Analysis
- user interaction
yes - max time kernel
80s - max time network
81s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
- submitted
10/11/2026, 23:12
General
- Target setup-win32-bundle_V2.exe
- Size 578KB
- Sample261110-267dfacb96
- SHA256 3bc16539ab5493a0a5a2b82bb1ae04a0ef9ad55147dbf83c00725e642c8d9d7b
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 29 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup-win32-bundle_V2.exe"C:\Users\Admin\AppData\Local\Temp\setup-win32-bundle_V2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{E2594883-7118-4DCB-88FA-61E7FF3D053D}\.cr\setup-win32-bundle_V2.exe"C:\Windows\Temp\{E2594883-7118-4DCB-88FA-61E7FF3D053D}\.cr\setup-win32-bundle_V2.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\setup-win32-bundle_V2.exe" -burn.filehandle.attached=576 -burn.filehandle.self=5922⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe"C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe"C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe"C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{a6be72df-746f-4723-bb46-f01ee6d7da89}\setup-win32-bundle.exe" -burn.filehandle.attached=568 -burn.filehandle.self=5763⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup-win32-bundle_V2.exe"C:\Users\Admin\AppData\Local\Temp\setup-win32-bundle_V2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{56CC9AC9-34F2-4DBC-AE87-6D651C616AB1}\.cr\setup-win32-bundle_V2.exe"C:\Windows\Temp\{56CC9AC9-34F2-4DBC-AE87-6D651C616AB1}\.cr\setup-win32-bundle_V2.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\setup-win32-bundle_V2.exe" -burn.filehandle.attached=756 -burn.filehandle.self=7602⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
9E84AE0062EF16E4A63F590F004C898C
F15827BEC5BABE89C21DCDAE77464BF1
103621DE9CD5414CC2538780B4B75751
9E84AE0062EF16E4A63F590F004C898C
F15827BEC5BABE89C21DCDAE77464BF1
state.rsm
logo.png
logoside.png
wixstdba.dll
BootstrapperApplicationData.xml
thm.wxl
thm.xml
setup-win32-bundle_V2.exe
memory/3308-115-0x0000000000070000-0x00000000000E9000-memory.dmp
memory/3308-191-0x0000000000070000-0x00000000000E9000-memory.dmp
memory/5852-116-0x0000000000070000-0x00000000000E9000-memory.dmp
memory/5852-129-0x0000000000070000-0x00000000000E9000-memory.dmp
memory/5852-131-0x0000000000070000-0x00000000000E9000-memory.dmp
memory/5852-190-0x0000000000070000-0x00000000000E9000-memory.dmp