5229816d13a3b851f292b0fa4169531b5e512b2b1d584ecdd9f2990354883827

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 552KB
Sample261003-zyb68ayway
SHA256 5229816d13a3b851f292b0fa4169531b5e512b2b1d584ecdd9f2990354883827
MD5 32144f5ad90483c01f057e7852c3c970
SHA1 ee6c50e8a2df0ed18b5c45b2be64bba218d4175e
SHA512 e2879ed48b1fc058aa27e4ee203962cf1f5e6b08a34e888fa99a6f008dd216e71d94f528c10ddded740e1aa90e897a59a5e93f1c5428e5ecc770cba08f774a5c
SSDEEP 12288:sc/fX9rhmsdW5jivju3w1SC4LqwRlheMb01JQntLOC+/QW+:h/P9wsdWt4Cw4xLPem+If
TLSH
T1FBC4F61366D8BCA8E1B216706F7797E1977EFC201B30C49F22C0151D997D9C2BA31BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "KNO12B7P7AH61WH2BD2453L3"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "RH9KX6V3PTHLAJB2EXPP8X1L"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "539CON28PNO8CN87LNHACWGB"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 2320	4164	setup.exe	88

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3K5T0WB2.BZB.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L87JCPPZ.JDT\3K5T0WB2.BZB.application
Size 5KB
SHA256 ba42a0fab7ae077493423c1b5437155931586a13d1dd0b625ac77f1b25f02665
MD5 53e01df4082104d983c6cf1bfc2870c7
SHA1 9cab3e0e116e5a240588a58dfc9ccff82a802b7a
SHA512 d35b3f61f5a217316c0bc0bf2bd9f99e786fd3a9b48674325c7d25ab646e59cb3f6422cc665cd8d2277273d7ee91b6fcb4b18ba2b0d95b18a525db7bf1f1f2e4
SSDEEP 96:0WLwO9ZcdDvPcgxzndIDPkoNqWCmOJpDaeEppWKCvlbPbBDA:f8fxFoNX6A
TLSH
T121C165A9C8C9D801F205F9713AF2E503595623B385EC405CBEA9489EDF89FD5C5423B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2320-18-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-24-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-15-0x0000021639D00000-0x0000021639D08000-memory.dmp

Download

memory/2320-19-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-21-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-22-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-23-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-17-0x0000021654520000-0x00000216546A8000-memory.dmp

Download

memory/2320-16-0x00007FFB4E30F000-0x00007FFB4E310000-memory.dmp

Download

memory/2320-25-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-28-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-29-0x0000021658D80000-0x0000021658DD0000-memory.dmp

Download

memory/2320-31-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2320-36-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads