86087f8ac1f51886794e2a903e64e36341aca0a463a5278b88b2c760a06a6f7e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
distroav-6.2.2-windows-x64-Installer.exe
Size 3.2MB
Sample261107-wvbvhady9v
SHA256 86087f8ac1f51886794e2a903e64e36341aca0a463a5278b88b2c760a06a6f7e
MD5 4a374264f0d7ea085ffefcd9a3df1999
SHA1 8395e314f8a31d7b806cdaca79ba2a99e16ac9ef
SHA512 424baaeb60b962466d1221fb96a812d3bc7476e8d64cff6efdfea71fec0d17091ceeb621182e90de7e4a49e8c48d13e9d62e88f422dfae387d94bb679e16d057
SSDEEP 49152:CuI2h6bFXobM3PerIHMvp/iO9vzXHVukzq8XE/5lodc:C5O6RYgmcHMDvL1ud5+c
TLSH
T1C8F5E03BB24B753EE06A16B539B2D134443BAE61A8124C1696E4EC8FFF354701D3E687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2436	netsh.exe
464	netsh.exe
4636	netsh.exe
5492	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
6008	distroav-6.2.2-windows-x64-Installer.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	distroav-6.2.2-windows-x64-Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	distroav-6.2.2-windows-x64-Installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5084-0-0x0000000000570000-0x00000000006A8000-memory.dmp	innosetup
behavioral2/memory/5084-8-0x0000000000570000-0x00000000006A8000-memory.dmp	innosetup
behavioral2/memory/5084-81-0x0000000000570000-0x00000000006A8000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6008	distroav-6.2.2-windows-x64-Installer.tmp
6008	distroav-6.2.2-windows-x64-Installer.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6008	distroav-6.2.2-windows-x64-Installer.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 6008	5084	distroav-6.2.2-windows-x64-Installer.exe	89
PID 6008 wrote to memory of 4636	6008	distroav-6.2.2-windows-x64-Installer.tmp	90
PID 6008 wrote to memory of 5492	6008	distroav-6.2.2-windows-x64-Installer.tmp	92
PID 6008 wrote to memory of 2436	6008	distroav-6.2.2-windows-x64-Installer.tmp	94
PID 6008 wrote to memory of 464	6008	distroav-6.2.2-windows-x64-Installer.tmp	96

C:\Users\Admin\AppData\Local\Temp\distroav-6.2.2-windows-x64-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\distroav-6.2.2-windows-x64-Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\is-S5S16EC3E6.tmp\distroav-6.2.2-windows-x64-Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-S5S16EC3E6.tmp\distroav-6.2.2-windows-x64-Installer.tmp" /SL5="$401C4,2117992,1219584,C:\Users\Admin\AppData\Local\Temp\distroav-6.2.2-windows-x64-Installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" advfirewall firewall delete rule name="OBS - DistroAV" dir=out
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" advfirewall firewall add rule name="OBS - DistroAV" dir=out action=allow program="{autopf}\obs-studio\bin\64bit\obs64.exe" description="Rules added by DistroAV installer for ease of use." enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5492
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" advfirewall firewall delete rule name="OBS - DistroAV" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2436
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" advfirewall firewall add rule name="OBS - DistroAV" dir=in action=allow program="{autopf}\obs-studio\bin\64bit\obs64.exe" description="Rules added by DistroAV installer for ease of use." enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

is-25G1TJ0LIV.tmp

Path C:\ProgramData\obs-studio\plugins\distroav\bin\64bit\is-25G1TJ0LIV.tmp
Size 610KB
SHA256 2a69ca6b1cea4401193f01e6f4c112d31f67869274bcbacdbbef3193e7abe696
MD5 0147ead851bbcd2a3fde10a456dde611
SHA1 8c63b606c5484ad0bb7afb2d56b3a2992b15999f
SHA512 3622c069099118bc0b43722ec32417b973fb797f7f75c9fbcb5c275e095c348c7781aed3e0978d24189e4d1886e4434b2351841fe34fce4841502b2319b51731
SSDEEP 6144:bakI8lv+r7fUOedU+LdLwCPsxA5OMWcN4sr6Mf/xj0dsLP17GcPyTWaOFjtef3/:bak1lWr7fUvLwCaNAK
TLSH
T133D4E61B72116A5FD96182F4C6C2C639E263FC40CF11D6AB02D5BE9B3E3729D7838946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-96Q1VMSIJM.tmp

Path C:\ProgramData\obs-studio\plugins\distroav\bin\64bit\is-96Q1VMSIJM.tmp
Size 4.5MB
SHA256 05841cc6b748b1bf33d9707dad177a38f975957d0cb43a45d23c60a0388f63e1
MD5 40a5fc890b3e4b97c1381b21cf19a5de
SHA1 41d28f86e5a35d7761875d9499fddbd048a47081
SHA512 d533b119f6ea665d9345e58421115267a91ddbfcc8c0ab8a5a86e4cca76ac417038c685f3e62b739f7461ca8de8f5d0cf9a2c815428fe00305daded673dfcf33
SSDEEP 49152:lfg/j9uokiSSUgrGRN/eStASOWYMdJjcVZT/cFQchsif4N9zM5YDBASTFXGEGVJY:wcASOWYMdJjDolR
TLSH
T12F2618B3E6818D23C4EE073AD08E031D2365DA06D7CF6FCF5148A6655ECA394EE6E641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

distroav-6.2.2-windows-x64-Installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-S5S16EC3E6.tmp\distroav-6.2.2-windows-x64-Installer.tmp
Size 4.5MB
SHA256 dd6fa67c7089cfa40dc30f4a3c6683756ef85e18db3afec3d4de25899b137571
MD5 a5272e695614a1d90eb65b40695cdcce
SHA1 1f7126df22f8cf69da9bdb3d6ba56ac837fd0629
SHA512 dd4adc6d5707ec8e678738b709b7d535088f4feedf060ef396541c85ef17481877abdbd9683623f7c71e8733f1b6e807c803a1b0066c2a8ca290d454dc5fa689
SSDEEP 98304:RYU5hnuOajWwMPdCpepI3GrwrA+Ju333z4:TxuHjWfZIzi4
TLSH
T16C266C03B248713EE4571A3A483BE2B4983F7E213A15CD4B6BE40D9FBE395416D2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5084-0-0x0000000000570000-0x00000000006A8000-memory.dmp

Download

memory/5084-8-0x0000000000570000-0x00000000006A8000-memory.dmp

Download

memory/5084-81-0x0000000000570000-0x00000000006A8000-memory.dmp

Download

memory/6008-6-0x00000000039A0000-0x00000000039A1000-memory.dmp

Download

memory/6008-10-0x00000000039A0000-0x00000000039A1000-memory.dmp

Download

memory/6008-9-0x0000000000F90000-0x0000000001423000-memory.dmp

Download

memory/6008-12-0x0000000000F90000-0x0000000001423000-memory.dmp

Download

memory/6008-79-0x0000000000F90000-0x0000000001423000-memory.dmp

Download

memory/6008-80-0x0000000000F90000-0x0000000001423000-memory.dmp

Download