Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 04:26
General
- Target ScriptPlayer-Debug-1.2.3.463.exe
- Size 4.1MB
- Sample261011-e2vshsez81
- SHA256 269cc6f62878987edb0cb7d724ce72e4c7297267a66c36012e2342c66d4dfc0c
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 4 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScriptPlayer-Debug-1.2.3.463.exe"C:\Users\Admin\AppData\Local\Temp\ScriptPlayer-Debug-1.2.3.463.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RGQJ8.tmp\ScriptPlayer-Debug-1.2.3.463.tmp"C:\Users\Admin\AppData\Local\Temp\is-RGQJ8.tmp\ScriptPlayer-Debug-1.2.3.463.tmp" /SL5="$70216,3886673,121344,C:\Users\Admin\AppData\Local\Temp\ScriptPlayer-Debug-1.2.3.463.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\StepInitialize.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.exe"C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Buttplug.dll
FMUtils.KeyboardHook.dll
is-VPT2I.tmp
Octokit.dll
ScriptPlayer.HandyApi.dll
ScriptPlayer.Ipc.dll
ScriptPlayer.Shared.dll
ScriptPlayer.exe
ScriptPlayer.exe.config
WMSDKNS.XML.bak
ScriptPlayer-Debug-1.2.3.463.tmp
index.dat
memory/4424-181-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-224-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-178-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-180-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-184-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-183-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-186-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-185-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-188-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-190-0x00007FFE29FF0000-0x00007FFE2A000000-memory.dmp
memory/4424-192-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-191-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-189-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-187-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-193-0x00007FFE29FF0000-0x00007FFE2A000000-memory.dmp
memory/4424-177-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-223-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-226-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-225-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-182-0x00007FFE2C840000-0x00007FFE2C850000-memory.dmp
memory/4424-227-0x00007FFE6C700000-0x00007FFE6C963000-memory.dmp
memory/4424-179-0x00007FFE6C85F000-0x00007FFE6C860000-memory.dmp
memory/4516-10-0x0000000002460000-0x0000000002461000-memory.dmp
memory/4516-6-0x0000000002460000-0x0000000002461000-memory.dmp
memory/4516-175-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4516-9-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4540-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4540-176-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4540-8-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5100-239-0x000001C02A7A0000-0x000001C02A7B6000-memory.dmp
memory/5100-231-0x000001C00FF60000-0x000001C01004A000-memory.dmp
memory/5100-237-0x000001C02A760000-0x000001C02A786000-memory.dmp
memory/5100-247-0x000001C02A830000-0x000001C02A838000-memory.dmp
memory/5100-248-0x000001C02AA80000-0x000001C02AABE000-memory.dmp
memory/5100-249-0x000001C02A840000-0x000001C02A84E000-memory.dmp
memory/5100-235-0x000001C0104C0000-0x000001C0104C8000-memory.dmp
memory/5100-233-0x000001C02AC80000-0x000001C02B15A000-memory.dmp
memory/5100-251-0x000001C02AAF0000-0x000001C02AAFA000-memory.dmp
memory/5100-253-0x000001C02C170000-0x000001C02C272000-memory.dmp