Analysis
- max time kernel
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 10:15
General
- Target VerifyPlus_Kurulum_1.0.0.exe
- Size 18.5MB
- Sample261002-mabvbswcnc
- SHA256 5ccd526f0daccce6f58306d1d33a77d41b43817ac2ca0cf95f5d3d0a5ac055a8
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 15 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VerifyPlus_Kurulum_1.0.0.exe"C:\Users\Admin\AppData\Local\Temp\VerifyPlus_Kurulum_1.0.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PKHKSS883Y.tmp\VerifyPlus_Kurulum_1.0.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-PKHKSS883Y.tmp\VerifyPlus_Kurulum_1.0.0.tmp" /SL5="$7021E,18171267,854016,C:\Users\Admin\AppData\Local\Temp\VerifyPlus_Kurulum_1.0.0.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Programs\VERIFY+\VerifyPlus.exe"C:\Users\Admin\AppData\Local\Programs\VERIFY+\VerifyPlus.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\VERIFY+\VerifyPlus.exe"C:\Users\Admin\AppData\Local\Programs\VERIFY+\VerifyPlus.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled"2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Svg.dll
Qt6Widgets.dll
VerifyPlus.exe
qsvgicon.dll
qgif.dll
qico.dll
qjpeg.dll
qsvg.dll
libgcc_s_seh-1.dll
libstdc++-6.dll
libwinpthread-1.dll
logo.png
logo_full.png
qwindows.dll
qmodernwindowsstyle.dll
unins000.exe
__PSScriptPolicyTest_4r5gevei.rgo.psm1
VerifyPlus_Kurulum_1.0.0.tmp
memory/1700-155-0x00007FFBD5BD0000-0x00007FFBD62B4000-memory.dmp
memory/1700-215-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/1700-305-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/1700-303-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/1700-287-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/1700-267-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/1700-269-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/1700-214-0x00007FFBF0260000-0x00007FFBF0276000-memory.dmp
memory/1700-177-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/1700-179-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/1700-157-0x00007FFBF0280000-0x00007FFBF02A2000-memory.dmp
memory/1700-154-0x00007FF67FEC0000-0x00007FF67FF7A000-memory.dmp
memory/1700-156-0x00007FFBD59E0000-0x00007FFBD5BCF000-memory.dmp
memory/1700-159-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/1700-158-0x00007FFBD57B0000-0x00007FFBD59DA000-memory.dmp
memory/1700-160-0x00007FFBF0260000-0x00007FFBF0276000-memory.dmp
memory/1700-161-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/1700-162-0x00007FFBD8ED0000-0x00007FFBD9010000-memory.dmp
memory/2460-11-0x00000000003A0000-0x00000000007E2000-memory.dmp
memory/2460-163-0x00000000003A0000-0x00000000007E2000-memory.dmp
memory/2460-9-0x0000000001220000-0x0000000001221000-memory.dmp
memory/2460-6-0x0000000001220000-0x0000000001221000-memory.dmp
memory/2460-8-0x00000000003A0000-0x00000000007E2000-memory.dmp
memory/2460-136-0x00000000003A0000-0x00000000007E2000-memory.dmp
memory/2840-291-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/2840-219-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/2840-183-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/2840-182-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/2840-189-0x00007FFBD8ED0000-0x00007FFBD9010000-memory.dmp
memory/2840-185-0x00007FFBD5BD0000-0x00007FFBD62B4000-memory.dmp
memory/2840-188-0x00007FFBF0260000-0x00007FFBF0276000-memory.dmp
memory/2840-186-0x00007FFBF0280000-0x00007FFBF02A2000-memory.dmp
memory/2840-187-0x00007FFBD57B0000-0x00007FFBD59DA000-memory.dmp
memory/2840-308-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/2840-184-0x00007FFBD59E0000-0x00007FFBD5BCF000-memory.dmp
memory/2840-309-0x00007FFBD41B0000-0x00007FFBD4CCE000-memory.dmp
memory/2840-233-0x00007FFBF0260000-0x00007FFBF0276000-memory.dmp
memory/2840-181-0x00007FF67FEC0000-0x00007FF67FF7A000-memory.dmp
memory/2840-290-0x00007FFBD4CD0000-0x00007FFBD57A4000-memory.dmp
memory/4156-135-0x000002254DCE0000-0x000002254DD02000-memory.dmp
memory/4156-141-0x000002254DE40000-0x000002254DE4A000-memory.dmp
memory/4156-140-0x000002254DD80000-0x000002254DE32000-memory.dmp
memory/4156-139-0x000002254DD60000-0x000002254DD7E000-memory.dmp
memory/5836-164-0x00000000008B0000-0x0000000000990000-memory.dmp
memory/5836-7-0x00000000008B0000-0x0000000000990000-memory.dmp
memory/5836-0-0x00000000008B0000-0x0000000000990000-memory.dmp