Analysis
- user interaction
yes - max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 12:51
General
- Target setup_2020.14.24.exe
- Size 51.3MB
- Sample261006-p3mteagy5x
- SHA256 18ffabf9da2e38501fcb8326e0963d6e9dab7484f1546223a08ed1cf8a57c767
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_2020.14.24.exe"C:\Users\Admin\AppData\Local\Temp\setup_2020.14.24.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ci18-опись_КОНВЕРТАЦИЯ.XSD
док_РАСЧЕТ_ПО_ВЗНОСАМ_НА_ДОПОЛНИТЕЛЬНОЕ_СОЦИАЛЬНОЕ_ОБЕСПЕЧЕНИЕ_2015.XSD
док_РСВ1.XSD
док_РСВ2.XSD
док_СВЕДЕНИЯ_О_СЕРТИФИКАТЕ_НА_МАТЕРИНСКИЙ_КАПИТАЛ.XSD
опись_ВЕДОМОСТЬ_УПЛАТЫ.xsd
опись_ВХОДЯЩАЯ_ОПИСЬ_РЕЕСТРА.XSD
опись_СТАРЫЕ_ИС_СЗВ-3.XSD
Kolpols.TXT
Uregrs.TXT
parser2ndfl2013.ini
parser2ndfl2017.ini
page_fiz_liza_01_12.jpg
page_fiz_liza_01_19.gif
add.gif
app_48.gif
businessman_add.gif
businessman_delete.gif
businessman_preferences.gif
calc.gif
circle_green.gif
circle_orange.gif
collab_cpl_7.gif
forma.gif
ie.gif
info_2.gif
mail_send(4).png
notebook_delete.gif
outxml.gif
packa3.gif
rem.gif
save.gif
sort.gif
test.gif
test_old.gif
vibANK.png
vibNDFL.png
vibSZV.png
FSS4_2012_Unload.xsd
FSS4_2014_Unload.xsd
FSS4_2015_Unload.xsd
NO_AKCIZ_1_506_00_05_02_03.xsd
NO_BOUPR_1_159_00_05_03_01.xsd
NO_BUHOTCH_1_105_00_05_08_01.xsd
NO_ENVD_1_029_00_05_07_01.xsd
NO_ENVD_1_029_00_05_08_01.xsd
NO_ENVD_1_029_00_05_08_02.xsd
NO_IMUD_1_084_00_05_06_02.xsd
NO_IMUD_1_084_00_05_07_02.xsd
NO_IMUR_1_085_00_05_03_04.xsd
NO_KNTMSZ_1_107_00_05_02_01.xsd
NO_NDFL6_1_152_00_05_02_03.xsd
NO_NDS.10_1_003_05_05_05_01.xsd
NO_NDS.11_1_003_06_05_05_01.xsd
NO_NDS.12_1_003_07_05_05_01.xsd
NO_NDS.81_1_003_02_05_04_02.xsd
NO_NDS.81_1_003_02_05_07_01.xsd
NO_NDS.8_1_003_01_05_04_02.xsd
NO_NDS.8_1_003_01_05_05_02.xsd
NO_NDS.91_1_003_04_05_05_01.xsd
NO_NDS.9_1_003_03_05_05_01.xsd
NO_NDS_1_003_00_05_06_02.xsd
NO_PRIB_1_002_00_05_05_02.xsd
NO_PRIB_1_002_00_05_07_04_supp2.xsd
NO_RASCHSV_1_162_00_05_02_06.xsd
NO_RASCHSV_1_162_00_05_02_06_supp2.xsd
NO_TRAND_1_054_00_05_05_02.xsd
NO_USN_1_030_00_05_04_02.xsd
NO_UTILSB_1_149_00_05_04_01.xsd
RSV1_2014_pre.xsd
UT_SBSOZD_1_515_00_05_02_01.xsd
UT_UVTORGSB_1_535_00_05_01_01.xsd
f4form_2017_3_Unload.xsd
f4form_2017_Unload.xsd
sr_zpusn_1_092_00_05_08_01.xsd
uninstall.ini
uninstall.ini
uninstall.ini
uninstall.ini
4logo_sn.bmp
guig.dll
unppmd.dll
genteert.dll
memory/1156-22-0x0000000000810000-0x0000000000811000-memory.dmp