Overview

overview

8

Static

static

3

setup.exe

windows10-2004-x64

8

setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 18:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 8.0MB
  • Sample260626-w2f3sset6m
  • SHA256 8a79adfa41d7d052a2654262f3b64a4b9b02213950304f7488622ab68a8d3ba8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 33 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6104
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\Documents\Downloaded Installations\{BA25C03F-022A-427D-BFD1-2C1456A836C4}\Sentinel Protection Installer 7.6.6.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5768
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2465E63DB4699A6206F0D447C8EC458F C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2984
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4920
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EF89A9B7853BCF7B2E184F67F1683E45
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe" -c installAll
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:3792
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe" -c add
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4284
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\SPSScript.dat"
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3732
        • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe
          "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe" -c add
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\script.dat"
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4476
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2616
    • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
      "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4228
    • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
      "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:5936
    • C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
      "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:5948
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{3854ed9c-4480-064e-9086-9a6bace31389}\SNTUSB64.INF" "9" "49c45bedf" "00000000000000E0" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5812
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:2636

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a0060.rbs
            • Path C:\Config.Msi\e5a0060.rbs
            • Size 154KB
            • SHA256 44f0a1aa4c80d384ea01252bc2650779a9826288d0a7690e8ef91b6692d7e64b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SNTUSB64.SYS
            • Path C:\PROGRA~2\COMMON~1\SAFENE~1\SENTIN~2\SNTUSB64.SYS
            • Size 62KB
            • SHA256 1b9f3bc4d2dc67ca6de11f02ae10dd09b47c64a1b4b7afe568acb1b6ac27cab4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sntusb64.cat
            • Path C:\PROGRA~2\COMMON~1\SAFENE~1\SENTIN~2\sntusb64.cat
            • Size 8KB
            • SHA256 3e5b6279a5e1736e926585769282dd13740395a8943a6c7df3b6b66d777a9805
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MD5CHAP.dll
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\MD5CHAP.dll
            • Size 216KB
            • SHA256 7ffd9db225afc2a51993933b6ddce96ec84fd0958f2b7aaea8223978b24b5d2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SHKSrvSupport.exe
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\SHKSrvSupport.exe
            • Size 44KB
            • SHA256 782e3d010bc97c882c97a6f74926ff7dfffe9441426284ae4479b2e5434d3e9f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sntlconfigsrvr.xml
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlconfigsrvr.xml
            • Size 2KB
            • SHA256 18e5d729e460e95f1724498fd2f6321e6b2efc71fc001c40f030bd8f85f263eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            sntlkeyssrvr.exe
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
            • Size 368KB
            • SHA256 3494faaa692b51a5f67a7b6c0312a41cc7a5b20797e6ebd177d3e2039fc4b69b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SPNSrvSupport.exe
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\SPNSrvSupport.exe
            • Size 50KB
            • SHA256 2a1ca1f2fb3e60140044f3c93b49cd91a45a1e0827126b41a82156290b7c1f47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MD5CHAP.dll
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\MD5CHAP.dll
            • Size 222KB
            • SHA256 43b943437cb5d048f5fb515814abb72fd103f8257c061d7fba698355d72d3aab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sntlconfigsrvr.xml
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\sntlconfigsrvr.xml
            • Size 2KB
            • SHA256 22e1214dbf3b9eb567a85df18f951db78a4a9d3b2de4ffe4410fa4272d80339e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            spnsrvnt.exe
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
            • Size 1.2MB
            • SHA256 6a0218a728556c82382a25e6b08fb6a0636530e54de433848c3386c2f1a217d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sntlsrtsrvr.exe
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
            • Size 286KB
            • SHA256 aa9be99b66a192297efb8c5f38554c9f7c72e558f71ac454dba2cdb33182c663
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SNTUSB64.INF
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SNTUSB64.INF
            • Size 2KB
            • SHA256 6d45dc7acb11932e1ec95416472ae858549cfc073a596874d36b64677d377b37
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Sentinel64.cat
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\Sentinel64.cat
            • Size 6KB
            • SHA256 f7220da22f675b369d50b68fde0df017faa5f609fcddcc6669c3526911ecbdf5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SentinelDriverInstallSupport.exe
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SentinelDriverInstallSupport.exe
            • Size 69KB
            • SHA256 b2f76ddac38c3e3786f1c6b5179e0216738b15d945a590a6e6e80f342b33af81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupSysDriver.exe.manifest
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\SetupSysDriver.exe.manifest
            • Size 527B
            • SHA256 438ddc8be2a7253566272133429d1f044f8146ece031dfcc87ca080e17068acc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            sentinel64.sys
            • Path C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel System Driver\sentinel64.sys
            • Size 142KB
            • SHA256 000a6f7f15177a08ed4e22db1c06f9ff0f8d324541a3e7af7f35123d9ca4122d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI4116.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI4116.tmp
            • Size 80KB
            • SHA256 adb43809b9d164a220cf80045fcbb4aabd665f83715ac05def245ede8e0f1355
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI4194.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI4194.tmp
            • Size 128KB
            • SHA256 b5db90d3cc7745c25985ed88ce83f83d255c3af539052371e9576befb7b1e505
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SPSScript.dat
            • Path C:\Users\Admin\AppData\Local\Temp\SPSScript.dat
            • Size 192B
            • SHA256 a116c4b117094c42881315b9a5f2e40b3ec7fbf28434fffc7b2bbf77297d4c9a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0x0409.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_is2CF3\0x0409.ini
            • Size 5KB
            • SHA256 43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Sentinel Protection Installer 7.6.6.msi
            • Path C:\Users\Admin\AppData\Local\Temp\_is2CF3\Sentinel Protection Installer 7.6.6.msi
            • Size 7.8MB
            • SHA256 fe09671dbe00e939828240851a2c2e748cde2ad90513cbf0a02905c49765979c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\_is2CF3\_ISMSIDEL.INI
            • Size 11B
            • SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
            • MD5 SHA1 SHA512
            Submit Download

            script.dat
            • Path C:\Users\Admin\AppData\Local\Temp\script.dat
            • Size 178B
            • SHA256 ba69332934501aec8ad83e1b0450e21c8708e2826b70e06ce7c993742125fc6e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ~2CE2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\~2CE2.tmp
            • Size 2KB
            • SHA256 109fe06402d0b524821bd952a1c7a7f7d493626c6769c55a567d95962a7ca6b5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 69KB
            • SHA256 a2844b3ebf45ea4d218c9a4fd2c08fd7c309b97f14dad425f06a78cb571726c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sntusb64.inf_amd64_66aa0ee786194734.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\sntusb64.inf_amd64_66aa0ee786194734.ini
            • Size 419B
            • SHA256 d9cafc949ba6f4c642dbe0709b64d426b7f04cf443955b337ad811d5129c14ba
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 4a2b79d3122b239ac4a7d0f13092856f1f9c290ad32faa0ce54486061e53f4be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {9594b7e5-efcf-4d7b-8d17-c78b622ed72c}_OnDiskSnapshotProp
            • Path \??\Volume{833668ed-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9594b7e5-efcf-4d7b-8d17-c78b622ed72c}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 65d230dc096c5fccf62243c4a78fd923636309c94c3f2fb3103bd3ecd88d14fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download