Analysis
- geolocation tags
- user interaction
yes - max time kernel
150s - max time network
154s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
30/09/2026, 12:37
General
- Target diskgeeker-installer_nt1790771766506.exe
- Size 3.5MB
- Sample260930-ptrq1avy8l
- SHA256 bc7b14491b37d2e2f33e1f5a7635536224f321976904796f7d796a3738e00546
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 39 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 6 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\diskgeeker-installer_nt1790771766506.exe"C:\Users\Admin\AppData\Local\Temp\diskgeeker-installer_nt1790771766506.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DISM.exeDISM /online /enable-feature /featurename:BitLocker /NoRestart2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3DB2D496-B269-425C-AB55-A809B04537CD\dismhost.exeC:\Users\Admin\AppData\Local\Temp\3DB2D496-B269-425C-AB55-A809B04537CD\dismhost.exe {13DDEEB6-57CE-437E-8E81-E515110897FF}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\SysWOW64\DISM.exeDISM /online /enable-feature /featurename:Bitlocker-Utilities /NoRestart2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7FC931E3-3F92-4D07-9A07-51FB118A0DBC\dismhost.exeC:\Users\Admin\AppData\Local\Temp\7FC931E3-3F92-4D07-9A07-51FB118A0DBC\dismhost.exe {4FE946B6-082B-4E11-B701-B66ADFAEAF79}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\iboysoft_dgw_1790771934.exe"C:\Users\Admin\AppData\Local\Temp\iboysoft_dgw_1790771934.exe" /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /RESTARTEXITCODE=1233 /LOG="C:\Users\Admin\AppData\Local\Temp\inno_89A9E9B9-2F01-487B-A647-3D56F67417E1_20260930_180851.log" /NOCANCEL /DIR="C:\Program Files\DiskGeeker\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N33F8.tmp\iboysoft_dgw_1790771934.tmp"C:\Users\Admin\AppData\Local\Temp\is-N33F8.tmp\iboysoft_dgw_1790771934.tmp" /SL5="$F01B8,31863960,119296,C:\Users\Admin\AppData\Local\Temp\iboysoft_dgw_1790771934.exe" /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /RESTARTEXITCODE=1233 /LOG="C:\Users\Admin\AppData\Local\Temp\inno_89A9E9B9-2F01-487B-A647-3D56F67417E1_20260930_180851.log" /NOCANCEL /DIR="C:\Program Files\DiskGeeker\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SysprepProvider.dll
TransmogProvider.dll
AppxProvider.dll
AssocProvider.dll
CbsProvider.dll
DismCorePS.dll
DismHost.exe
DismProv.dll
DmiProvider.dll
GenericProvider.dll
IBSProvider.dll
IntlProvider.dll
LogProvider.dll
MsiProvider.dll
OSProvider.dll
OfflineSetupProvider.dll
ProvProvider.dll
SetupPlatformProvider.dll
SmiProvider.dll
UnattendProvider.dll
dg_installer_content.jpg
iboysoft_dgw_1790771934.exe
installer_e8683a3f96a761371437fb554d88629e_20260930_180851.log
libGATrace.dll
iboysoft_dgw_1790771934.tmp
logo.jpg
dism.log
dism.log
dism.log
dism.log
memory/1300-121-0x0000000000400000-0x000000000052B000-memory.dmp
memory/1300-122-0x0000000070100000-0x0000000070296000-memory.dmp
memory/2152-106-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2152-120-0x0000000000400000-0x0000000000428000-memory.dmp