Overview

overview

7

Static

static

3

ImageLight...up.exe

windows10-2004-x64

7

ImageLight...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 18:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ImageLightBox-win-Setup.exe
  • Size 22.5MB
  • Sample261107-xkl36aev2z
  • SHA256 7e09cf17fc5f43da5e65f42c55bcc9a887f8df5d0e13de7e91e46675f6d545cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ImageLightBox-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\ImageLightBox-win-Setup.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Users\Admin\Downloads\inst-dotnet-10.0.0-X64-WindowsDesktop.exe
      "C:\Users\Admin\Downloads\inst-dotnet-10.0.0-X64-WindowsDesktop.exe" /norestart /passive /showrmui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2AC1D9F0-59F1-4C09-93C4-86E914CE9274} {8117B946-909F-40E1-B7FE-ABFED1B987AD}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:2912
      • C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
        "C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{CFBCBE55-FD3B-42DC-9372-6825CBB5FAA5} {42E67DA2-E657-40AA-9094-77A0390EEB00} 1044
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2516
  • C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
      "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107185514.log" /passive /norestart /showrmui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\TEMP\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6D23A5E3-2801-4D80-BDD9-4E83AB3C8FBB} {5FAB8F00-A0F2-4682-8478-3010B181B40D}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:5700
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding E99AB32B49495F1B047DE94E67ED5380
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3612

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DotNetRuntime
        • Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
        • Size 28.1MB
        • SHA256 36c8067684aeb83228b44ecb3d4c103379017ca87e3e007e51105a91e404d97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107185514.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107185514.log
        • Size 24KB
        • SHA256 b15732173f5d10f9f771b9dcedaaada5a07d0551745e31a4fc5c2fcd8b7fb45f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107185514_000_DotNetHost.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107185514_000_DotNetHost.log
        • Size 4KB
        • SHA256 42c77fc0c5ff510b416a0a60c2038a935ffa655636e42611b212555803110091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetHost
        • Path C:\Users\Admin\AppData\Local\Temp\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\DotNetHost
        • Size 848KB
        • SHA256 abf9056691ac5c463120c59943bcc7b3ff8cc45e9430f5260d6383108f0f2839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetHostFxr
        • Path C:\Users\Admin\AppData\Local\Temp\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\DotNetHostFxr
        • Size 920KB
        • SHA256 b26eb4b947543ee2becaf5f71d8736f5bbdcb340eb1259856bdaf64bc11c7782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsDesktopRuntime
        • Path C:\Users\Admin\AppData\Local\Temp\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\WindowsDesktopRuntime
        • Size 28.7MB
        • SHA256 cd1659987ad005184e83139f89fd0f073005916311f3426ae2152e0fc942a2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI92FF.tmp
        • Path C:\Windows\Installer\MSI92FF.tmp
        • Size 411KB
        • SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperApplicationData.xml
        • Path C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\BootstrapperApplicationData.xml
        • Size 9KB
        • SHA256 2994ce2de1b0a3527527b3e0e914d389fd9f4d9dbc1e22f30b1f385c8565e525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetLogo_256x.png
        • Path C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\DotNetLogo_256x.png
        • Size 2KB
        • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dotnet.ico
        • Path C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\dotnet.ico
        • Size 44KB
        • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\thm.wxl
        • Size 7KB
        • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\TEMP\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\thm.xml
        • Size 11KB
        • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.exe
        • Path C:\Windows\Temp\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.ba\wixstdba.exe
        • Size 431KB
        • SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windowsdesktop-runtime-10.0.14-win-x64.exe
        • Path C:\Windows\Temp\{3547F19E-14FC-4F97-AE01-DD0494D5B9A1}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
        • Size 968KB
        • SHA256 4234cb04b518dd990fd7053a16584dc37400465686ec0ef288d410e3ba304f17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1028\thm.wxl
        • Size 7KB
        • SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1029\thm.wxl
        • Size 7KB
        • SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1031\thm.wxl
        • Size 7KB
        • SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1036\thm.wxl
        • Size 8KB
        • SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1040\thm.wxl
        • Size 7KB
        • SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1041\thm.wxl
        • Size 8KB
        • SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1042\thm.wxl
        • Size 7KB
        • SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1045\thm.wxl
        • Size 7KB
        • SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1046\thm.wxl
        • Size 7KB
        • SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1049\thm.wxl
        • Size 9KB
        • SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\1055\thm.wxl
        • Size 7KB
        • SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\2052\thm.wxl
        • Size 7KB
        • SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\3082\thm.wxl
        • Size 7KB
        • SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperExtensionData.xml
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\BootstrapperExtensionData.xml
        • Size 276B
        • SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        license.rtf
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\license.rtf
        • Size 215B
        • SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{F70486C8-37B1-4C76-B97F-7AE963797F1E}\.ba\logo.png
        • Size 852B
        • SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4600-147-0x0000000000250000-0x0000000000316000-memory.dmp
        Download

        memory/4600-124-0x0000000000250000-0x0000000000316000-memory.dmp
        Download