Overview

overview

7

Static

static

3

setup.exe

windows10-2004-x64

7

setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 01:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 1.9MB
  • Sample260910-b25qyavzhy
  • SHA256 38ceec01237633116d28ad993ae3e7d2fcd9a1c9f91a471b739e7fbcb4d430fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\is-DBU4V.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DBU4V.tmp\setup.tmp" /SL5="$801CC,1668373,53248,C:\Users\Admin\AppData\Local\Temp\setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Users\Admin\AppData\Roaming\Sniper Elite\Uninstall\unins000.exe
        "C:\Users\Admin\AppData\Roaming\Sniper Elite\Uninstall\unins000.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
          "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Roaming\Sniper Elite\Uninstall\unins000.exe" /FIRSTPHASEWND=$501C8 /VERYSILENT
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:2524
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1272

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        setup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-DBU4V.tmp\setup.tmp
        • Size 893KB
        • SHA256 262525579265f50b8f46f13e13a73aa75ebb01c77bda61450ac57993aa451f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _shfoldr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-GG8K8.tmp\_isetup\_shfoldr.dll
        • Size 22KB
        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BGImage1.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\BGImage1.png
        • Size 357KB
        • SHA256 0212eb9788e0ceeb7f6e7956e10ad79e12932e07f63106bf11aca08f995c16ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BGImage2.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\BGImage2.png
        • Size 21KB
        • SHA256 ad16b9d4572cf1da8edbb23562fab787a1c62fdbd5a6d8d6aa0785ebfdf0d1c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Button1.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\Button1.png
        • Size 9KB
        • SHA256 19de14f39dcf61101e08b6c80a4eaaab123ce403655339726e2b3df5503cb1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Button2.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\Button2.png
        • Size 25KB
        • SHA256 ed98bebbff88e986a5a19e1041551d15144cbc20526db2f12e95dc133b42b27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Button3.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\Button3.png
        • Size 5KB
        • SHA256 4300e55a0e51dab2f9ddd0a15d037b62bea53b4f79adfc0716ba0c64a471f82b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FLRImage1.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\FLRImage1.png
        • Size 2KB
        • SHA256 6876d5c5bbbbc804e2188853bb37bc6e2aa2e93203f01fed5234044a915dff5a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ISDone.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\ISDone.dll
        • Size 446KB
        • SHA256 b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LSTImage1.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\LSTImage1.bmp
        • Size 937KB
        • SHA256 ebd4658332c20aed45a1f161ddab8d6755892ba5cdfc4cf68e8b46ef2fc866ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Progress1.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\Progress1.png
        • Size 4KB
        • SHA256 cb3d6f226fdd91809b2fc3cea78cd017e6ac3d803b9b10b216e2c2ef8b2e49ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDWImage1.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage1.png
        • Size 1KB
        • SHA256 f66e5246e3d04d55d611e96260fbe88aa5be5ea39b2d7c61a493ea0ca5748c62
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage10.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage10.png
        • Size 2KB
        • SHA256 4512aac6cba173f582a7351e21aafe8216135303191709fb264822407168041c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage11.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage11.png
        • Size 1KB
        • SHA256 7713d4446d7326b0c751eb7e662ae9057c923efe72814448a80efa5e471acfc1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage12.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage12.png
        • Size 2KB
        • SHA256 f6c62481bb6c87aa45a2578de7e677288b8c70eeeca5aa15935a9354ee4c73af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage2.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage2.png
        • Size 3KB
        • SHA256 abf73885d9b1bae9567fd5751417033acfd11a9b245521870183e17f0ae04e89
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage3.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage3.png
        • Size 1KB
        • SHA256 9cc277f3cc8a2ea83abb5b47343e798c34b650bb57cbd44934821e7932869313
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage4.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage4.png
        • Size 1KB
        • SHA256 0e80146e8f855dcaa5e98776c3c38df6c0e8fd64965fd3fe765b38954d5d0276
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage5.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage5.png
        • Size 2KB
        • SHA256 eac59ca2e68d44f2ce9c54c5ff0ae418f756f013f5b5f646f28c054e6ea7cd8c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage6.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage6.png
        • Size 2KB
        • SHA256 ecc8fca0df2c09072b95282120761acf5ccf488cfd6fbfe95f81e2ed2e686315
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage7.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage7.png
        • Size 2KB
        • SHA256 d723ef4a90413558c35c9d862fba1feebfb30da9d575dbc3dbd8b8fe63d46907
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage8.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage8.png
        • Size 2KB
        • SHA256 0a7b552be8d1341b73f45dd49fd81912623504a355ee7848ec2eeed2d607ebd7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SDWImage9.png
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\SDWImage9.png
        • Size 1KB
        • SHA256 1c1bb4546e59e2953bbd831b16746d24aaef607b4167e173d03b46df3c94bd63
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        botva2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-LVUV6.tmp\botva2.dll
        • Size 37KB
        • SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unins000.dat
        • Path C:\Users\Admin\AppData\Roaming\Sniper Elite\Uninstall\unins000.dat
        • Size 72KB
        • SHA256 9878c395c4fe9c54d3d1f521d4aa1eb47f943e6fe7039d1ac649f9d53b658ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unins000.exe
        • Path C:\Users\Admin\AppData\Roaming\Sniper Elite\Uninstall\unins000.exe
        • Size 903KB
        • SHA256 b33f1c657dbd9d9c15374e309a17186c3e504b08e33345b5a24175c9f39d0dee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2252-184-0x00000000132B0000-0x0000000013326000-memory.dmp
        Download

        memory/2252-7-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-154-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-155-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-250-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-157-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-185-0x00000000145A0000-0x00000000145AF000-memory.dmp
        Download

        memory/2252-166-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-168-0x00000000145A0000-0x00000000145AF000-memory.dmp
        Download

        memory/2252-167-0x00000000132B0000-0x0000000013326000-memory.dmp
        Download

        memory/2252-13-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-181-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-229-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-207-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/2252-231-0x00000000145A0000-0x00000000145AF000-memory.dmp
        Download

        memory/2252-47-0x00000000145A0000-0x00000000145AF000-memory.dmp
        Download

        memory/2252-18-0x00000000132B0000-0x0000000013326000-memory.dmp
        Download

        memory/2252-230-0x00000000132B0000-0x0000000013326000-memory.dmp
        Download

        memory/2524-232-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/4220-227-0x0000000000400000-0x00000000004F2000-memory.dmp
        Download

        memory/4388-0-0x000000000040D000-0x000000000040E000-memory.dmp
        Download

        memory/4388-1-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4388-156-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4388-251-0x0000000000400000-0x0000000000414000-memory.dmp
        Download