Analysis
- user interaction
yes - max time kernel
58s - max time network
72s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 01:34
General
- Target Aslain_WoWs_Mod_Manager_Setup.exe
- Size 6.5MB
- Sample260913-by5a1add65
- SHA256 1a69c77e796e98e08bf5c9c9057f4fc2f3f1aae0cf44b4d66c42a4fa420b7b1d
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 35 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Control Panel 1 IoCs
- Modifies registry class 34 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aslain_WoWs_Mod_Manager_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Aslain_WoWs_Mod_Manager_Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I1E9PR4DBB.tmp\Aslain_WoWs_Mod_Manager_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-I1E9PR4DBB.tmp\Aslain_WoWs_Mod_Manager_Setup.tmp" /SL5="$4017C,5290991,870912,C:\Users\Admin\AppData\Local\Temp\Aslain_WoWs_Mod_Manager_Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Aslain's WoWs Mod Manager\Aslain.WoWsModManager.exe"C:\Program Files\Aslain's WoWs Mod Manager\Aslain.WoWsModManager.exe"3⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Enumerates connected drives
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Aslain.WoWsModManager.exe
Aslain.WoWsModManager.exe.config
Ookii.Dialogs.Wpf.dll
Wpf.Ui.dll
Camera_Zeiss_Expert_x25_3f3c51ad.jpg.tmp
Camera_Zeiss_Extreme_x20_5cf8f2d1.jpg.tmp
Camera_Zeiss_Zoom_FOV_x25_851a9e7a.jpg.tmp
Camera_Zeiss_Zoom_x25_30bbd5ba.jpg.tmp
Crosshairs_dynamic_crosshair_Smart_Horizon_numbers_color_0d6c5d9b.jpg.tmp
Markers_Adjustable_Markers_aslain_e17898ca.jpg.tmp
Aslain.WoWsModManager.config
Aslain.WoWsModManager.config
Aslain.WoWsModManager.config
Aslain.WoWsModManager.config
Aslain.WoWsModManager.config
Aslain.WoWsModManager.config~RFe59cba3.TMP
Aslain.WoWsModManager.log
Aslain.WoWsModManager.log
Aslain.WoWsModManager.log
WMSDKNS.XML.bak
Aslain_WoWs_Mod_Manager_Setup.tmp
memory/3736-11-0x00000000005E0000-0x0000000000AD7000-memory.dmp
memory/3736-74-0x00000000005E0000-0x0000000000AD7000-memory.dmp
memory/3736-13-0x00000000005E0000-0x0000000000AD7000-memory.dmp
memory/3736-8-0x00000000005E0000-0x0000000000AD7000-memory.dmp
memory/3736-9-0x0000000001240000-0x0000000001241000-memory.dmp
memory/3736-6-0x0000000001240000-0x0000000001241000-memory.dmp
memory/4088-0-0x0000000000A90000-0x0000000000B74000-memory.dmp
memory/4088-89-0x0000000000A90000-0x0000000000B74000-memory.dmp
memory/4088-7-0x0000000000A90000-0x0000000000B74000-memory.dmp
memory/4268-71-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-97-0x0000023AF9810000-0x0000023AF984E000-memory.dmp
memory/4268-98-0x0000023AF97D0000-0x0000023AF97DE000-memory.dmp
memory/4268-100-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-99-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-96-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-199-0x0000023AF9F60000-0x0000023AF9F68000-memory.dmp
memory/4268-200-0x0000023AF9F70000-0x0000023AF9F78000-memory.dmp
memory/4268-95-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-94-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-90-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-766-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-87-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-88-0x0000023AF3530000-0x0000023AF354C000-memory.dmp
memory/4268-906-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-914-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-920-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-927-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-73-0x0000023AF35F0000-0x0000023AF36AA000-memory.dmp
memory/4268-72-0x0000023AF3BB0000-0x0000023AF4164000-memory.dmp
memory/4268-69-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-68-0x0000023AD8B20000-0x0000023AD8E2A000-memory.dmp
memory/4268-1187-0x0000023AF3B20000-0x0000023AF3B40000-memory.dmp
memory/4268-1213-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-1226-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-1257-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-67-0x00007FFB3347F000-0x00007FFB33480000-memory.dmp
memory/4268-1600-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp
memory/4268-1619-0x00007FFB332F0000-0x00007FFB33C94000-memory.dmp