Overview

overview

8

Static

static

3

CreamInstaller.exe

windows10-2004-x64

7

CreamInstaller.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    13s
  • max time network
    31s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 17:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CreamInstaller.exe
  • Size 159.3MB
  • Sample260703-wb4feaat2k
  • SHA256 9ba98a3e279100d081b826f0cd7ee5df75544cab38256ba83b92847c533b869e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 26 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CreamInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\CreamInstaller.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:5140
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4400
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:2856
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
        PID:2192

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 591B
            • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft.Win32.Registry.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\Microsoft.Win32.Registry.dll
            • Size 117KB
            • SHA256 2c90cef5d7c36f5fee1bbed8063c1e686fa32e6b6c82f80165b4a18ebc6a5907
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Win32.SystemEvents.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\Microsoft.Win32.SystemEvents.dll
            • Size 93KB
            • SHA256 1649a192d885852fccfca834c7ab6741aec98f26e4cffda023c926aa685c83c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Concurrent.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.Concurrent.dll
            • Size 269KB
            • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.NonGeneric.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.NonGeneric.dll
            • Size 101KB
            • SHA256 c144cafb2874da6cf94de5b3120be4f34533154a7fae0203f3be9edc0a711dff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Specialized.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.Specialized.dll
            • Size 101KB
            • SHA256 3007823d00ad51279893e51772ddcf146fce40201bc9f9cf67a7ac1b621b0401
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Collections.dll
            • Size 253KB
            • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.EventBasedAsync.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.EventBasedAsync.dll
            • Size 45KB
            • SHA256 d2f0a49a8731011015438e15dbc7d5e98d4d828c64fe2915f146c3134b4af6c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.Primitives.dll
            • Size 77KB
            • SHA256 f740bcc73efcbc9d7ab10cfe3abe78e92192e65b07df75dd4147e170ee9ede0d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.TypeConverter.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.TypeConverter.dll
            • Size 729KB
            • SHA256 fe600112a6418ec6afe641141e12d1394d5865c1cf4f91d100319871d0903d99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ComponentModel.dll
            • Size 29KB
            • SHA256 d57264f04ff029a7056b7e4278fd817142ec020b3f97a4a3d354800b142c07cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Data.Common.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Data.Common.dll
            • Size 2.7MB
            • SHA256 c65afb676950f6e8d1d51b26c43322db919baded5756b898383d4164b0c2af58
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.DiagnosticSource.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.DiagnosticSource.dll
            • Size 405KB
            • SHA256 563c02d0a5d56cc6ed16ef429703ca62a9b2d31b41c0f29d9f4a6d8955953c9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.Process.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.Process.dll
            • Size 329KB
            • SHA256 6c84154fc465ac4e8e94c6f1c977b58191e570e8ab2e4a8979def8abeb6fa565
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.TraceSource.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Diagnostics.TraceSource.dll
            • Size 141KB
            • SHA256 7a5f1222220ce740bf46fa4b1cf40e981104a783fb2fd8e22201020d74d0e814
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Drawing.Common.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Drawing.Common.dll
            • Size 1.5MB
            • SHA256 d41e527283c5ea87117346458448834332cdd8631222690caa5aab5829677083
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Drawing.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Drawing.Primitives.dll
            • Size 129KB
            • SHA256 afd1c312e64e3e626e619bbbe763a815c742d73c9eddbaa7218f6c0d95c16675
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.Expressions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Linq.Expressions.dll
            • Size 3.5MB
            • SHA256 c1854099ec0a0ecd7c3a69a05eaf4006c4e514019d59adfa10c723f405a5e804
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Linq.dll
            • Size 529KB
            • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Memory.dll
            • Size 153KB
            • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Net.Http.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Http.dll
            • Size 1.7MB
            • SHA256 ef311434c054d83c585523d98a1708434fdcb82f26d4dd2af5033f4c1e2286f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Net.NameResolution.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.NameResolution.dll
            • Size 109KB
            • SHA256 c2869d6ac006715f559c131dc89e396ba5828af2a112c26e6fdfa751a5b30d38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Net.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Primitives.dll
            • Size 225KB
            • SHA256 5432189d2f8fd07663e97088758eb8da82a1ad6e5ddbc0b24d742e6ee023d0eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Net.Security.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Security.dll
            • Size 653KB
            • SHA256 001cc1d58ce48bbcaf8b170f41f35e1f878eadb0eac3a9889bdea6192095ef7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Net.Sockets.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Net.Sockets.dll
            • Size 533KB
            • SHA256 04e36f3abd972d0206c32a04f00797fe79be081d188cdd1a34d6701f63b7c69e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ObjectModel.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.ObjectModel.dll
            • Size 77KB
            • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.CoreLib.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Private.CoreLib.dll
            • Size 12.6MB
            • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Uri.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Private.Uri.dll
            • Size 253KB
            • SHA256 1bbc0db2701cd5ac75cdbfe151039f6682adb4c44e281b94ae103f37dcfd5d00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Xml.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Private.Xml.dll
            • Size 7.6MB
            • SHA256 795f979ae1f5e42060be355fc4ee1a4aeb478fd15b194bca745e3847908252a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Resources.Extensions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Resources.Extensions.dll
            • Size 133KB
            • SHA256 68c86c160cb8acb481cd28e5b8b5b1ec876a2f087d316af0bff6b1e10e364123
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.InteropServices.dll
            • Size 93KB
            • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.Numerics.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.Numerics.dll
            • Size 321KB
            • SHA256 b8ab1b348fa3488448b3a0d94c22a82b31aed7cd65c90616c0bff290f3ddd4a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.Serialization.Formatters.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.Serialization.Formatters.dll
            • Size 301KB
            • SHA256 d47e9313bca3d4774203c88177e67b61512228d9466ec6e98ac8ec0877023cd4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.Serialization.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Runtime.Serialization.Primitives.dll
            • Size 37KB
            • SHA256 7deef3601977c718346c6e846bc6e197b26b5f535e2dc6626373276fbea6ae0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Security.Claims.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Security.Claims.dll
            • Size 97KB
            • SHA256 be08a2b7d3caecc99b425e98057c052f64243ab827c0b837c24fce9074fa997a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Security.Cryptography.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Security.Cryptography.dll
            • Size 2.0MB
            • SHA256 a6b2e8bdf9768e762b38f96b5fe56963269f0338281b19d66653aee900c71b53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Security.Principal.Windows.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Security.Principal.Windows.dll
            • Size 181KB
            • SHA256 35637cd4cfbf500043a4fdf19e800b6f18ee9fc062b5fe2b2c442ae801bfae59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Threading.dll
            • Size 81KB
            • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Windows.Forms.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Windows.Forms.Primitives.dll
            • Size 2.9MB
            • SHA256 fdff8b6988dc848872a2d06d8980cf6aeb47bf97e13cb772a14ab59f7a275846
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Windows.Forms.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\YsJ7y5N7EnkLR_eVL5iom3SYZOdsZI0=\System.Windows.Forms.dll
            • Size 12.9MB
            • SHA256 a920861ea1a101e5a226c3012d441cebf3f883deb17d62106e5369ab181844d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2192-593-0x0000020080100000-0x0000020080200000-memory.dmp
            Download

            memory/2192-636-0x0000020094540000-0x0000020094560000-memory.dmp
            Download

            memory/2192-592-0x0000020080100000-0x0000020080200000-memory.dmp
            Download

            memory/2192-601-0x0000020083CF0000-0x0000020083DF0000-memory.dmp
            Download

            memory/2192-604-0x0000020083B30000-0x0000020083B50000-memory.dmp
            Download

            memory/2192-600-0x0000020083900000-0x0000020083920000-memory.dmp
            Download

            memory/2856-744-0x000001C655090000-0x000001C6554C4000-memory.dmp
            Download