7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260924-py4lcstgph
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2500	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4940	MSBuild.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6068	cmd.exe
3912	cmd.exe
4332	cmd.exe
1828	cmd.exe
5560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\Build.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\bOarsbuuX.nji:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.Common.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.csproj.user:Zone.Identifier	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3176	Setup.exe
3176	Setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 6068	3176	Setup.exe	89
PID 3176 wrote to memory of 3912	3176	Setup.exe	91
PID 3176 wrote to memory of 4332	3176	Setup.exe	93
PID 3176 wrote to memory of 2500	3176	Setup.exe	95
PID 2500 wrote to memory of 5740	2500	forfiles.exe	96
PID 5740 wrote to memory of 5192	5740	cmd.exe	98
PID 5740 wrote to memory of 624	5740	cmd.exe	99
PID 5740 wrote to memory of 1828	5740	cmd.exe	100
PID 1828 wrote to memory of 4572	1828	cmd.exe	101
PID 1828 wrote to memory of 5864	1828	cmd.exe	102
PID 5740 wrote to memory of 2452	5740	cmd.exe	103
PID 2452 wrote to memory of 5560	2452	conhost.exe	104
PID 5560 wrote to memory of 4852	5560	cmd.exe	105
PID 5560 wrote to memory of 4940	5560	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4332
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1 /m bOarsbuuX.nji /c "cmd /c ren @file bOarsbuuX.bat && call bOarsbuuX.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "bOarsbuuX.nji" bOarsbuuX.bat && call bOarsbuuX.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5192
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:4572
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:5864
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\bOarsbuuX.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\bOarsbuuX.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5560
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4852
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Indirect Command Execution

T1202

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

persistent.1790254310.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1790254310.tmp
Size 1KB
SHA256 c8425e5634a9c4c29d793efdde6ac62b499caf0a224d39cb36bae9e0a2232572
MD5 7bb19647e9a2d74594d81352a7b1e79b
SHA1 8014c82d1ec2f748b63eaeaac6c84de37f8ef8cb
SHA512 b0a54833c1a1c2f5b376edda89e1689fb850accd0d2a2ab3dd632d201ece5930fbab16ce9357c2e0cc02d05ec3c26f72dc124f3b327e284faa518259226e9fcb
TLSH
T1D9310C7E9F08CB7BCD00E8042DE55ADD353B5B6CC6D7F4191A14D48F1518567D241B39
MD5 SHA1 SHA512 TLSH

Submit Download

Build.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\Build.targets
Size 69KB
SHA256 689a939900dfb3bb4c9be529ed92cfc98ae335db068e4139e9e3a5e3657d5194
MD5 2451924a5e79926c53c1e94fac26e7c7
SHA1 1e4efba3e20c5fd67f2e5213d89322f3d91ab7da
SHA512 ac5d3ea031342f61c5e34e6354b63c6da20275609989fdc1fed463a0d457209f2615df953b3174547c186f4bf4ab23735ae4840596b2d62ffcf9f0fb2842b747
SSDEEP 1536:6+x6UgxpFcmZZcpjcXt56Y1cuX0MWzFhjcUu6lE6EdEMWjiC3TzQj+b+bTPV50sm:UL00VOKbjhhzYOKifO/zJ8dl2
TLSH
T1B0635754A5F3270072BD712282DFAED2161AEE0311552CD8C5DE992AF2173D2BE13E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReferralRouter.Common.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.Common.props
Size 41KB
SHA256 775fb7f231da9d8170b6bbd0343118d20037637ec154dc657bf29a355979236e
MD5 78cf415db6037dcf8807edd253c120fa
SHA1 d4a1a8937e38620e810af60a6e7c021919dcee06
SHA512 6d3d533399ff8ac1f5c83313f640902943474863c70d212f9f8727b0ff3976fdd12a113e340345db44a38db3bd5b0b55dc8c1c04f5a12a381295ea9a8234f2a2
SSDEEP 768:mfPPZuhfBAfeaO3Pp2ROAbcBERGSc30LtjVo2qAwr2fSfKASBkBmGiex7JDS0Zjc:mnZuhfeK/p2ROScEtV/qAwr2Sw
TLSH
T1BC1389A86DE21A41B23D718291EF5BC52D1BDE4336A42AD8D4DA763333227D47843E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReferralRouter.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.csproj
Size 45.9MB
SHA256 3cbeb220acb12a903c00f69d5e5433453a9f57e06792f99c480c3ec59458d405
MD5 6bb551a9b83d2375024f37855a7a0651
SHA1 507ed7b2d31dc38c1c46073e96804890293ccbb6
SHA512 2f98f404519cdfed5330165fc86f6823c4e62d262edfcbbbd16f732ed84500265834b5a8d4f0a69374fec3792aadc4821295a83d04b833ba13803bfad07630ab
SSDEEP 24576:EQGDvBofEXWXe6yIVASoib/M2+UzIlCbAM:/
TLSH
T121B7AC5213554BAEF68C0EC9C5EB100A24FA9526BD552288AFF37EF77C2BDC05074A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReferralRouter.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.csproj.user
Size 88KB
SHA256 5733a6854601aaa0b5d1ae65b3ddc15041274274351a8ecf495ca941a8c229c5
MD5 7f60a54efb36c9ba602b5085fbab6330
SHA1 5e7c771a1f2718f44f26d61246c340c329ebe625
SHA512 9d0a2019676b297c95310f90f1953c33e3e8223e94e2b023ee128f906fb234e847bf5758d81916da02112a6ae5ced3cb327353e187bade4ec88a78c13aa945e6
SSDEEP 1536:UU5ZS4PqhIz8peuWitUiUwpeSQa3ARfhn++yZ1IJTQnIofDf6/BSV:jzZ/QV
TLSH
T1E8931514B9A309917B3D7545C2CF4AC5252AEC03A6B06C8DC8DE71B333566E0B867E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReferralRouter.csproj:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\ReferralRouter.csproj:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

bOarsbuuX.nji

Path C:\Users\Admin\AppData\Local\Temp\tmp-01591-VTsqGpIzVfv1\bOarsbuuX.nji
Size 1KB
SHA256 2700bb7349b23e8e8ccf59534ce27d96c68c5ebc0281b92093d8c68a899e1c49
MD5 4bc8e0f8c554298c8cc360fc2e15d59e
SHA1 2111a6a173e8ecb14a37b114eab144fc82c809e3
SHA512 247f47bf333cadada6608314f3f6514a43765f05dd9a2e5d1b5fe7c4c2bd4f995da9d0349a67bad1dc4ca855d5f90cb7563e81efded320ee91ecc4ecbf1f7024
TLSH
T1B0319B56B1110449C4F1A67B67B18233135E62C33884F4BC71C8DDAC745F56EAA941E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/4940-281-0x0000000000810000-0x0000000000850000-memory.dmp

Download

memory/4940-284-0x0000000005350000-0x0000000005380000-memory.dmp

Download

memory/4940-283-0x0000000005550000-0x00000000056AA000-memory.dmp

Download

memory/4940-282-0x0000000005290000-0x00000000052AA000-memory.dmp

Download

memory/4940-304-0x0000000005540000-0x0000000005556000-memory.dmp

Download

memory/4940-305-0x000000003C170000-0x000000003CCB6000-memory.dmp

Download

memory/4940-306-0x000000000B470000-0x000000000B53A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads