Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ipscan-3.9.0-setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ipscan-3.9.0-setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target ipscan-3.9.0-setup.exe
- Size 17.6MB
- Sample261029-zhyqaacd72
- SHA256 cf89753f97f44100d17ddac620231af952e70cb3f4fc02f410d3573be06b332e
- MD5 379f357438b97f2332e6b96cb9d43cd6
- SHA1 3d9942119469336a0d19fbb33faab56fd9e3f7bb
- SHA512 e8fd29a9c04c6cdccfb6f421fc55c2f041df5406f975d737a3a385dfc411c525610e551ff93ea9b5d3b003a46e73d9b0fff71471f5f634edc83a3aa3d7b64c5d
- SSDEEP 393216:HCWa8dI0DMu4LGDygkqApOPGTZB2Oexqy7HZK6Errn36KBKN/vRjw0m:HlDBDMZyDygkqApaukuy7w66bnK9vREV
- TLSH T10B07338A555FCB8DE5F7847530ACE41085A64E1719686BC8DFBEBBB844B8DF1B8C1320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 5052 ipscan-3.9.0-setup.exe 5052 ipscan-3.9.0-setup.exe 5052 ipscan-3.9.0-setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 40 IoCs
description ioc Process File created C:\Program Files\Angry IP Scanner\jre\lib\tzdb.dat ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\prefs.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\logging.properties ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\java.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\java.security ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\jrt-fs.jar ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\keytool.exe ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\nio.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\license.txt ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\java.exe ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\net.properties ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\limited\default_local.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\jvm.lib ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\cacerts ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\java.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\verify.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\zip.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\limited\default_US_export.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\jvm.cfg ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\blocked.certs ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\uninstall.exe ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\jli.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\limited\exempt_local.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\unlimited\default_US_export.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\classlist ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\msvcp140.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\client\jvm.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\modules ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\tzmappings ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\public_suffix_list.dat ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\ipscan.exe ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\release ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\javaw.exe ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\jimage.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\README.txt ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\lib\security\default.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\conf\security\policy\unlimited\default_local.policy ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\icon.ico ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\net.dll ipscan-3.9.0-setup.exe File created C:\Program Files\Angry IP Scanner\jre\bin\vcruntime140.dll ipscan-3.9.0-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipscan-3.9.0-setup.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsm46B6.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm46B6.tmp\UserInfo.dll
- Size 4KB
- SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
- MD5 2f69afa9d17a5245ec9b5bb03d56f63c
- SHA1 e0a133222136b3d4783e965513a690c23826aec9
- SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
- TLSH T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm46B6.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 8416e0209e7c1497ef84173f52b623eb38d86bab59886fe99317d8f557bf66f8
- MD5 571986bb6e3eed28c772e9dfa1b2d87e
- SHA1 c2e7574f8713def6d8647a780d4b5d6fb54843a4
- SHA512 2d2d5ec9e9627a0f7e3e3741bdfab4429cabffc0ab71c5968b87595d41be28ad29ae0dc5142710ad5718c6ef04cf76dee7a9b158d8b34c7a7d59eeaa7f66cf2a
- SSDEEP 3072:yBbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxrxxxxxxxxxxxxxxxxxxy:Yxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4
- TLSH T1A7E38A9DA179CED2F22B1DBE18B95050743B2ECE2040EDE7C251AD5DA3BC8041F65B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm46B6.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH