c3e8136abb1cb79cda5fcdda8fe60be161db4148f936fbb8c84f20cbe055ec39

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SimpleTTSReader-2.0.4-setup.exe
Size 22.9MB
Sample260601-ay45kacy2m
SHA256 c3e8136abb1cb79cda5fcdda8fe60be161db4148f936fbb8c84f20cbe055ec39
MD5 29287e8af6e3e80463cb63a15afd1f10
SHA1 3982a7b9740d80d30ddeb66080ac38ab47a8853e
SHA512 8ac37e8926e554e59074291d7fb61b4a158f1a2d33d93e2226a57c5799ae7b3787f7233eab276d97dc820321c761c6e42f193d21a9ad79581089638b8dd4f26c
SSDEEP 393216:HWfm8HD5r50O4ajfl0JseN6O/sN0wQZTbqrJarbZpKYtThnKlzW:HWfm8Vr50kreRE6F0SbjKYdhnsW
TLSH
T1CA3733B965E9CF3EE774A0B55029630C0BB194BE23253C7ACE1D5FA1C807D124AF85A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
3480	VC_redist.x64.exe
4412	VC_redist.x64.exe
1600	VC_redist.x64.exe

Loads dropped DLL 3 IoCs

pid	Process
1980	SimpleTTSReader-2.0.4-setup.exe
1980	SimpleTTSReader-2.0.4-setup.exe
4412	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Simple TTS Reader\VC_redist.x64.exe	SimpleTTSReader-2.0.4-setup.exe
File opened for modification	C:\Program Files\Simple TTS Reader\VC_redist.x64.exe	SimpleTTSReader-2.0.4-setup.exe
File created	C:\Program Files\Simple TTS Reader\simplettsreader.exe	SimpleTTSReader-2.0.4-setup.exe
File created	C:\Program Files\Simple TTS Reader\Changelog.txt	SimpleTTSReader-2.0.4-setup.exe
File created	C:\Program Files\Simple TTS Reader\License (Slint).html	SimpleTTSReader-2.0.4-setup.exe
File created	C:\Program Files\Simple TTS Reader\License.html	SimpleTTSReader-2.0.4-setup.exe
File created	C:\Program Files\Simple TTS Reader\Uninstall.exe	SimpleTTSReader-2.0.4-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleTTSReader-2.0.4-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000035d00ca4488ad7d50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000035d00ca40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090035d00ca4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a35d00ca4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d35d00ca4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85CBCC28-E397-4fcd-802E-100BE5F064A2}\LocalServer32	SimpleTTSReader-2.0.4-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	SimpleTTSReader-2.0.4-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85CBCC28-E397-4fcd-802E-100BE5F064A2}	SimpleTTSReader-2.0.4-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85CBCC28-E397-4fcd-802E-100BE5F064A2}\LocalServer32\ = "C:\\Program Files\\Simple TTS Reader\\simplettsreader.exe"	SimpleTTSReader-2.0.4-setup.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	1480	vssvc.exe
Token: SeRestorePrivilege	1480	vssvc.exe
Token: SeAuditPrivilege	1480	vssvc.exe
Token: SeBackupPrivilege	1612	srtasks.exe
Token: SeRestorePrivilege	1612	srtasks.exe
Token: SeSecurityPrivilege	1612	srtasks.exe
Token: SeTakeOwnershipPrivilege	1612	srtasks.exe
Token: SeBackupPrivilege	1612	srtasks.exe
Token: SeRestorePrivilege	1612	srtasks.exe
Token: SeSecurityPrivilege	1612	srtasks.exe
Token: SeTakeOwnershipPrivilege	1612	srtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3480	1980	SimpleTTSReader-2.0.4-setup.exe	80
PID 3480 wrote to memory of 4412	3480	VC_redist.x64.exe	81
PID 4412 wrote to memory of 1600	4412	VC_redist.x64.exe	82

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SimpleTTSReader-2.0.4-setup.exe
"C:\Users\Admin\AppData\Local\Temp\SimpleTTSReader-2.0.4-setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files\Simple TTS Reader\VC_redist.x64.exe
  "C:\Program Files\Simple TTS Reader\VC_redist.x64.exe" /quiet
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\Temp\{BC747E4D-E48A-4295-8A70-94E60490D221}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{BC747E4D-E48A-4295-8A70-94E60490D221}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Simple TTS Reader\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /quiet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\Temp\{A3B10E75-ACDB-44DC-A864-7BE5C1638B16}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{A3B10E75-ACDB-44DC-A864-7BE5C1638B16}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{00B8D9E5-01E4-4FC0-906E-EE2B6AC3A284} {F16E5FE3-BF95-44BA-97F4-53A8F1AF1E96} 4412
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VC_redist.x64.exe

Path C:\Program Files\Simple TTS Reader\VC_redist.x64.exe
Size 17.7MB
SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
MD5 23985a8a66ae306aedf0a9feb1a3d14b
SHA1 7ee9442ceaeef605ea66849f042b8410433c988d
SHA512 b618f601a1989a696c8efa0208efd977a3bfe9a8df8ace8fae9eef20262240e7eefcb67ce466fe166bdc606d80d594d2de80b3b4e530749aab8e99f5cecd86d4
SSDEEP 393216:Sr3bJsxx3E2DiCLwmQQp5MTFarWznCY1LHRqLJ:S3mx3D585AI+WDCYZHRw
TLSH
T1D717333160A0413BFBF51077B928A2202E7CE73C2B5598BAD7D8AD1D7D6A84147FB163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

simplettsreader.exe

Path C:\Program Files\Simple TTS Reader\simplettsreader.exe
Size 13.7MB
SHA256 84fc1ca2537cc8b0e389957e322afb525ed556d57936ac6bfbe6aff856005118
MD5 2d087195e97f3b9eec0fcf0774497cd1
SHA1 02d3850f9c29688a19d30445c69a7a4bf2f2a3e5
SHA512 7f5e58dafd2888e237f2c06ab26338a7e58fb1b22e3c25cb85c8b9d3d7d1a9cf321cc901c1d499f1772b3e11cbddca52cb8d362982f47e04177d54eef9f04cbe
SSDEEP 98304:jCgCmrGLf8USBjOWlheQS4Gcbf98L1Bu3AIchIOTmvV2UHBb6fshWU2:jlfLBiW+QS4piIQsVRHBb6Cw
TLSH
T1ECE65B42BAAB99ECD19AC470834696376A2134CF0B3579FB46C496383F79BE01F39315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv51C6.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsv51C6.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv51C6.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{A3B10E75-ACDB-44DC-A864-7BE5C1638B16}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{A3B10E75-ACDB-44DC-A864-7BE5C1638B16}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{BC747E4D-E48A-4295-8A70-94E60490D221}\.cr\VC_redist.x64.exe
Size 615KB
SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
MD5 e5237fba0388d7d5ac22e823da709438
SHA1 d772562f32eec346f0ba6260877a3caffc0d8dac
SHA512 af99bc56c4c1f1ed0fb4302a301a7a1a6a85baf8343e3abbfa38533085ffa3cc5fe5d004efeadb22daddc8f7800fb27b040eacbaece4a234b8fcf49e3a1e183a
SSDEEP 12288:P3mgqnIZuYfCYqFet4CovkM7wVYnEvIhqFxVKLxYGHLNJk:P3WnIZuMCxezot76gTqFxVKLxVk
TLSH
T11CD48D32A5614033F7F105B3B928A6303E7CE728275189A9D7D4BD1D7EA84C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads