Overview

overview

7

Static

static

1

Glacier.zip

windows10-ltsc_2021-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    06/08/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Glacier.zip
  • Size 35.5MB
  • Sample260806-2fa8basajh
  • SHA256 5b1723feb71e5b4ece2a286198148a9abe12233acaa2e63bc967200abf4f89f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionransomware

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Glacier.zip
    1⤵
      PID:1768
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4372
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Glacier.zip" -tzip
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1864
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\Glacier\Glacier Installer.msi"
        1⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3856
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:664
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
            PID:3448
          • C:\Windows\system32\cmd.exe
            cmd.exe /c start /b svchost.exe
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1720
            • C:\Users\Admin\AppData\Local\SystemService_1861\svchost.exe
              svchost.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3240
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 3240).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2424
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f"
                4⤵
                • Executes a command shell one-liner
                PID:4564
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2608
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 2608).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4416
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ukx2p3x\4ukx2p3x.cmdline"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2260
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF4C.tmp" "c:\Users\Admin\AppData\Local\Temp\4ukx2p3x\CSCB7B17769EF08478CBAF9376B61414E62.TMP"
                      7⤵
                        PID:2188
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4448

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e598ca7.rbs
                • Path C:\Config.Msi\e598ca7.rbs
                • Size 8KB
                • SHA256 78a41d8668dc0aa4b5048a4b8c26fd33c67840d4c9c4c6322b930a3b5a4ab318
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                .system
                • Path C:\Users\Admin\.system
                • Size 14B
                • SHA256 834cf0c79a1e741e381e74aadf5e5eb4d5a2a35840f31721a4306543ae164e4c
                • MD5 SHA1 SHA512
                Submit Download

                svchost.exe
                • Path C:\Users\Admin\AppData\Local\SystemService_1861\svchost.exe
                • Size 44.9MB
                • SHA256 752b9085647083fa76e2f32e036c9a6246c41e094cc8e81bbf5a8ef6bc403b4f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4ukx2p3x.dll
                • Path C:\Users\Admin\AppData\Local\Temp\4ukx2p3x\4ukx2p3x.dll
                • Size 3KB
                • SHA256 5423966e74b1f0b6393e8edf38c5247f9449167bd3f26aabbbfca21ebe14da5d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RESCF4C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RESCF4C.tmp
                • Size 1KB
                • SHA256 b2d64f5be6fcf54ace3c05fd3d4350d23b8f9dcd109f47b04293e824444d3917
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_reenhadl.rlm.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_reenhadl.rlm.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Glacier Installer.msi
                • Path C:\Users\Admin\Desktop\Glacier\Glacier Installer.msi
                • Size 45.0MB
                • SHA256 be002cdadb24b89a96e08cd8c214c60be08bc1bdb7ee6e7165be182398e91eaf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 24.0MB
                • SHA256 f07ebd10a9bd5ec7eaf2aebb753ea7f4b61c273606ad80ea86699876b66f0893
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                {aadb06fc-b375-4b96-8176-cc15bc22c2b0}_OnDiskSnapshotProp
                • Path \??\Volume{db4e272b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{aadb06fc-b375-4b96-8176-cc15bc22c2b0}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 97e159ac95adf9d2fb59c847f19b81feb3a690b5872131e0863f4d559ece8e18
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4ukx2p3x.0.cs
                • Path \??\c:\Users\Admin\AppData\Local\Temp\4ukx2p3x\4ukx2p3x.0.cs
                • Size 218B
                • SHA256 531c21f32b41b8651df1f844f1a6485b19926699ff33c80de4fc70a44882394c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                4ukx2p3x.cmdline
                • Path \??\c:\Users\Admin\AppData\Local\Temp\4ukx2p3x\4ukx2p3x.cmdline
                • Size 369B
                • SHA256 55e89d82b5e09228288b0c18313b3021d6635cc72c0297934d6612137b3bf419
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CSCB7B17769EF08478CBAF9376B61414E62.TMP
                • Path \??\c:\Users\Admin\AppData\Local\Temp\4ukx2p3x\CSCB7B17769EF08478CBAF9376B61414E62.TMP
                • Size 652B
                • SHA256 601c1659d6be05e77eddd51e45aeb4d7f96ca1e2196ec0a5b74c3e46ff31871a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/664-39-0x000001EE11D00000-0x000001EE127C2000-memory.dmp
                Download

                memory/2260-68-0x00000243A28A0000-0x00000243A3362000-memory.dmp
                Download

                memory/2424-42-0x0000024092750000-0x0000024093212000-memory.dmp
                Download

                memory/4416-49-0x00000157510B0000-0x00000157510D2000-memory.dmp
                Download

                memory/4416-70-0x00000157510A0000-0x00000157510A8000-memory.dmp
                Download

                memory/4416-73-0x0000015738260000-0x0000015738D22000-memory.dmp
                Download