Overview

overview

8

Static

static

3

setup.exe

windows10-2004-x64

8

setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/06/2026, 18:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 8.0MB
  • Sample260626-w1mtyset3n
  • SHA256 8a79adfa41d7d052a2654262f3b64a4b9b02213950304f7488622ab68a8d3ba8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 43 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\Documents\Downloaded Installations\{BA25C03F-022A-427D-BFD1-2C1456A836C4}\Sentinel Protection Installer 7.6.6.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5924
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CCAA3DA2DCFE691A319A03D1BF3404B4 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5548
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4656
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D61B25AE10E5C62760A33194EF03B424
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe" -c installAll
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:5820
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe" -c add
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:728
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\SPSScript.dat"
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5624
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe" -c add
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4176
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\script.dat"
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1972
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2488
    • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
      "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4324
    • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
      "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1824
    • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
      "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:2692
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{ae5b5843-e251-d54f-a5de-47c3f3185f20}\SNTUSB64.INF" "9" "49c45bedf" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4212

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58eeb1.rbs
          • Path C:\Config.Msi\e58eeb1.rbs
          • Size 154KB
          • SHA256 b78d41b81ff653ee0393fec9a872cd3c39af2274211ab93226fe21dc5c6ebfa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SNTUSB64.SYS
          • Path C:\PROGRA~2\COMMON~1\SAFENE~1\SENTIN~2\SNTUSB64.SYS
          • Size 62KB
          • SHA256 1b9f3bc4d2dc67ca6de11f02ae10dd09b47c64a1b4b7afe568acb1b6ac27cab4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sntusb64.cat
          • Path C:\PROGRA~2\COMMON~1\SAFENE~1\SENTIN~2\sntusb64.cat
          • Size 8KB
          • SHA256 3e5b6279a5e1736e926585769282dd13740395a8943a6c7df3b6b66d777a9805
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MD5CHAP.dll
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\MD5CHAP.dll
          • Size 216KB
          • SHA256 7ffd9db225afc2a51993933b6ddce96ec84fd0958f2b7aaea8223978b24b5d2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SHKSrvSupport.exe
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe
          • Size 44KB
          • SHA256 782e3d010bc97c882c97a6f74926ff7dfffe9441426284ae4479b2e5434d3e9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sntlconfigsrvr.xml
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlconfigsrvr.xml
          • Size 2KB
          • SHA256 18e5d729e460e95f1724498fd2f6321e6b2efc71fc001c40f030bd8f85f263eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sntlkeyssrvr.exe
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
          • Size 368KB
          • SHA256 3494faaa692b51a5f67a7b6c0312a41cc7a5b20797e6ebd177d3e2039fc4b69b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPNSrvSupport.exe
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe
          • Size 50KB
          • SHA256 2a1ca1f2fb3e60140044f3c93b49cd91a45a1e0827126b41a82156290b7c1f47
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MD5CHAP.dll
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\MD5CHAP.dll
          • Size 222KB
          • SHA256 43b943437cb5d048f5fb515814abb72fd103f8257c061d7fba698355d72d3aab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sntlconfigsrvr.xml
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\sntlconfigsrvr.xml
          • Size 2KB
          • SHA256 22e1214dbf3b9eb567a85df18f951db78a4a9d3b2de4ffe4410fa4272d80339e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          spnsrvnt.exe
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
          • Size 1.2MB
          • SHA256 6a0218a728556c82382a25e6b08fb6a0636530e54de433848c3386c2f1a217d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sntlsrtsrvr.exe
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
          • Size 286KB
          • SHA256 aa9be99b66a192297efb8c5f38554c9f7c72e558f71ac454dba2cdb33182c663
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SNTUSB64.INF
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SNTUSB64.INF
          • Size 2KB
          • SHA256 6d45dc7acb11932e1ec95416472ae858549cfc073a596874d36b64677d377b37
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Sentinel64.cat
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\Sentinel64.cat
          • Size 6KB
          • SHA256 f7220da22f675b369d50b68fde0df017faa5f609fcddcc6669c3526911ecbdf5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SentinelDriverInstallSupport.exe
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe
          • Size 69KB
          • SHA256 b2f76ddac38c3e3786f1c6b5179e0216738b15d945a590a6e6e80f342b33af81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SetupSysDriver.exe.manifest
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SetupSysDriver.exe.manifest
          • Size 527B
          • SHA256 438ddc8be2a7253566272133429d1f044f8146ece031dfcc87ca080e17068acc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sentinel64.sys
          • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\sentinel64.sys
          • Size 142KB
          • SHA256 000a6f7f15177a08ed4e22db1c06f9ff0f8d324541a3e7af7f35123d9ca4122d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI48BC.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI48BC.tmp
          • Size 80KB
          • SHA256 adb43809b9d164a220cf80045fcbb4aabd665f83715ac05def245ede8e0f1355
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI48FD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI48FD.tmp
          • Size 128KB
          • SHA256 b5db90d3cc7745c25985ed88ce83f83d255c3af539052371e9576befb7b1e505
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPSScript.dat
          • Path C:\Users\Admin\AppData\Local\Temp\SPSScript.dat
          • Size 192B
          • SHA256 a116c4b117094c42881315b9a5f2e40b3ec7fbf28434fffc7b2bbf77297d4c9a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          0x0409.ini
          • Path C:\Users\Admin\AppData\Local\Temp\_is39C9\0x0409.ini
          • Size 5KB
          • SHA256 43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Sentinel Protection Installer 7.6.6.msi
          • Path C:\Users\Admin\AppData\Local\Temp\_is39C9\Sentinel Protection Installer 7.6.6.msi
          • Size 7.8MB
          • SHA256 fe09671dbe00e939828240851a2c2e748cde2ad90513cbf0a02905c49765979c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\_is39C9\_ISMSIDEL.INI
          • Size 262B
          • SHA256 375b1bc7063f7d78f2de2d4f30b2cf1b03439ed75eb297e2a74e749d15502f65
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\_is39C9\_ISMSIDEL.INI
          • Size 9B
          • SHA256 39dc0aa1c73f37aca1528e6b1dbece97e523cd1324e9b577f5dc5e2217197868
          • MD5 SHA1 SHA512
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\_is39C9\_ISMSIDEL.INI
          • Size 11B
          • SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
          • MD5 SHA1 SHA512
          Submit Download

          script.dat
          • Path C:\Users\Admin\AppData\Local\Temp\script.dat
          • Size 178B
          • SHA256 ba69332934501aec8ad83e1b0450e21c8708e2826b70e06ce7c993742125fc6e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ~39B8.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~39B8.tmp
          • Size 2KB
          • SHA256 109fe06402d0b524821bd952a1c7a7f7d493626c6769c55a567d95962a7ca6b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 37KB
          • SHA256 cca8f2036619759a874a38b17734b59db4fe182b96bccd8ba0990f3547450ce5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 4b6aa4fe2e9888d77f9432723eb441e876f8c36ba56415467981baa5dd08c402
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {998749e7-eda8-46ee-8f99-87bcebcaa2bf}_OnDiskSnapshotProp
          • Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{998749e7-eda8-46ee-8f99-87bcebcaa2bf}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 fd367d9276446c428c886a7cc35d3e208724dafc36b95557e2e900fffa355707
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download