Overview

overview

8

Static

static

3

FBI Setup.exe

windows10-2004-x64

6

FBI Setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 19:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FBI Setup.exe
  • Size 356KB
  • Sample260801-yaerrswvdt
  • SHA256 045e8a56e0aa269d862a5794d7f2bea1663be470dbd49c4f016a5481757714ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Boot or Logon Autostart Execution: Time Providers 1 TTPs 62 IoCs

    The Windows Time service (W32Time) enables time synchronization across and within domains.

    persistence
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 11 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 6 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\FBI Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\FBI Setup.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4388
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:616
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c WMIC CPU Get VirtualizationFirmwareEnabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC CPU Get VirtualizationFirmwareEnabled
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1564
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\VC_redist.x64.exe /setup /q /norestart 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\VC_redist.x64.exe
        C:\Windows\VC_redist.x64.exe /setup /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Windows\Temp\{FB9AFAAB-F9FC-4E10-8BBD-104C1D84DBFB}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{FB9AFAAB-F9FC-4E10-8BBD-104C1D84DBFB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Windows\VC_redist.x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /setup /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\Windows\Temp\{787A6CBB-A07C-44D0-A9D5-10D23A991731}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{787A6CBB-A07C-44D0-A9D5-10D23A991731}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2C558BED-FD9E-476B-9EDE-AEC8EEFB5D2B} {77C3ADB4-55EF-41FF-8CDD-4B6C6765A6D6} 4544
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3004
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\VC_redist.x86.exe /setup /q /norestart 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\VC_redist.x86.exe
        C:\Windows\VC_redist.x86.exe /setup /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2948
        • C:\Windows\Temp\{9CE45692-258E-485C-B910-E4CE255DDB96}\.cr\VC_redist.x86.exe
          "C:\Windows\Temp\{9CE45692-258E-485C-B910-E4CE255DDB96}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Windows\VC_redist.x86.exe" -burn.filehandle.attached=764 -burn.filehandle.self=768 /setup /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5800
          • C:\Windows\Temp\{2B8C448F-C548-459C-93F8-56DD33FF4FD7}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{2B8C448F-C548-459C-93F8-56DD33FF4FD7}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3E3A081D-BEB9-4B1E-A55E-67A86CBA53A5} {7B47FECD-A6BE-405A-B580-B7459D129305} 5800
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5824
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 1072
            5⤵
            • Program crash
            PID:616
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c w32tm /register 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\system32\w32tm.exe
        w32tm /register
        3⤵
        • Server Software Component: Terminal Services DLL
        • Boot or Logon Autostart Execution: Time Providers
        PID:5768
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop w32time 2>nul
      2⤵
      • Executes a command shell one-liner
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\system32\net.exe
        net stop w32time
        3⤵
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop w32time
          4⤵
          • System Time Discovery
          PID:3124
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c w32tm /unregister 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Windows\system32\w32tm.exe
        w32tm /unregister
        3⤵
          PID:2752
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c w32tm /register 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\system32\w32tm.exe
          w32tm /register
          3⤵
          • Server Software Component: Terminal Services DLL
          • Boot or Logon Autostart Execution: Time Providers
          PID:1836
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c net start w32time 2>nul
        2⤵
        • Executes a command shell one-liner
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\system32\net.exe
          net start w32time
          3⤵
          • System Time Discovery
          • Suspicious use of WriteProcessMemory
          PID:4528
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 start w32time
            4⤵
            • System Time Discovery
            PID:5960
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c w32tm /resync 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\system32\w32tm.exe
          w32tm /resync
          3⤵
            PID:2132
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic os get version | findstr /R "[0-9]\.[0-9]\.[0-9]"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic os get version
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1260
          • C:\Windows\system32\findstr.exe
            findstr /R "[0-9]\.[0-9]\.[0-9]"
            3⤵
              PID:5604
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:3096
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          1⤵
            PID:4444
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2740
          • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2400
            • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260801203519.log" /setup
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5300
              • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260801203519.log" /setup
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:704
                • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{99ED0F39-B383-4992-BDB5-93C10B73135A} {2D19B2BA-76B3-4D6D-B89E-C2968503287D} 704
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:684
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 1060
                  4⤵
                  • Program crash
                  PID:4496
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5800 -ip 5800
            1⤵
              PID:1692
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalService -s w32time
              1⤵
                PID:5984
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService
                1⤵
                  PID:2904
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 704 -ip 704
                  1⤵
                    PID:5796

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        e594d50.rbs
                        • Path C:\Config.Msi\e594d50.rbs
                        • Size 16KB
                        • SHA256 be1e5f8cc3cfa84541e85de1b3e93f62080591fb6ec7c43df967258390c3cc2e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e594d55.rbs
                        • Path C:\Config.Msi\e594d55.rbs
                        • Size 18KB
                        • SHA256 797f065aa0bd27bbd1a6ea7a8f1d413c2af0f68bb5c98f8bf045210769600c08
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e594d62.rbs
                        • Path C:\Config.Msi\e594d62.rbs
                        • Size 20KB
                        • SHA256 4b943c6b667e4180096d0f7b8f4c15789ee22ccb6324642316c4d548216fc998
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e594d71.rbs
                        • Path C:\Config.Msi\e594d71.rbs
                        • Size 19KB
                        • SHA256 6cb355a61aac7aa22b1e1bf1335a720c61dd2dd04efb4e6bc74360c95bff0995
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        state.rsm
                        • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
                        • Size 832B
                        • SHA256 28755435f45e6ad6d5e961caacff7fbef071c46b5197aa89b415cfc40379aac4
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        MSI97238.LOG
                        • Path C:\Users\Admin\AppData\Local\Temp\MSI97238.LOG
                        • Size 2KB
                        • SHA256 5c92d301bbb5b8dba8eebde9e44973c59e54db460dd110653176ff1a6271265c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        dd_vcredist_x86_20260801203519.log
                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260801203519.log
                        • Size 13KB
                        • SHA256 0dcf9a7960bea5fa80d4fb61984e4cfc142f855a4a9fa6f726ee38eb3cb47d8e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dd_vcredist_x86_20260801203519_000_vcRuntimeMinimum_x86.log
                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260801203519_000_vcRuntimeMinimum_x86.log
                        • Size 2KB
                        • SHA256 71f3aa471d09b8f95c6fa7a6f6f84c2a3a345585f54a9bf9b09fc45aeb0e9d3e
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        cab54A5CABBE7274D8A22EB58060AAB7623
                        • Path C:\Windows\Temp\{2B8C448F-C548-459C-93F8-56DD33FF4FD7}\cab54A5CABBE7274D8A22EB58060AAB7623
                        • Size 838KB
                        • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cabB3E1576D1FEFBB979E13B1A5379E0B16
                        • Path C:\Windows\Temp\{2B8C448F-C548-459C-93F8-56DD33FF4FD7}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                        • Size 4.9MB
                        • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcRuntimeAdditional_x86
                        • Path C:\Windows\Temp\{2B8C448F-C548-459C-93F8-56DD33FF4FD7}\vcRuntimeAdditional_x86
                        • Size 200KB
                        • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcRuntimeMinimum_x86
                        • Path C:\Windows\Temp\{2B8C448F-C548-459C-93F8-56DD33FF4FD7}\vcRuntimeMinimum_x86
                        • Size 200KB
                        • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        logo.png
                        • Path C:\Windows\Temp\{787A6CBB-A07C-44D0-A9D5-10D23A991731}\.ba\logo.png
                        • Size 1KB
                        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        wixstdba.dll
                        • Path C:\Windows\Temp\{787A6CBB-A07C-44D0-A9D5-10D23A991731}\.ba\wixstdba.dll
                        • Size 215KB
                        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_redist.x86.exe
                        • Path C:\Windows\Temp\{9CE45692-258E-485C-B910-E4CE255DDB96}\.cr\VC_redist.x86.exe
                        • Size 669KB
                        • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        license.rtf
                        • Path C:\Windows\Temp\{9D05144C-4CE5-48C7-984C-693EA98FD3E4}\.ba\license.rtf
                        • Size 9KB
                        • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        thm.wxl
                        • Path C:\Windows\Temp\{9D05144C-4CE5-48C7-984C-693EA98FD3E4}\.ba\thm.wxl
                        • Size 2KB
                        • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        thm.xml
                        • Path C:\Windows\Temp\{9D05144C-4CE5-48C7-984C-693EA98FD3E4}\.ba\thm.xml
                        • Size 8KB
                        • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_redist.x64.exe
                        • Path C:\Windows\Temp\{FB9AFAAB-F9FC-4E10-8BBD-104C1D84DBFB}\.cr\VC_redist.x64.exe
                        • Size 670KB
                        • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_redist.x64.exe
                        • Path C:\Windows\VC_redist.x64.exe
                        • Size 24.4MB
                        • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_redist.x86.exe
                        • Path C:\Windows\VC_redist.x86.exe
                        • Size 13.3MB
                        • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/2740-236-0x00000196DD120000-0x00000196DDAC4000-memory.dmp
                        Download