11b3a760fc0dc63b76e32f0436b04fb59bcb3e33dba64fa172b48b0eb09e76b9

Analysis

user interaction
yes
max time kernel
269s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 543KB
Sample261110-enqlmscg55
SHA256 11b3a760fc0dc63b76e32f0436b04fb59bcb3e33dba64fa172b48b0eb09e76b9
MD5 57c862882899199d2d76912a1bf685aa
SHA1 eee1509477f98bb3e9e536998d7eb0c294fdd76d
SHA512 047397aae853f11a184e03da95cf04759b005499fdb02029cca18956b75cbc942944c3519050859c9c1088e8259f17e7edc64d7a9074da8f6aba9209581d4898
SSDEEP 12288:HMOm++g05n4/0zIF/F9ywG6pveMb01JQntLOCQeC:HMOm++4mUcwjvemQe
TLSH
T1DAC4F61366DCBCB5E17216B0AB7B97E18B7EFC205A30C58F23C0055D5A7C5C2BA21B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "WO186DMLQZ76XDN7BEN5R51Z"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "N7WHGG851Q7MC2NZG8TEECDX"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "EQ2E10B98ZR87T59VGGW4O3E"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 1720	5168	setup.exe	89

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Skyline-daily.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G1C49BAA.YYA\ZXPVTT0C.YKX\Skyline-daily.exe.manifest
Size 195KB
SHA256 5911efeba249a36fa2a021ff47229194b48c639ceac135564572cc7f2dfec2bc
MD5 dd0813940e21421b5d7df6cf1a2d672e
SHA1 a9d1c5a7dadcdfbc43253fb99c64387c161ff97c
SHA512 a99d74d76f6321dce7f79d79413541ca3d2e23e273970a13fd5653ab9085b554e27971fca3ae3d360c65576fb209741d1c8780176a2d1319c21a08ab47dd7e92
SSDEEP 768:tF05tueakQ/w56P3MSZrJ4mra9xhzWfJC3riC7Yw8j0Za5zThJ0Dx3Et167wTkfw:qG//cSZrSUEyfJWiNaIZWDxrWsU
TLSH
T13714AC5688C07D21533691D8FFE2D924FE017B23417F158ABC4D1AEF5FA2448AAC72B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PQDHQBO8.484.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\W0QJ2X84.C6W\PQDHQBO8.484.application
Size 19KB
SHA256 bec9eb51397193b558d49df4f7800dd71ce325d37dfd0b4613c168c70b04360c
MD5 06a04dd7d2bb15948f6e997720c50dfc
SHA1 3453281ecfa89541cfa006d223efaf13b9ec18c9
SHA512 e483a3b15285a1e8de504202c802068361fac0bfe176275450ba17395626478f08e85d70c97b3b867d5b026cf93ad201574d983b75aa0ba94f5e51830b4d1552
SSDEEP 384:N9hURrWwmovZEM7YC6Ip1PguC1bS4VkTkM5jlSf:y5ThJ0CjPmbS4VR/f
TLSH
T12F928E5ECEC26C555316E120BBE3511A558827A38CFD449DBD9A290F4B8CF7322732CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-18-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-19-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-13-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-14-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-16-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-17-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-9-0x00007FF8C49BF000-0x00007FF8C49C0000-memory.dmp

Download

memory/1720-12-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-20-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-11-0x00000207F28F0000-0x00000207F2A78000-memory.dmp

Download

memory/1720-23-0x00000207F7070000-0x00000207F70C0000-memory.dmp

Download

memory/1720-10-0x00000207D8140000-0x00000207D8148000-memory.dmp

Download

memory/1720-45-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

memory/1720-46-0x00007FF8C4830000-0x00007FF8C51D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads