6f8aa84021cc190bfc9c7efa375f6e8adfafa8bb1832ba5ea6ddc8a211ca888f

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fences4_setup_sd.exe
Size 12.4MB
Sample261102-dc7v4sea29
SHA256 6f8aa84021cc190bfc9c7efa375f6e8adfafa8bb1832ba5ea6ddc8a211ca888f
MD5 f8db736dc6c611ff78e853e79cf749f6
SHA1 592bb1965595331ec7cf3322be2aad6b1cd1c001
SHA512 5d4bc2adf6f14a9d34bc01affb10dd62da2c5e1cf2e84a7e0940c17edb3e47fba04052899283eaf132dbc399b10c1eb1275a9f7e90e26e2e45a7c697f65c3328
SSDEEP 196608:oNaqQ8EAwKAviL86vrdP2qfozoDU4WQ8J8v/l8+kUvpakbrEcQrFvB+X5abjPBLN:oAPhiL8YrkqTU4WPJ822p/srFvB+Jar
TLSH
T11AD63312A761D0BAE59D1035C8A183F25B723E74EB1788EB97C17DCC7870AF2A735069
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001500000001c4a2-4.dat	upx
behavioral2/memory/3408-10-0x0000000000030000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3408-74-0x0000000000030000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3408-75-0x0000000000030000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3408-78-0x0000000000030000-0x0000000000418000-memory.dmp	upx

Executes dropped EXE 2 IoCs

pid	Process
3408	irsetup.exe
1168	GetMachineSID.exe

Loads dropped DLL 2 IoCs

pid	Process
3408	irsetup.exe
3408	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	irsetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	irsetup.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fences4_setup_sd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetMachineSID.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3408	irsetup.exe
3408	irsetup.exe
3408	irsetup.exe
3408	irsetup.exe
3408	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3408	4780	Fences4_setup_sd.exe	89
PID 3408 wrote to memory of 3844	3408	irsetup.exe	90
PID 3408 wrote to memory of 1168	3408	irsetup.exe	92

C:\Users\Admin\AppData\Local\Temp\Fences4_setup_sd.exe
"C:\Users\Admin\AppData\Local\Temp\Fences4_setup_sd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1949218 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Fences4_setup_sd.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-650287814-2715975232-1279715623-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /y /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Encoding.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Encoding.lmd
Size 393KB
SHA256 d0b2fa60e707982899ecd8c4dc462721c82491245b26721a7c0e840c5f557aed
MD5 6eec47ab86d212fe3ed0f56985c8e817
SHA1 06da90bcc06c73ce2c7e112818af65f66fcae6c3
SHA512 36d6ef8a3fecb2c423079cadbfcbe2b044095f641c9a6ce0f9d0e96c6400f00a089aa26cc9d361bfdbcfdc3a8487d18d64956b36f39320648d1ddb565221a9cb
SSDEEP 6144:Jn49uVamRTBkNYZ1qrgUDtBfOGj3ruHkFB2t6SyoYkQe9ANuiRv1:ZSc3ZBkA1qUUXfP2XzYkQOcuiRd
TLSH
T139842395E52A115CE47882BF4EC3AECF43B878014E484F1E1AD189197CDEBF59257E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetMachineSID.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
Size 58KB
SHA256 723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43
MD5 55bbf335f75f2a2fe0a5daf603964d41
SHA1 f1b9686e8a9f10682722fc5e08c02c016b597804
SHA512 af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6
SSDEEP 768:Ss62anwZWdmSDvNHhf97jWvoI6TKqoRkePfP4ED2AnIBPZ0wdC04oEPg+:82aFdL7DdjWvw/oRRPn7It1Cl4+
TLSH
T158436D163A90C032E5535A304DB4D2A25F7BBD6265B5864F3BD803BE9FB13C06E2935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetMachineSID.tmp

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp
Size 40B
SHA256 f5481063312c0f2c1bb9bfbb33a0602f0a5189317a12c0212ca747cfc16fc48a
MD5 72a3f58a377c77c6f6c2c79a9ceee926
SHA1 d818c2aeb38b538a7fc915560fb09824acc6dc22
SHA512 873b15352004ea486c4c05a8668f7f4c23c5fbdb33012b6e6f04bdc9fd662d0a46a9bb8b7f9ade20c63b10b6c3699e8298bf8e022bc6eb7da8667b94958a4b9d
MD5 SHA1 SHA512

Submit Download

IRIMG1.JPG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
Size 2KB
SHA256 988cf422cbf400d41c48fbe491b425a827a1b70691f483679c1df02fb9352765
MD5 3220a6aefb4fc719cc8849f060859169
SHA1 85f624debcefd45fdfdf559ac2510a7d1501b412
SHA512 5c45ea8f64b3cdfb262c642bd36b08c822427150d28977af33c9021a6316b6efed83f3172c16343fd703d351af3966b06926e5b33630d51b723709712689881d
TLSH
T155414D575E420F025B63C3BA69033336E7FBAA832618A93D11C2E069C670CF2A504739
MD5 SHA1 SHA512 TLSH

Submit Download

eula.txt

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\eula.txt
Size 9KB
SHA256 11b8d888d66f5f99c09bfb49acf7043759aee603275a42ed7945341049c4ba17
MD5 2d2d96dbfeeb044ac50eabe28bc00191
SHA1 179c388a6415cea696bf8536d89a58ba01ccab36
SHA512 1a7beff57b155498e815c04d89f275eb7537b4c9631643e67f0787aa8c2807248f5c5519efcc468a71b41e3399d9560b58cf14c5dd3bfdef23fc9ef206ddd0a1
SSDEEP 192:U2fLhKXfPEc1MBNo/mvLuoMLed0DyF+o01lOtoQKKVt3ZofFghg/O52:UxJG2ycsV6sGO52
TLSH
T1B112D97E722263375B820352651A6AC1F356A07936AF96C4606CD20D1393D2983FFADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 748d48d246526e2a79edcde87255ffa5387e3bcc94f6ca5e59589e07e683cd80
MD5 68ac216f38a5f7c823712c216ca4b060
SHA1 f6ad96e91103c40eb33fd3f1324d99093e5d014e
SHA512 9b7dce4ed6e2caee1cdb33e490e7062344d95d27ba48e96f66094a3413da27fb32680dd2e9a5b2091489780929c27fe36914210793fbef81dfb5b4fb1a9b469b
SSDEEP 24576:DUaoYNnzYpEIJgna0Axar763oeSzZXcanoJJdTz71n06fUcgk:DtzaEIG0aS4e6ZWt06M
TLSH
T1D35533D197C91268FC6E287739978A425B3BBE5EEE961F4147CCFC0F4B314A26431868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 326KB
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
SSDEEP 6144:rpF7LK5bwfYggoCQxltnoqhMQ3WxAOj+JzOgmx:j7Igvnoz0Wx8xe
TLSH
T11B64AE03F293C072D5A500B90569D7BA4E7A79715776C4F7AFD01AAC8E603E0AB3634E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3408-32-0x0000000007640000-0x0000000007643000-memory.dmp

Download

memory/3408-31-0x0000000010000000-0x0000000010144000-memory.dmp

Download

memory/3408-10-0x0000000000030000-0x0000000000418000-memory.dmp

Download

memory/3408-74-0x0000000000030000-0x0000000000418000-memory.dmp

Download

memory/3408-76-0x0000000010000000-0x0000000010144000-memory.dmp

Download

memory/3408-75-0x0000000000030000-0x0000000000418000-memory.dmp

Download

memory/3408-77-0x0000000007640000-0x0000000007643000-memory.dmp

Download

memory/3408-78-0x0000000000030000-0x0000000000418000-memory.dmp

Download

memory/3408-83-0x0000000010000000-0x0000000010144000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads