Overview

overview

7

Static

static

3

setup.exe

windows10-2004-x64

7

setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 23:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 31.6MB
  • Sample261029-22746sty7m
  • SHA256 ece00cb92420f9d50d485cfa5dfcaf844f3af17ee6cb5e9ca5c46345fe4bac86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Balabolka\BFileExt.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:252
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\Balabolka\BFileExt.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:5260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 1344
      2⤵
      • Program crash
      PID:4824
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1280 -ip 1280
    1⤵
      PID:5536

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          BFileExt.dll
          • Path C:\Program Files (x86)\Balabolka\BFileExt.dll
          • Size 362KB
          • SHA256 8a9a359dfb2b732daa10b8094456823aa7e54488038e6af33a0b6db1fa864e51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          balabolka.exe
          • Path C:\Program Files (x86)\Balabolka\balabolka.exe
          • Size 12.2MB
          • SHA256 5eee0d187347762f61d4fafbf898203791800033bf5d2ab533620f73ff8f8d7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uninstall.log
          • Path C:\Program Files (x86)\Balabolka\uninstall.log
          • Size 3KB
          • SHA256 0114673847166f11f0c7fec11afe8a36338617dbcb37be3182c98d5dc0db1119
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          uninstall.log
          • Path C:\Program Files (x86)\Balabolka\uninstall.log
          • Size 4KB
          • SHA256 00b4acb61fdbe0e992f0ad1cc0f07d98d6281821081236ff1ebbbd69e1928e39
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7logo.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\gentee9A\7logo.bmp
          • Size 7KB
          • SHA256 41a433347bbab486ce9604bf1deb626782f08523ca64b80641ef415704c0c61f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          guig.dll
          • Path C:\Users\Admin\AppData\Local\Temp\gentee9A\guig.dll
          • Size 20KB
          • SHA256 005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unppmd.dll
          • Path C:\Users\Admin\AppData\Local\Temp\gentee9A\unppmd.dll
          • Size 8KB
          • SHA256 d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          genteert.dll
          • Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
          • Size 60KB
          • SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          balabolka.cfg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\balabolka.cfg
          • Size 54B
          • SHA256 c3dc385f886d4c269289579843ce948586fe61d96132619412bcb5f9af128d38
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          balabolka.cfg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\balabolka.cfg
          • Size 91B
          • SHA256 63fc93c688a859524dd3a44ab05d85f7649c40d8d63af2a510e5c5c646cc8af5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          English.hmg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\English.hmg
          • Size 793B
          • SHA256 71c93cb8678860be64d331185b3fb98a25eb6b8bc82c5ffa947997d9b738d134
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          French.hmg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\French.hmg
          • Size 1KB
          • SHA256 93d2ced1363dc7ac6b5f714b6cfc63083eac4d27c1adb20183f844a677df73c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          German.hmg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\German.hmg
          • Size 467B
          • SHA256 06c5a18a46c69572f412e892ea292eac0619ef2a4108235e577cd2224ff88e34
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Russian Nicolai (SAPI4).hmg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\Russian Nicolai (SAPI4).hmg
          • Size 66KB
          • SHA256 ba98e3122ac14f4906499be6af1308613d4f4ee607ab2a36e30e408a6bac1f8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Russian Olga.hmg
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\Russian Olga.hmg
          • Size 66KB
          • SHA256 d5e31449c29a88e0b992ed6578f2fcf7f791e2e73867e51f6094d5603ce37c4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ligature.dic
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\ligature.dic
          • Size 392B
          • SHA256 8253d49803e1d7d1b99869abaab08b344f441484355944639ba2ff2aa18b2b5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sample.bxd
          • Path C:\Users\Admin\AppData\Roaming\Balabolka\dict\sample.bxd
          • Size 439B
          • SHA256 ba740dc63018d4c2f387cb7421432d0d4c196fc81709e74f8f0db89921f17aa1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1280-26-0x0000000003EF0000-0x0000000003EF1000-memory.dmp
          Download

          memory/1280-25-0x0000000003F00000-0x0000000003F01000-memory.dmp
          Download

          memory/5260-697-0x000000011005E000-0x000000011005F000-memory.dmp
          Download