Overview

overview

7

Static

static

3

Capri-Setup.exe

windows10-2004-x64

7

Capri-Setup.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    98s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/10/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Capri-Setup.exe
  • Size 10.2MB
  • Sample261030-da98fsdb27
  • SHA256 50e7905ba6c1c50494ecab349f8ccbf5e021258785ccc27176c70172738b3c59
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Capri-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Capri-Setup.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Capri\Capri.exe
      "C:\Users\Admin\AppData\Local\Capri\Capri.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
  • C:\Windows\system32\werfault.exe
    werfault.exe /hc /shared Global\98e2a9837774466e81bc1939de3cfdeb /t 3884 /p 3852
    1⤵
      PID:4212
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2000
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x49c 0x2f4
      1⤵
        PID:852
      • C:\Users\Admin\AppData\Local\Capri\Capri.exe
        "C:\Users\Admin\AppData\Local\Capri\Capri.exe"
        1⤵
        • Executes dropped EXE
        PID:2428

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Capri.exe
            • Path C:\Users\Admin\AppData\Local\Capri\Capri.exe
            • Size 10.0MB
            • SHA256 d752398335a45ae300d50ad05ff2dce538ae9e10e1d6ebb6c941dbccd216ad74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.json
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json
            • Size 1KB
            • SHA256 5c10877e933a3ad99299ba1e5d7e0515a4ce6c4382af184e05f88c39002d54f7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json
            • Size 1KB
            • SHA256 ce7cb1a8251e79d2952568f70b637288c2fb800efd9b4f13f94c960f7153ee2e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json.new
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json.new
            • Size 1KB
            • SHA256 70d4a761ac84389f61aae65c5549db008c8d7d129cc7aba6e189901cc6c91b39
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json.new
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json.new
            • Size 1KB
            • SHA256 cd90d3d5bf44ed54ac1fbcdbac0acf8be33fe32d5879de141ab8f47f2512fe00
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json.new
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json.new
            • Size 1KB
            • SHA256 23cf24e6a1c18ba41afc1f28200c2c91435d40b96b8c537c1c747f0e831b2d36
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json.new
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json.new
            • Size 1KB
            • SHA256 ac4002c003bff5d9f4c8862b74335088eb201cc141a84cd7bdab302967a576c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json.new
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json.new
            • Size 1KB
            • SHA256 359b4fd29b81aee846e7aa559c9f4ef4e3f107905494e29692db73c719631ae2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json.new
            • Path C:\Users\Admin\AppData\Local\Capri\settings.json.new
            • Size 1KB
            • SHA256 f73068df48ffc7cc249e9ea8eb9349b336292ed74acbdcaf51055eb7f47ced19
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            sherpa-onnx-LICENSE.txt
            • Path C:\Users\Admin\AppData\Local\Capri\voice\capri-voice-1.new\licenses\sherpa-onnx-LICENSE.txt
            • Size 11KB
            • SHA256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2000-59-0x0000019C28F80000-0x0000019C28FA0000-memory.dmp
            Download

            memory/2000-29-0x0000019C28970000-0x0000019C28990000-memory.dmp
            Download

            memory/2000-23-0x0000019C27C00000-0x0000019C27D00000-memory.dmp
            Download

            memory/2000-28-0x0000019C289B0000-0x0000019C289D0000-memory.dmp
            Download

            memory/2488-139-0x000000001BC40000-0x000000001BC50000-memory.dmp
            Download

            memory/2488-684-0x000000001BC40000-0x000000001BC50000-memory.dmp
            Download

            memory/2488-17-0x0000000020630000-0x0000000020642000-memory.dmp
            Download

            memory/2488-13-0x000000001BC40000-0x000000001BC50000-memory.dmp
            Download

            memory/2488-0-0x00000000007E0000-0x000000000120C000-memory.dmp
            Download

            memory/2488-11-0x000000001C870000-0x000000001C87A000-memory.dmp
            Download

            memory/2488-10-0x000000001BC40000-0x000000001BC50000-memory.dmp
            Download

            memory/2488-1-0x000000001BC40000-0x000000001BC50000-memory.dmp
            Download

            memory/2712-691-0x0000000023030000-0x000000002306C000-memory.dmp
            Download

            memory/2712-727-0x0000000025A20000-0x0000000025A46000-memory.dmp
            Download

            memory/2712-728-0x00000000231B0000-0x00000000231BE000-memory.dmp
            Download

            memory/2712-726-0x00000000230B0000-0x00000000230BA000-memory.dmp
            Download

            memory/2712-729-0x0000000027B30000-0x0000000027B8A000-memory.dmp
            Download

            memory/2712-725-0x00000000230A0000-0x00000000230A8000-memory.dmp
            Download

            memory/2712-724-0x00000000259C0000-0x00000000259EE000-memory.dmp
            Download

            memory/2712-690-0x00000000202D0000-0x00000000202E2000-memory.dmp
            Download

            memory/2712-738-0x00000000275D0000-0x000000002765A000-memory.dmp
            Download

            memory/2712-689-0x000000001C860000-0x000000001C8B0000-memory.dmp
            Download

            memory/2712-688-0x000000001C2B0000-0x000000001C2E8000-memory.dmp
            Download

            memory/2712-755-0x00000000275D0000-0x000000002765A000-memory.dmp
            Download

            memory/2712-686-0x0000000000D60000-0x0000000001760000-memory.dmp
            Download

            memory/2712-765-0x00000000275D0000-0x000000002765A000-memory.dmp
            Download