISetupFileErrors" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80FDE82A-2CAA-11D3-88C3-00C04F72F303}\ = "ISetupObjectReboot" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF8B49D-16D0-49A5-B133-ABE7DCC23DAF} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF8B49D-16D0-49A5-B133-ABE7DCC23DAF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B14-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2583251F-0A04-11D3-886B-00C04F72F303}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DFB7010-41EB-11D3-BBBA-00105A1F0D68}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EDC2C10-66FE-11D3-A90F-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFED5DD0-0694-11D4-A934-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC3-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8c3c1b17-e59d-11d2-b40b-00a024b9dddd} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\ = "ISetupObjectContext" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\ = "ISetupFileErrors" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDF8B49D-16D0-49A5-B133-ABE7DCC23DAF}\ = "ISetupProgress2" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27D2CF3C-D5B0-11D2-8094-00104B1F9838}\1.0\HELPDIR IKernel.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 64 wrote to memory of 4164 64 Setup.exe 85 PID 3040 wrote to memory of 2288 3040 IKernel.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4164
-
-
C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exeC:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2288
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini
- Size 27KB
- SHA256 5214789c08ee573e904990dcd29e9e03aaf5cf12e86fae368005fd8f4e371bd5
- MD5 62d5f9827d867eb3e4ab9e6b338348a1
- SHA1 828e72f9c845b1c0865badaef40d63fb36447293
- SHA512 b38bb74dc2e528c2a58a7d14a07bd1ecaaf55168b53afc8f4718f3bf5d6f8c8b922b98551a355ebb1009f23cff02fd8596413468993a43756c4de7dfed573732
- SSDEEP 384:2ERJ48bJNafWlc/n++TOa2SZ4+CIPo2S4m:2ER3JNaM+MJIPo27m
- TLSH T1F0D2211A552A1ED5EAB8328D3C907C8C74CCF1610AF2F6A7C4FE748649B745C2E6242F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
- Size 600KB
- SHA256 985eb55ecb750da812876b8569d5f1999a30a24bcc54f9bab4d3fc44dfedb931
- MD5 b3fd01873bd5fd163ab465779271c58f
- SHA1 e1ff9981a09ab025d69ac891bfc931a776294d4d
- SHA512 6674ab1d65da9892b7dd2fd37f300e087f58239262d44505b53379c676fd16da5443d2292aeaae01d3e6c40960b12f9cac651418c827d2a33c29a6cdf874be43
- SSDEEP 6144:cTqa+rypBCk+Fx7/BCttXXikQklSn8nbFpBJkCcjalJ/M6HnpJpaijgBwTFg56lX:fr/SlSBUJjnNRjpTWamB4
- TLSH T178D46C267EB5D437C2228071CF688BD4EAE5EEA54D7209473B88371C1E71D46C727A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
- Size 76KB
- SHA256 590be865ddf8c8d0431d8f92aa3948cc3c1685fd0649d607776b81cd1e267d0a
- MD5 003a6c011aac993bcde8c860988ce49b
- SHA1 6d39d650dfa5ded45c4e0cb17b986893061104a7
- SHA512 032aba4403eb45646aa1413fdc6c5d08baab4d0306d20b4209e70c84e47f6b72e68457bbc4331a5f1a5fa44aa776a89eb9fd29d0d956fa2fe11364c26ab09ee7
- SSDEEP 768:uj5UUtenZewInMM66FwMd21I1FNVBt3NogjISsK7phsfTkF0kN1usI5FrAg1OBoM:Q5PI9F6SCdNoe57phsgW7Ag8lj
- TLSH T1327306327783C173D24212B1ADAAE6D9AF65BE475EE502073E637B8F3C31B14C859642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
- Size 172KB
- SHA256 8efcbd8752d8bbfd7ee559502d1aa28134c9bf391bf7fc5ce6fdfd4473599afb
- MD5 377765fd4de3912c0f814ee9f182feda
- SHA1 a0ab6a28f4ba057d5eae5c223420eb599cd4d3b1
- SHA512 31befb11715f78043b7684287b4086ce003cb66f97c6eff8c2b438eae29045d8856172c6b898be9f08c139edc4647c2bce000da497aed208b7a5a69d4d90c710
- SSDEEP 3072:r+qN/OeBOZOptEHrOM/JUb1pZHYJvY6zsB7qAJy/Km1kUpbVxgr:5/bPtQxJUb1pdGQ6z73vzpbV6r
- TLSH T1B1047B3137A1C471C1A5017E6E158BEAEFABFD628EA409433F54374DBCB2A51CD3A246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
- Size 32KB
- SHA256 32c6ad91dc66bc12e1273b1e13eb7a15d6e8f63b93447909ca2163dd21b22998
- MD5 8f02b204853939f8aefe6b07b283be9a
- SHA1 c161b9374e67d5fa3066ea03fc861cc0023eb3cc
- SHA512 8df23b7d80a4dd32c484ca3bd1922e11938d7ecda9fc5fd5045eed882054efca7b7131ea109c4f20d8279845ffeb50ef46fb7419d190b8cf307eb00168746e59
- SSDEEP 192:Ec9t9ShCx1JQ5BoQZgTWPLnOBog5MOSiYp7e9MCMWnaaAyqX:EAxoVgTNk9sM9pE
- TLSH T1A2E25412EFA695B6F6C540703D772577252D2C3018E5D027EBC6DC4E287E2A3496EB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
- Size 220KB
- SHA256 4f77a9018b6b0d41151366e9acab3397416d114fc895703deb82b20f40116ad1
- MD5 b2f7e6dc7e4aae3147fbfc74a2ddb365
- SHA1 716301112706e93f85977d79f0e8f18f17fb32a7
- SHA512 e6ae396bd9b4f069b5fafe135c0f83718cc236d1cf9007db7305bd5442c86483c0f1e0fad9cd6d547e8715278e23e6fafa973c63ebbe998a31a2153dbbbe7f83
- SSDEEP 6144:v4cBIsIikn+3HUYzZ2HWrXzXdgASLB2X4X:v4cBI5X+kkkqjXdpX
- TLSH T1B8246D2139B8C539C39E0B31EF666FB4F6F9DE544EE1484B1F582E1C9D35A48C52212E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CFDE6C3B-6571-48CA-A1B4-B53F7A7CEE93}\_IsRes.dll
- Size 256KB
- SHA256 01f7fa67b094181a1924163031c88ace5ef7e5bf275a0ee423b33d52548a6c32
- MD5 e5fae47fe690a374a3ed13b1dbc0d4f2
- SHA1 1517cb38d317038c774a5d973c65c26b1b868b82
- SHA512 f1df57d364530400562e6550c42b5cddb290d5d0651c45626ea2edcb3128808029d120612ba6470b59746938d6a98f91d39dca34946d6a5b698707504bd5846c
- SSDEEP 3072:rXRZKGskkkkknffCp5CrRb9YfMX0E9QsJB9cWe7Ka2cJDd1:rhbskkkkknffCp5CrRKlua9
- TLSH T16344830BE52AC14FF55CC23489A21EE657E57E54A72505F2FEAF7A1C20382707E16E0E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CFDE6C3B-6571-48CA-A1B4-B53F7A7CEE93}\_IsUser.dll
- Size 1003KB
- SHA256 dd846f0c537805a50b92938b74414f1fd6543af69a22cd17657ff6e901a21e66
- MD5 be626e25a67c45bb09ed4a9a8346a2b5
- SHA1 7081b72c5a461da519a02f34607cc6537432feb2
- SHA512 95a90215c9a828ca86dd3a2e35ccb0a962a6494f29267c69d7bff81718ad89e8d852ac60cec12b1d28fdb2813d724148107c8788012b46e33b81a857f8d42fc1
- SSDEEP 12288:4Q5bktnjo36sHI2lgvmWCFVAMN8dBiZAnSQkXO5MKFXyFU1Xo9RybRQDtE583UWg:4LjoKbHmWQAMwYeMSVAybRU86UW
- TLSH T10825D0599463B95BDC10A176341EE2901E766E42DCCD8EBB32E6BF8B5834CF425E0C93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CFDE6C3B-6571-48CA-A1B4-B53F7A7CEE93}\isrt.dll
- Size 324KB
- SHA256 148d8f53bba9a8d5558b192fb4919a5b0d9cb7fd9f8e481660f8667de4e89b66
- MD5 61c056d2df7ab769d6fd801869b828a9
- SHA1 4213d0395692fa4181483ffb04eef4bda22cceee
- SHA512 a2da2558c44e80973badc2e5f283cec254a12dfbcc66c352c8f394e03b1e50f98551303eab6f7995ac4afd5a503bd29b690d778b0526233efc781695ed9e9172
- SSDEEP 6144:KzbdBEFj2WevDaaf4SUANAV+sckpp/+oZO2qwZ1YN3jWo5KDjr73rgE0:oBEAH33AVnpRoO1pWK/PbgE
- TLSH T1A9647E137AF5C57AC68B4230FB285FA8B6FD97551DF0D8835BC40A2C5E37846C226A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CFDE6C3B-6571-48CA-A1B4-B53F7A7CEE93}\issrv.dll
- Size 10KB
- SHA256 a256897013d8bd659c1b3667920cc36453a981f3a7c61514b1cab1f122e75a36
- MD5 fe13cf654249d8599e438987a5cf061f
- SHA1 83f48417701064ebc90886e8f37e7c027e7040bd
- SHA512 cac97aa8fc737ef424b02f1cb03a827bd518633e91f5bea929b8f136882459e6eb89f7724ec6e4d69f7bef218d36f4377de548bc2030779a2c9c06d68829f0d2
- SSDEEP 192:Ef097ndxciaQJOws36MmoOnKAt84FJujh9mbaK4:E897ndxciLO16MmoOnKAt8UJuroP
- TLSH T1EE220932B3D408D9F65343F477F6071B2568ED3003E1B1B50C1B960EB9A8216F16E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CFDE6C3B-6571-48CA-A1B4-B53F7A7CEE93}\setup.inx
- Size 154KB
- SHA256 2be63427cb8ef0d2e9094b64565e61726bb49a06067dd391fc3872d5ac4427c5
- MD5 4c557b7e31517872b264ba30fff37bd1
- SHA1 a0df8cf3069dd5ebee4873ebae70c9aae89ee5dd
- SHA512 5b72fd7643e58a950d347da7218aea1c7f7119558a26e61f804fa95bb5c54e84ba501e1342612f38b7be9c8104e0f308215d6e86ecee971ab8dbdc93cacc4fb4
- SSDEEP 1536:4zUDmYdDA62KgrR8FbHn+MrkG/KtK6F9kb3Bysd8CPatcI2HKWMWDmL7bo6rF1wF:49AfqL7ba
- TLSH T1C9F39B70B4416E0BE37D9B3FC9679573B360B0549F23AB2661AB77386C851272F422B1
- MD5 SHA1 SHA512 SSDEEP TLSH