Overview

overview

7

Static

static

3

CreamInstaller.exe

windows10-ltsc_2021-x64

7

Resubmissions

27/05/2026, 22:36

260527-2jqgeacx4y

27/05/2026, 22:26

260527-2cvsjsax5l7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    27/05/2026, 22:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CreamInstaller.exe
  • Size 159.3MB
  • Sample260527-2cvsjsax5l
  • SHA256 9ba98a3e279100d081b826f0cd7ee5df75544cab38256ba83b92847c533b869e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 42 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CreamInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\CreamInstaller.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:1936
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:540
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1220
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:700

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Microsoft.Win32.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\Microsoft.Win32.Primitives.dll
          • Size 14KB
          • SHA256 1570fe580286c2b2b8e997f6dea230f7f50f07e03e4440e63f0c6fea458436b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Win32.Registry.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\Microsoft.Win32.Registry.dll
          • Size 117KB
          • SHA256 2c90cef5d7c36f5fee1bbed8063c1e686fa32e6b6c82f80165b4a18ebc6a5907
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Win32.SystemEvents.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\Microsoft.Win32.SystemEvents.dll
          • Size 93KB
          • SHA256 1649a192d885852fccfca834c7ab6741aec98f26e4cffda023c926aa685c83c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Concurrent.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.Concurrent.dll
          • Size 269KB
          • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.NonGeneric.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.NonGeneric.dll
          • Size 101KB
          • SHA256 c144cafb2874da6cf94de5b3120be4f34533154a7fae0203f3be9edc0a711dff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Specialized.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.Specialized.dll
          • Size 101KB
          • SHA256 3007823d00ad51279893e51772ddcf146fce40201bc9f9cf67a7ac1b621b0401
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.dll
          • Size 253KB
          • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.EventBasedAsync.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.EventBasedAsync.dll
          • Size 45KB
          • SHA256 d2f0a49a8731011015438e15dbc7d5e98d4d828c64fe2915f146c3134b4af6c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.Primitives.dll
          • Size 77KB
          • SHA256 f740bcc73efcbc9d7ab10cfe3abe78e92192e65b07df75dd4147e170ee9ede0d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.TypeConverter.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.TypeConverter.dll
          • Size 729KB
          • SHA256 fe600112a6418ec6afe641141e12d1394d5865c1cf4f91d100319871d0903d99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.dll
          • Size 29KB
          • SHA256 d57264f04ff029a7056b7e4278fd817142ec020b3f97a4a3d354800b142c07cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Data.Common.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Data.Common.dll
          • Size 2.7MB
          • SHA256 c65afb676950f6e8d1d51b26c43322db919baded5756b898383d4164b0c2af58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.DiagnosticSource.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.DiagnosticSource.dll
          • Size 405KB
          • SHA256 563c02d0a5d56cc6ed16ef429703ca62a9b2d31b41c0f29d9f4a6d8955953c9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.Process.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.Process.dll
          • Size 329KB
          • SHA256 6c84154fc465ac4e8e94c6f1c977b58191e570e8ab2e4a8979def8abeb6fa565
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.TraceSource.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.TraceSource.dll
          • Size 141KB
          • SHA256 7a5f1222220ce740bf46fa4b1cf40e981104a783fb2fd8e22201020d74d0e814
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.Tracing.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.Tracing.dll
          • Size 15KB
          • SHA256 76434a3c74d78c183c0527da0335959df8a54a8f32022b2c7da1ac5f520e52f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Drawing.Common.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Drawing.Common.dll
          • Size 1.5MB
          • SHA256 d41e527283c5ea87117346458448834332cdd8631222690caa5aab5829677083
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Drawing.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Drawing.Primitives.dll
          • Size 129KB
          • SHA256 afd1c312e64e3e626e619bbbe763a815c742d73c9eddbaa7218f6c0d95c16675
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.Expressions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Linq.Expressions.dll
          • Size 3.5MB
          • SHA256 c1854099ec0a0ecd7c3a69a05eaf4006c4e514019d59adfa10c723f405a5e804
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Linq.dll
          • Size 529KB
          • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Memory.dll
          • Size 153KB
          • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.Http.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Http.dll
          • Size 1.7MB
          • SHA256 ef311434c054d83c585523d98a1708434fdcb82f26d4dd2af5033f4c1e2286f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.NameResolution.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.NameResolution.dll
          • Size 109KB
          • SHA256 c2869d6ac006715f559c131dc89e396ba5828af2a112c26e6fdfa751a5b30d38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Primitives.dll
          • Size 225KB
          • SHA256 5432189d2f8fd07663e97088758eb8da82a1ad6e5ddbc0b24d742e6ee023d0eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.Security.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Security.dll
          • Size 653KB
          • SHA256 001cc1d58ce48bbcaf8b170f41f35e1f878eadb0eac3a9889bdea6192095ef7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.Sockets.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Sockets.dll
          • Size 533KB
          • SHA256 04e36f3abd972d0206c32a04f00797fe79be081d188cdd1a34d6701f63b7c69e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ObjectModel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ObjectModel.dll
          • Size 77KB
          • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.Uri.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Private.Uri.dll
          • Size 253KB
          • SHA256 1bbc0db2701cd5ac75cdbfe151039f6682adb4c44e281b94ae103f37dcfd5d00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.Xml.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Private.Xml.dll
          • Size 7.6MB
          • SHA256 795f979ae1f5e42060be355fc4ee1a4aeb478fd15b194bca745e3847908252a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Resources.Extensions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Resources.Extensions.dll
          • Size 133KB
          • SHA256 68c86c160cb8acb481cd28e5b8b5b1ec876a2f087d316af0bff6b1e10e364123
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.InteropServices.dll
          • Size 93KB
          • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.Numerics.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.Numerics.dll
          • Size 321KB
          • SHA256 b8ab1b348fa3488448b3a0d94c22a82b31aed7cd65c90616c0bff290f3ddd4a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.Serialization.Formatters.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.Serialization.Formatters.dll
          • Size 301KB
          • SHA256 d47e9313bca3d4774203c88177e67b61512228d9466ec6e98ac8ec0877023cd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.Serialization.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.Serialization.Primitives.dll
          • Size 37KB
          • SHA256 7deef3601977c718346c6e846bc6e197b26b5f535e2dc6626373276fbea6ae0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.dll
          • Size 42KB
          • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Claims.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Security.Claims.dll
          • Size 97KB
          • SHA256 be08a2b7d3caecc99b425e98057c052f64243ab827c0b837c24fce9074fa997a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Cryptography.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Security.Cryptography.dll
          • Size 2.0MB
          • SHA256 a6b2e8bdf9768e762b38f96b5fe56963269f0338281b19d66653aee900c71b53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Principal.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Security.Principal.Windows.dll
          • Size 181KB
          • SHA256 35637cd4cfbf500043a4fdf19e800b6f18ee9fc062b5fe2b2c442ae801bfae59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Thread.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Threading.Thread.dll
          • Size 15KB
          • SHA256 bdb668c3df634e44accbe714d281253c4d62955177a8b1af0f09180a622be3c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Threading.dll
          • Size 81KB
          • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Windows.Forms.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Windows.Forms.Primitives.dll
          • Size 2.9MB
          • SHA256 fdff8b6988dc848872a2d06d8980cf6aeb47bf97e13cb772a14ab59f7a275846
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Windows.Forms.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Windows.Forms.dll
          • Size 12.9MB
          • SHA256 a920861ea1a101e5a226c3012d441cebf3f883deb17d62106e5369ab181844d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/540-582-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-584-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-583-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-581-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-580-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-579-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-585-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-575-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-574-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download

          memory/540-573-0x00000229BD7F0000-0x00000229BD7F1000-memory.dmp
          Download