Overview

overview

8

Static

static

3

setup.exe

windows10-2004-x64

8

setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/10/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 667KB
  • Sample261018-wwggdahs21
  • SHA256 36bd42317c14d1dc0558859f34330aca8b56b43c1405cdb269bd8afb11a1a8cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies registry class 13 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\NetCoreCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\NetCoreCheck.exe" Microsoft.WindowsDesktop.App 8.0.31
      2⤵
      • Executes dropped EXE
      PID:3144
    • C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\NetCoreCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\NetCoreCheck.exe" Microsoft.WindowsDesktop.App 8.0.31
      2⤵
      • Executes dropped EXE
      PID:2780
    • C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\windowsdesktop-runtime-8.0.31-win-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\windowsdesktop-runtime-8.0.31-win-x64.exe" /q
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Windows\Temp\{36ACF187-9C6D-4324-AB44-79EF88B18B14}\.cr\windowsdesktop-runtime-8.0.31-win-x64.exe
        "C:\Windows\Temp\{36ACF187-9C6D-4324-AB44-79EF88B18B14}\.cr\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=696 /q
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\.be\windowsdesktop-runtime-8.0.31-win-x64.exe
          "C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\.be\windowsdesktop-runtime-8.0.31-win-x64.exe" -q -burn.elevated BurnPipe.{02CAF540-9843-43CA-B86C-B874C5309A1D} {EDB0EA1A-E15B-434E-87DB-613C4E224144} 4764
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4180
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 1068
          4⤵
          • Program crash
          PID:5020
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9A6BFC79495D8A472AF5B8B41D21C4A4
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4340
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 991F33BC17FEBE743ADCE669DC973245
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1500
  • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
    "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
      "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
        "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
          "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" -q -burn.elevated BurnPipe.{162E213C-3BBA-49AE-97AA-9322DE991AE3} {F20BC783-CDE0-4D50-A56B-2A4FBB3338A2} 2276
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4712
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4764 -ip 4764
    1⤵
      PID:4412

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Microsoft Windows Desktop Runtime - 8.0.31 (x64).swidtag
          • Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.31 (x64).swidtag
          • Size 490B
          • SHA256 e3e252b4b182beaa6642dd67d671770fba1468972ffd3023f8f8e239a31cf46b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dotnet-hostfxr-8.0.31-win-x64.msi
          • Path C:\ProgramData\Package Cache\{147B0E5B-D916-44F6-A66B-163CF0F723E9}v64.124.58447\dotnet-hostfxr-8.0.31-win-x64.msi
          • Size 776KB
          • SHA256 6049ef4356fa5aadff989cac1bc005f091ceccba4ef618a809205ad8328d7555
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\state.rsm
          • Size 1KB
          • SHA256 45165649e3f4fe05e48951514bef75156a95da9c7bfcf5ca2c228ef8dd7f17a3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log
          • Size 11KB
          • SHA256 e86eddb296e499385b83812d7036c10c0f72c90d8fd46f718349f450a931e9ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626_000_dotnet_runtime_8.0.31_win_x64.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626_000_dotnet_runtime_8.0.31_win_x64.msi.log
          • Size 2KB
          • SHA256 5a072053a1e863b785e23450e3c797535b09c1001d247741e7d118a5d0ca14be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NetCoreCheck.exe
          • Path C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\NetCoreCheck.exe
          • Size 141KB
          • SHA256 3e1c1d8c5540e45099a501c4bc910222618fc21563644bc9add00ea541b013f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Test240706203.runtimeconfig.json
          • Path C:\Users\Admin\AppData\Local\Temp\VSD9F48.tmp\net8desktopruntime_x64\Test240706203.runtimeconfig.json
          • Size 104B
          • SHA256 6a777266b8579f7828894a87a832b9fc6ff84ef716da6105248f2115d5c64ff5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI1CB.tmp
          • Path C:\Windows\Installer\MSI1CB.tmp
          • Size 219KB
          • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windowsdesktop-runtime-8.0.31-win-x64.exe
          • Path C:\Windows\Temp\{36ACF187-9C6D-4324-AB44-79EF88B18B14}\.cr\windowsdesktop-runtime-8.0.31-win-x64.exe
          • Size 607KB
          • SHA256 979eb818a30d9759b4571af89c877597d1fc88b20ddd5f3d0ddd538b70c8b20d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\Temp\{C49B09DF-5417-40C4-94D3-F29D030F0315}\.ba\BootstrapperApplicationData.xml
          • Size 7KB
          • SHA256 5b459acefd453b95c6bb662f766038c48222867db4016bdfb91420493eff1e9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{C49B09DF-5417-40C4-94D3-F29D030F0315}\.ba\thm.wxl
          • Size 5KB
          • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{C49B09DF-5417-40C4-94D3-F29D030F0315}\.ba\thm.xml
          • Size 11KB
          • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bg.png
          • Path C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\.ba\bg.png
          • Size 4KB
          • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\.ba\wixstdba.dll
          • Size 190KB
          • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet_host_8.0.31_win_x64.msi
          • Path C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\dotnet_host_8.0.31_win_x64.msi
          • Size 704KB
          • SHA256 6523695f0a8784208c166fd4c7f026d049bebb67f9f426b9f6f70a9f014ad41b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet_runtime_8.0.31_win_x64.msi
          • Path C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\dotnet_runtime_8.0.31_win_x64.msi
          • Size 26.4MB
          • SHA256 ec6855e09c01c457029b536daeec4208a8a21acdce08250162d02bc0531ca72c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windowsdesktop_runtime_8.0.31_win_x64.msi
          • Path C:\Windows\Temp\{D414F14F-840E-4345-B076-5CA6871846AD}\windowsdesktop_runtime_8.0.31_win_x64.msi
          • Size 29.2MB
          • SHA256 afa54a38d640d211b2c23a19c7d93c80fa922e39bc84f735e109124c33becca3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2276-227-0x00000000000F0000-0x0000000000166000-memory.dmp
          Download

          memory/4712-226-0x00000000000F0000-0x0000000000166000-memory.dmp
          Download

          memory/5056-228-0x00000000000F0000-0x0000000000166000-memory.dmp
          Download