Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/10/2026, 22:28
General
- Target SmoothieInstaller.exe
- Size 75KB
- Sample261001-2d11ysca56
- SHA256 9c6ed64d0a52ab90bdd8c588e28b387151634f8df5315c1809f7c82386c7740d
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SmoothieInstaller.exe"C:\Users\Admin\AppData\Local\Temp\SmoothieInstaller.exe"1⤵
- Downloads MZ/PE file
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vx2p1jng.zxg.exe"C:\Users\Admin\AppData\Local\Temp\vx2p1jng.zxg.exe" /repair /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{9200FDBE-C33B-4345-987F-1E9228103C71}\.cr\vx2p1jng.zxg.exe"C:\Windows\Temp\{9200FDBE-C33B-4345-987F-1E9228103C71}\.cr\vx2p1jng.zxg.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vx2p1jng.zxg.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /repair /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{95FD4761-6FFE-410E-96F2-A9EB78E3C9B9}\.be\VC_redist.x64.exe"C:\Windows\Temp\{95FD4761-6FFE-410E-96F2-A9EB78E3C9B9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C4A348CD-9CA9-433C-B06C-AD55D1A2B89A} {5DC0F9C2-F04A-4E1E-93CF-264FC2EC80FF} 26364⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vx2p1jng.zxg.exe
top_level.txt
top_level.txt
LICENSE
WHEEL
binary.file
utf-16.file
utf-8.file
LICENSE
top_level.txt
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
requirements.py
android.py
unix.py
windows.py
_types.py
py.typed
WHEEL
typing_extensions.py
cli.exe
gui.exe
LICENSE.txt
entry_points.txt
__main__.py
pack.py
tags.py
unpack.py
LICENSE
LICENSE.BSD
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_tokenizer.py
markers.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
vendor.txt
vx2p1jng.zxg.exe
logo.png
wixstdba.dll
memory/1652-14-0x00000172F53F0000-0x00000172F542C000-memory.dmp
memory/1652-4-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-20-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-19-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-18-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-17-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-16-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-15-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-13-0x00000172F5390000-0x00000172F53A2000-memory.dmp
memory/1652-0-0x00007FF9AD9CF000-0x00007FF9AD9D0000-memory.dmp
memory/1652-11-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-8-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-7-0x00000172F2290000-0x00000172F22B2000-memory.dmp
memory/1652-21-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-3-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-2-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-4250-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-4251-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-4252-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-4262-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-1-0x00000172D7150000-0x00000172D7166000-memory.dmp
memory/1652-22-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/1652-25-0x00000172F2270000-0x00000172F227A000-memory.dmp
memory/1652-24-0x00000172F53C0000-0x00000172F53D2000-memory.dmp
memory/1652-4329-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp