Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:41
General
- Target Setup.exe$$.exe
- Size 27.2MB
- Sample261102-lnwk8at19l
- SHA256 fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe$$.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe$$.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T8FER.tmp\Setup.exe$$.tmp"C:\Users\Admin\AppData\Local\Temp\is-T8FER.tmp\Setup.exe$$.tmp" /SL5="$400A6,27675946,779264,C:\Users\Admin\AppData\Local\Temp\Setup.exe$$.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\is-V63C2.tmp\__exo.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n1twml24\n1twml24.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC172.tmp" "c:\Users\Admin\AppData\Local\Temp\n1twml24\CSC61F1D3E011874589B62A4E829424FFFF.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESC172.tmp
__PSScriptPolicyTest_mhu53cie.hwc.psm1
Setup.exe$$.tmp
__exo.ps1
n1twml24.dll
1.exe
deyi.dll
CSC61F1D3E011874589B62A4E829424FFFF.TMP
n1twml24.0.cs
n1twml24.cmdline
memory/3332-86-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3332-61-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3332-7-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3332-95-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3428-60-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3428-0-0x00000000004C2000-0x00000000004C3000-memory.dmp
memory/3428-96-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3428-1-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/6056-70-0x0000021238340000-0x000002123836A000-memory.dmp
memory/6056-51-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-62-0x0000021237860000-0x000002123798F000-memory.dmp
memory/6056-52-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-58-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-66-0x0000021237C00000-0x0000021237CB2000-memory.dmp
memory/6056-65-0x0000021237BE0000-0x0000021237BFE000-memory.dmp
memory/6056-53-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-67-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-68-0x00000212379B0000-0x00000212379BA000-memory.dmp
memory/6056-69-0x0000021237F10000-0x0000021237F2E000-memory.dmp
memory/6056-55-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-71-0x0000021238340000-0x0000021238364000-memory.dmp
memory/6056-59-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-47-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-48-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-46-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-45-0x000002121F2C0000-0x000002121F2E2000-memory.dmp
memory/6056-84-0x0000021237BE0000-0x0000021237BE8000-memory.dmp
memory/6056-44-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-43-0x00007FFD7C05F000-0x00007FFD7C060000-memory.dmp
memory/6056-88-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-92-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-91-0x0000021237860000-0x000002123798F000-memory.dmp
memory/6056-57-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp
memory/6056-56-0x00007FFD7BED0000-0x00007FFD7C874000-memory.dmp