Overview

overview

8

Static

static

3

SicherDesk-Setup.exe

windows10-2004-x64

7

SicherDesk-Setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    113s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SicherDesk-Setup.exe
  • Size 22.7MB
  • Sample260708-pg46kagv2n
  • SHA256 c118b1bc5870718131bbe5eb86fcf0076abd2ccc837e7c7cf604a93c4f9d74ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 55 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SicherDesk-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SicherDesk-Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RuntimeBroker_sicherdesk.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5616
    • C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe
      "C:\Users\Admin\AppData\Local\sicherdesk\.\SicherDesk.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe
        "C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe" --portable-service --portable-service-shmem-name=_portable_service_2440_c848b4a2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2300
        • C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe
          "C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_2440_c848b4a2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:3364
      • C:\Windows\system32\cmd.exe
        "cmd" /c "taskkill /F /IM RuntimeBroker_sicherdesk.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5440
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM RuntimeBroker_sicherdesk.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2548
      • C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe
        "C:\Users\Admin\AppData\Local\sicherdesk\.\SicherDesk.exe" --check-hwcodec-config
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:280
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5972
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5908
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5748
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 603B
        • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 595B
        • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SicherDesk.exe
        • Path C:\Users\Admin\AppData\Local\sicherdesk\SicherDesk.exe
        • Size 348KB
        • SHA256 ade1abdd5089f660fc9d382bc1fcaacc034907c1e31cb758fe3b2d6dbc22b045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.so
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\app.so
        • Size 12.7MB
        • SHA256 d846bc07fa0696965f4bff3beb9be29a710ac009000bbde9d470209e34197980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AssetManifest.bin
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\AssetManifest.bin
        • Size 4KB
        • SHA256 09582a818214f5bf67fec31ff76c3b588dd402b3298873eab05d580eec87fd69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FontManifest.json
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\FontManifest.json
        • Size 483B
        • SHA256 068f1cc96816fab157a6813ce233731e46bf661ad84d0018381fb58b19396886
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        address_book.ttf
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\assets\address_book.ttf
        • Size 1KB
        • SHA256 c725b18176aa78151e013222a9fc9c439a9a9106d6c061e8f617162a80a8b4f7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        checkbox-outline.svg
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\assets\checkbox-outline.svg
        • Size 856B
        • SHA256 b8520bb0397257021199d933bee9e047cf35347fa56fe615cdfba201294f87c0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        device_group.ttf
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\assets\device_group.ttf
        • Size 1KB
        • SHA256 757071e3671adac7f6fca290259e782ddaf8e5a8381cf14b6984b3f05c67412f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        icon.png
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\assets\icon.png
        • Size 49KB
        • SHA256 ce95e0bbcf37e8f5c0ebe1597b3be823069b9fc18dc5ea0330683626f6568ab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        more.ttf
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\assets\more.ttf
        • Size 1KB
        • SHA256 54d71ef06045813df9227bd03e97a082c4bf22def1483e8dd5343391508d5740
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tabbar.ttf
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\assets\tabbar.ttf
        • Size 2KB
        • SHA256 a17ca0a8f7d5aa5ea3f6380f3a282b98b3d66135bb0cee5d431082f560030db8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MaterialIcons-Regular.otf
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\flutter_assets\fonts\MaterialIcons-Regular.otf
        • Size 1.6MB
        • SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\sicherdesk\data\icudtl.dat
        • Size 760KB
        • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop_drop_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\desktop_drop_plugin.dll
        • Size 322KB
        • SHA256 5b6cc736ccb67d60a3d6201a342fd0c47780a4f250e4a76a0f6a0b50f500b88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop_multi_window_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\desktop_multi_window_plugin.dll
        • Size 386KB
        • SHA256 d392c0eda1e57c638eee95d2d8f458bbafea3abd04328cf4e2f739881ede2446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        file_selector_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\file_selector_windows_plugin.dll
        • Size 349KB
        • SHA256 97ec2ea9a74a5c0ce0d078f500680b3fe013cdaa0d1c749661fa4acd19e2426f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_custom_cursor_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\flutter_custom_cursor_plugin.dll
        • Size 312KB
        • SHA256 c3e37bc03d468dc7061b109963dbf57be0b95c75078e703d1394d82c69755030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_gpu_texture_renderer_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\flutter_gpu_texture_renderer_plugin.dll
        • Size 344KB
        • SHA256 64be9a18d14a6e934d90e7782875166e831504b0d178580ff0c8303602296ea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_windows.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\flutter_windows.dll
        • Size 17.2MB
        • SHA256 295d3767a5e5c4017f4877e67a4a8926178ecdfbb1196c3bd21ec5f5097f5ed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        librustdesk.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\librustdesk.dll
        • Size 34.5MB
        • SHA256 3926e830f1999dd41bce9e69ed44e56e1a558a4e827f423d0604b1dbca76e2bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        screen_retriever_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\screen_retriever_plugin.dll
        • Size 516KB
        • SHA256 fc989e7d9d1671832f859e7e96f1f748c7e3e781b79baa2e4bacce58bc387168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        texture_rgba_renderer_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\texture_rgba_renderer_plugin.dll
        • Size 321KB
        • SHA256 dd971c9f3b9d68b43bd682f9437d3ae31b9bd28c53642f3a272b3bc0117ca959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uni_links_desktop_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\uni_links_desktop_plugin.dll
        • Size 519KB
        • SHA256 f76a9b4aa7c3c522d17d21065114c0eda179529254810ab218c1754e7a66b289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        url_launcher_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\url_launcher_windows_plugin.dll
        • Size 325KB
        • SHA256 c0be77a85b66b01897b4c00b93b9d23d9317253f37dc1726416f120fcb4b7638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        window_manager_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\window_manager_plugin.dll
        • Size 545KB
        • SHA256 d61d0ec1abb89e95667956452cbb1e46199225d28583bc26d4edbecf4e61749d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        window_size_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sicherdesk\window_size_plugin.dll
        • Size 514KB
        • SHA256 4ce0d09cbb511dafa3537d87a5af4a77cfecf984edc40524ff35e8aca25af338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SicherDesk2.toml
        • Path C:\Users\Admin\AppData\Roaming\SicherDesk\config\SicherDesk2.toml
        • Size 126B
        • SHA256 60463d142d7b8af5295d8b9e72ee7ef79f03c505754bfb1faa5bc97b0538dccd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2440-154-0x000001CAC5D70000-0x000001CAC6A29000-memory.dmp
        Download

        memory/2440-151-0x000001CAC0490000-0x000001CAC0491000-memory.dmp
        Download

        memory/2440-153-0x000001CAC5D70000-0x000001CAC6A29000-memory.dmp
        Download

        memory/2440-152-0x000001CAC5D70000-0x000001CAC6A29000-memory.dmp
        Download

        memory/2440-155-0x000001CAC5B50000-0x000001CAC5B51000-memory.dmp
        Download

        memory/5748-373-0x000001AB03A00000-0x000001AB03A20000-memory.dmp
        Download

        memory/5748-390-0x000001AB14300000-0x000001AB14320000-memory.dmp
        Download

        memory/5748-351-0x000001AB001E0000-0x000001AB002E0000-memory.dmp
        Download

        memory/5748-350-0x000001AB001E0000-0x000001AB002E0000-memory.dmp
        Download

        memory/5748-349-0x000001AB001E0000-0x000001AB002E0000-memory.dmp
        Download

        memory/5748-363-0x000001AB03CA0000-0x000001AB03CC0000-memory.dmp
        Download

        memory/5748-369-0x000001AB03ED0000-0x000001AB03FD0000-memory.dmp
        Download

        memory/5908-555-0x000000000DD20000-0x000000000E59B000-memory.dmp
        Download