7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
899s
max time network
431s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260912-3wt6ssxfnd
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2376	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4544	MSBuild.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
404	cmd.exe
3820	cmd.exe
2272	cmd.exe
4048	cmd.exe
4828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\Internal.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\S69biEfPd.ig:Zone.Identifier	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2400	Setup.exe
2400	Setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 404	2400	Setup.exe	80
PID 2400 wrote to memory of 3820	2400	Setup.exe	82
PID 2400 wrote to memory of 2272	2400	Setup.exe	84
PID 2400 wrote to memory of 2376	2400	Setup.exe	86
PID 2376 wrote to memory of 948	2376	forfiles.exe	87
PID 948 wrote to memory of 1948	948	cmd.exe	89
PID 948 wrote to memory of 1236	948	cmd.exe	90
PID 948 wrote to memory of 4048	948	cmd.exe	91
PID 4048 wrote to memory of 3508	4048	cmd.exe	92
PID 4048 wrote to memory of 1488	4048	cmd.exe	93
PID 948 wrote to memory of 1468	948	cmd.exe	94
PID 1468 wrote to memory of 4828	1468	conhost.exe	95
PID 4828 wrote to memory of 2552	4828	cmd.exe	96
PID 4828 wrote to memory of 4544	4828	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2272
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN /m S69biEfPd.ig /c "cmd /c ren @file S69biEfPd.bat && call S69biEfPd.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "S69biEfPd.ig" S69biEfPd.bat && call S69biEfPd.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1948
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:1236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:3508
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:1488
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\S69biEfPd.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\S69biEfPd.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4828
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2552
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

persistent.1789315091.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1789315091.tmp
Size 1KB
SHA256 9d1c62f94bdd1bfdf87bfa6056c2cdf8bbf6fd91bee09d384cf9c994c04017d9
MD5 a304bc7f6a834aaee455e99d24d53929
SHA1 c22ba85753f12c54dcd070c4cd4f7eb36a41a30a
SHA512 797230c3400cc5667868704e870b49713d374f372bef6613b959e459e1633cda826e2369f31d407aa0d8e33c9d3684ef3ff22deee88ced17d85ca20070be549b
TLSH
T16531EA1DCC6A97B1AD63295C4281466B0E1E0FB645515D59D41CC2958C1141DBBB8B47
MD5 SHA1 SHA512 TLSH

Submit Download

ChurnDashboard.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.csproj
Size 26.3MB
SHA256 9f58742b36d089f47690132f6faf2efb4e18e5193f4f32a594d7f3af0d86dab7
MD5 5cdcdad8aadffc7fbb80711e23954309
SHA1 48bcadad2e6622be3f1e766d03d9c9cb13801ff9
SHA512 0eed4afca2beede30d0077aa8f88623e7393460a4a04116d1ef8583b66086fa2111dd483ef3441edcdf44abf0169a42958210c7408d6dd91547158c575d86ce5
SSDEEP 24576:bQeASFzbzxxwxbCZzCJ8bAU5JFKkiT0++XcnHCjgqd5RWfjDW9uE9dTpKdOg7C+N:o
TLSH
T19657B06107518BEEF2984EC4C4EA105A24F9E56B79542294BBB37EEB3C3FCC06470667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChurnDashboard.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.csproj.user
Size 72KB
SHA256 84389981d33667f474e8432b03ce1d51ea3604b6c33b7f09d5c4d228aefacbba
MD5 1366facd19db8d8ee1f80a31e426cde3
SHA1 9ca252bb4190b6751474a57ac5a0b34f8f371030
SHA512 c5ef692e317ac2cf8f229e09e8850e6910000dd8a4bfa12b57c7f3356b2fb1396c901708a2f7c343c621c2ab9004dc7581acd6360e4bd0bceb6fecbe61b5b095
SSDEEP 768:FY4QFB1MhiPkWVjlYPvzaFz8+gEZPEWQfmyPVr:Ut/Yu2JEZPETp
TLSH
T197738CA51F9B9906F11C3E078CE75B826F1FC98B48180599C2E7A979323A7D25213CDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChurnDashboard.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\ChurnDashboard.targets
Size 151KB
SHA256 9f4c382af3eca6096c227968327fe997a82bfdd33a0bd07f06244e22de836b67
MD5 3bccecee35693be3aaddbed0dc1fb148
SHA1 e1b522f4002ea1123b1c9ca16d2ee3e1d05a10c0
SHA512 af46829c98ccebc3f3bccd94ea19b0f6e00a96bcc16320e163fa0d26e39a876fa8b4ead8ed0de1a31b63d911886ce0e070c338843b06bff7984eb642c2dc3812
SSDEEP 768:gNnyUDp8g+04d9xPxYLI0rf1wpMvnqxwimMfU2W1XDJD4OSA9dl/hU9ldyaF/LnK:gNMdfP2drf1wAn1imMfU2WpJndTUZK
TLSH
T1D9E35DBD5AEB4A01F5093D965DEB13C213A7DB7314610898F448E27720A7AEBE113DCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Internal.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\Internal.props
Size 41KB
SHA256 4cb43375ddba7b2ab2564d15b42b0edad708e90ec055ebd0b427223656314a1f
MD5 8d17146d04404f5b546fca3d86d4fa4f
SHA1 8ea41ed230c68c793c5690d07a253502476bc6d1
SHA512 6e0c3aa2dbead2781989c8b99e67d9bb09b6832d2e467253233e3b9f0d5ce4aa73696917cf986c3a002176532d7ca16b7db1f8317b3394dd5f299ffc877c1462
SSDEEP 384:tX6vC1AKo6XpGDjepPWfBR/PdHOU5dk3MqG706CNS3ETIy/CiMzm4ytxwK:9ECZpPWP3dEEhXVy/nMC5t6K
TLSH
T14913446A5ECB4847F56C3D639DD723CA171BC86715350488D0AAE57B2233BEAE103DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S69biEfPd.ig

Path C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\S69biEfPd.ig
Size 1KB
SHA256 e807ed839c7656dfe181ac50412dca270b135a471b448a5540b924541d548bf1
MD5 667d13c548a1a749131e8dbc8a3f42fe
SHA1 8b3e57ce59f2fefdcac773cb4aa936a482f2013b
SHA512 d4f94a31c6c296590c7d48265e26ac1ad8ad4e48b84516701ec4ededbff505a4e3b3b025fda56edbec48d22e52afd4cfc52fd28d2b8fe4517f1520cbc69b9ff4
TLSH
T18C31DB96B0150449C4E5727B27B58333238DA2C33880F9BC71C4DDAC789F16FAA951E8
MD5 SHA1 SHA512 TLSH

Submit Download

S69biEfPd.ig:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-43934-fbskVnEnuTmN\S69biEfPd.ig:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/4544-296-0x0000000000850000-0x0000000000890000-memory.dmp

Download

memory/4544-297-0x0000000002AF0000-0x0000000002B0A000-memory.dmp

Download

memory/4544-298-0x0000000005220000-0x000000000537A000-memory.dmp

Download

memory/4544-299-0x0000000005110000-0x0000000005140000-memory.dmp

Download

memory/4544-304-0x0000000005860000-0x000000000587C000-memory.dmp

Download

memory/4544-305-0x00000000134F0000-0x0000000013B54000-memory.dmp

Download

memory/4544-306-0x0000000017F30000-0x000000001803E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads