Overview

overview

8

Static

static

3

setup.exe

windows10-2004-x64

8

setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    72s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 18:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 8.0MB
  • Sample260626-w1mtyset3n
  • SHA256 8a79adfa41d7d052a2654262f3b64a4b9b02213950304f7488622ab68a8d3ba8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\Documents\Downloaded Installations\{BA25C03F-022A-427D-BFD1-2C1456A836C4}\Sentinel Protection Installer 7.6.6.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3928
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CC2715DC0A5EEE3B54413F20F28223F7 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:6104
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3496
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2F6671841CFDEBB5596FA2725E723E20
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe" -c installAll
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          PID:4744
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe" -c add
          3⤵
            PID:3272
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\System32\netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\SPSScript.dat"
              4⤵
                PID:1220
            • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe
              "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe" -c add
              3⤵
                PID:2564
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\script.dat"
                  4⤵
                    PID:4812
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:5684
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:5220
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3520
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4056
            • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
              "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3400
            • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
              "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:6004
            • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
              "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe"
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              PID:2516
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{6551a134-0953-bb41-8ef2-a8778f010fa6}\SNTUSB64.INF" "9" "49c45bedf" "00000000000001A0" "WinSta0\Default" "00000000000001A4" "208" "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:4620
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:1132

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    e5a013b.rbs
                    • Path C:\Config.Msi\e5a013b.rbs
                    • Size 154KB
                    • SHA256 05177e663278ea0d8f6f83e5299623ac6c41ae0ed73382d16c5423fdbed63dd9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SNTUSB64.SYS
                    • Path C:\PROGRA~2\COMMON~1\SAFENE~1\SENTIN~2\SNTUSB64.SYS
                    • Size 62KB
                    • SHA256 1b9f3bc4d2dc67ca6de11f02ae10dd09b47c64a1b4b7afe568acb1b6ac27cab4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sntusb64.cat
                    • Path C:\PROGRA~2\COMMON~1\SAFENE~1\SENTIN~2\sntusb64.cat
                    • Size 8KB
                    • SHA256 3e5b6279a5e1736e926585769282dd13740395a8943a6c7df3b6b66d777a9805
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MD5CHAP.dll
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\MD5CHAP.dll
                    • Size 216KB
                    • SHA256 7ffd9db225afc2a51993933b6ddce96ec84fd0958f2b7aaea8223978b24b5d2e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SHKSrvSupport.exe
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe
                    • Size 44KB
                    • SHA256 782e3d010bc97c882c97a6f74926ff7dfffe9441426284ae4479b2e5434d3e9f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sntlconfigsrvr.xml
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlconfigsrvr.xml
                    • Size 2KB
                    • SHA256 18e5d729e460e95f1724498fd2f6321e6b2efc71fc001c40f030bd8f85f263eb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sntlkeyssrvr.exe
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
                    • Size 368KB
                    • SHA256 3494faaa692b51a5f67a7b6c0312a41cc7a5b20797e6ebd177d3e2039fc4b69b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SPNSrvSupport.exe
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe
                    • Size 50KB
                    • SHA256 2a1ca1f2fb3e60140044f3c93b49cd91a45a1e0827126b41a82156290b7c1f47
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MD5CHAP.dll
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\MD5CHAP.dll
                    • Size 222KB
                    • SHA256 43b943437cb5d048f5fb515814abb72fd103f8257c061d7fba698355d72d3aab
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sntlconfigsrvr.xml
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\sntlconfigsrvr.xml
                    • Size 2KB
                    • SHA256 22e1214dbf3b9eb567a85df18f951db78a4a9d3b2de4ffe4410fa4272d80339e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    spnsrvnt.exe
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
                    • Size 1.2MB
                    • SHA256 6a0218a728556c82382a25e6b08fb6a0636530e54de433848c3386c2f1a217d8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sntlsrtsrvr.exe
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
                    • Size 286KB
                    • SHA256 aa9be99b66a192297efb8c5f38554c9f7c72e558f71ac454dba2cdb33182c663
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SNTUSB64.INF
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SNTUSB64.INF
                    • Size 2KB
                    • SHA256 6d45dc7acb11932e1ec95416472ae858549cfc073a596874d36b64677d377b37
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Sentinel64.cat
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\Sentinel64.cat
                    • Size 6KB
                    • SHA256 f7220da22f675b369d50b68fde0df017faa5f609fcddcc6669c3526911ecbdf5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SentinelDriverInstallSupport.exe
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe
                    • Size 69KB
                    • SHA256 b2f76ddac38c3e3786f1c6b5179e0216738b15d945a590a6e6e80f342b33af81
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SetupSysDriver.exe.manifest
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SetupSysDriver.exe.manifest
                    • Size 527B
                    • SHA256 438ddc8be2a7253566272133429d1f044f8146ece031dfcc87ca080e17068acc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sentinel64.sys
                    • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\sentinel64.sys
                    • Size 142KB
                    • SHA256 000a6f7f15177a08ed4e22db1c06f9ff0f8d324541a3e7af7f35123d9ca4122d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 599B
                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MSI1BAC.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\MSI1BAC.tmp
                    • Size 80KB
                    • SHA256 adb43809b9d164a220cf80045fcbb4aabd665f83715ac05def245ede8e0f1355
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI1CA7.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\MSI1CA7.tmp
                    • Size 128KB
                    • SHA256 b5db90d3cc7745c25985ed88ce83f83d255c3af539052371e9576befb7b1e505
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SPSScript.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\SPSScript.dat
                    • Size 192B
                    • SHA256 a116c4b117094c42881315b9a5f2e40b3ec7fbf28434fffc7b2bbf77297d4c9a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    0x0409.ini
                    • Path C:\Users\Admin\AppData\Local\Temp\_is42D\0x0409.ini
                    • Size 5KB
                    • SHA256 43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Sentinel Protection Installer 7.6.6.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\_is42D\Sentinel Protection Installer 7.6.6.msi
                    • Size 7.8MB
                    • SHA256 fe09671dbe00e939828240851a2c2e748cde2ad90513cbf0a02905c49765979c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ISMSIDEL.INI
                    • Path C:\Users\Admin\AppData\Local\Temp\_is42D\_ISMSIDEL.INI
                    • Size 137B
                    • SHA256 a9bffc2d27e47d8ef8bdc2e7b1fc9e05e9a7b0ab2e50ed36b4a795c9601ca355
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    script.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\script.dat
                    • Size 178B
                    • SHA256 ba69332934501aec8ad83e1b0450e21c8708e2826b70e06ce7c993742125fc6e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ~40D.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\~40D.tmp
                    • Size 2KB
                    • SHA256 109fe06402d0b524821bd952a1c7a7f7d493626c6769c55a567d95962a7ca6b5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 69KB
                    • SHA256 fd34645638057ef9b25b0090758d1c0cdd070c72b30c776e018ba63436aa25c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sntusb64.inf_amd64_66aa0ee786194734.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\sntusb64.inf_amd64_66aa0ee786194734.ini
                    • Size 419B
                    • SHA256 d9cafc949ba6f4c642dbe0709b64d426b7f04cf443955b337ad811d5129c14ba
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    metadata-2
                    • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                    • Size 26.1MB
                    • SHA256 b3032dc3e72c083e709d2d9accb18eb5b803b48093be04aeaac84993054fd0dd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    {f6f58a67-ed38-4b3a-a527-423f2bab9f65}_OnDiskSnapshotProp
                    • Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f6f58a67-ed38-4b3a-a527-423f2bab9f65}_OnDiskSnapshotProp
                    • Size 6KB
                    • SHA256 b15d25c6e3fddb3c0512775da678c75bc1186b54ed18849c531d09191f5e8610
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/3520-76-0x0000020D001E0000-0x0000020D002E0000-memory.dmp
                    Download

                    memory/3520-111-0x0000020D15000000-0x0000020D15100000-memory.dmp
                    Download

                    memory/3520-116-0x0000020D03E90000-0x0000020D03EB0000-memory.dmp
                    Download

                    memory/3520-141-0x0000020D15340000-0x0000020D15360000-memory.dmp
                    Download

                    memory/3520-110-0x0000020D03D10000-0x0000020D03D30000-memory.dmp
                    Download

                    memory/4056-271-0x0000012C00070000-0x0000012C0032C000-memory.dmp
                    Download

                    memory/4056-597-0x0000012C00070000-0x0000012C0032C000-memory.dmp
                    Download