Overview

overview

8

Static

static

1

Windscribe...64.exe

windows10-2004-x64

5

Windscribe...64.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    61s
  • max time network
    67s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 11:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Windscribe_2.23.12_amd64.exe
  • Size 40.0MB
  • Sample260808-nz289awdle
  • SHA256 014aae3fddb8cfb858ff3e147d844e791621a61039a0d6aa9ea23db07fdaba3f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Drops file in System32 directory 32 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windscribe_2.23.12_amd64.exe
    "C:\Users\Admin\AppData\Local\Temp\Windscribe_2.23.12_amd64.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\7zr.exe
      "C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\7zr.exe" x -y -bb3 -bd -o"C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882" "C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\windscribeinstaller.7z"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
    • C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\Windscribe_2.23.12_amd64.exe
      "C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\Windscribe_2.23.12_amd64.exe"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3328
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /t /im windscribeopenvpn.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1520
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /t /im windscribewstunnel.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3564
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /t /im windscribectrld.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:236
      • C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\7zr.exe
        "C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\7zr.exe" x -y -bb3 -bd -o"C:\Program Files\Windscribe" "C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\windscribe.7z"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1008
      • C:\Program Files\Windscribe\devcon.exe
        "C:\Program Files\Windscribe\devcon.exe" dp_add openvpndco\win11\ovpn-dco.inf
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        PID:3980
      • C:\Program Files\Windscribe\devcon.exe
        "C:\Program Files\Windscribe\devcon.exe" dp_add tapwindows6\OemVista.inf
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        PID:4832
  • C:\Program Files\Windscribe\WindscribeService.exe
    "C:\Program Files\Windscribe\WindscribeService.exe"
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\system32\taskkill.exe
      C:\Windows\system32\taskkill.exe /f /t /im windscribeopenvpn.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:892
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c21951e3-720b-be4e-b3eb-974c2ceec668}\ovpn-dco.inf" "9" "4df7dbc87" "0000000000000170" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Windscribe\openvpndco\win11"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3624
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{882fa3bd-bf49-204f-9dad-f25f4dab508c}\OemVista.inf" "9" "4c577662b" "0000000000000168" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Windscribe\tapwindows6"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:4836
  • C:\Program Files\Windscribe\Windscribe.exe
    "C:\Program Files\Windscribe\Windscribe.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5456
    • C:\Windows\system32\taskkill.exe
      C:\Windows\system32\taskkill.exe /f /t /im windscribectrld.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3404

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ovpn-dco.cat
        • Path C:\PROGRA~1\WINDSC~1\OPENVP~1\win11\ovpn-dco.cat
        • Size 11KB
        • SHA256 fd66051a004582a47190503e67c4d2ad67e1312ea8b166536a04f3999f6b7be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ovpn-dco.sys
        • Path C:\PROGRA~1\WINDSC~1\OPENVP~1\win11\ovpn-dco.sys
        • Size 143KB
        • SHA256 4c677a57efbd2cbe40a9c29235446a8c2eaa0a4e32f648c7f195e0e660495392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tap0901.cat
        • Path C:\PROGRA~1\WINDSC~1\TAPWIN~1\tap0901.cat
        • Size 11KB
        • SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tap0901.sys
        • Path C:\PROGRA~1\WINDSC~1\TAPWIN~1\tap0901.sys
        • Size 40KB
        • SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallHelper.exe
        • Path C:\Program Files\Windscribe\InstallHelper.exe
        • Size 489KB
        • SHA256 3f0385d3dc8b4a3ccf7d05a94a08ccf044e4e3258f275c34774f3cff25b38876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Windscribe.exe
        • Path C:\Program Files\Windscribe\Windscribe.exe
        • Size 41.8MB
        • SHA256 e4e78c088cfd72aa513a5ec35ba5ac8b6b91bfa149a64253c50aa0935103e244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindscribeService.exe
        • Path C:\Program Files\Windscribe\WindscribeService.exe
        • Size 8.1MB
        • SHA256 f690ad5d11d47b8f35c823566b2a1456712e1b063d9565953e2b600319463114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WireguardService.exe
        • Path C:\Program Files\Windscribe\WireguardService.exe
        • Size 583KB
        • SHA256 de7b224aba904f4419b64b2220ec6fbe274b6c47becd265b77ce92c648cae66a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        devcon.exe
        • Path C:\Program Files\Windscribe\devcon.exe
        • Size 91KB
        • SHA256 ac41e1863ddfa921acf053e98348aa0f3485e4d13c41c8da7d0b90ef92a2f7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ovpn-dco.inf
        • Path C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf
        • Size 2KB
        • SHA256 f4ad125570e5e96da38ca0e6f35cb6c614b59d7d7f9844705595db78c29706a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        windscribesplittunnel.sys
        • Path C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys
        • Size 30KB
        • SHA256 8d76267f9c632801b64ccab24584e2ab60cb9d358c281a81cc80813b49426b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tapctl.exe
        • Path C:\Program Files\Windscribe\tapctl.exe
        • Size 159KB
        • SHA256 e38a0b4611dd734209b55183d01ef27255caef593ce6c322a9a3d32beda9ef1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OemVista.inf
        • Path C:\Program Files\Windscribe\tapwindows6\OemVista.inf
        • Size 7KB
        • SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstall.exe
        • Path C:\Program Files\Windscribe\uninstall.exe
        • Size 824KB
        • SHA256 036e86585c4863fef6334223dc5b758a791ab89590a60f6216937db4ea5d0acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windscribe-cli.exe
        • Path C:\Program Files\Windscribe\windscribe-cli.exe
        • Size 9.0MB
        • SHA256 976832a4f2afca7e3fe392dcc49b057f5b273840b5260147fe6031e08d50d98b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windscribectrld.exe
        • Path C:\Program Files\Windscribe\windscribectrld.exe
        • Size 7.1MB
        • SHA256 97e1ec194b0fa5d911d097a6bca3fe0c37846c81205488100a336cb10c7edd84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windscribeopenvpn.exe
        • Path C:\Program Files\Windscribe\windscribeopenvpn.exe
        • Size 6.0MB
        • SHA256 8f4e99cb4f345254b9b5dc1d1e2a830bc32bdaaf6c046f634cb494caa2f377e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windscribewstunnel.exe
        • Path C:\Program Files\Windscribe\windscribewstunnel.exe
        • Size 8.0MB
        • SHA256 1c115f70091250be8a52a3851c27095ab12e3a2afb8cf1c9d6905731ef2ce793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 63KB
        • SHA256 7aded73e5a19f60bd51aeff47194b1712c4dd4efb0f101ee66e34210328a4d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oemvista.inf_amd64_ba3e477187f1080b.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b.ini
        • Size 418B
        • SHA256 fefc3a607bc95745237407fcea3bc1bc8321ba40806171f890d54fb43e15675a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ovpn-dco.inf_amd64_9eb49abe443cc94d.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d.ini
        • Size 421B
        • SHA256 83d0ac3dcfcafb540876239229b87954a8515394438b3f57b08a00c67d167e53
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7zr.exe
        • Path C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\7zr.exe
        • Size 921KB
        • SHA256 f998608126c11ee1ce7d219777042799dbc5f22bf93031d4374b293ac5027022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windscribe.7z
        • Path C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\windscribe.7z
        • Size 31.7MB
        • SHA256 06a1abe0441db8aa74c1e2a014bdf75040d53fc673a25c8b80706e3610beabf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windscribeinstaller.7z
        • Path C:\Windows\Temp\WindscribeInstallerc47edd2ba3d97b309df80304246f0882\windscribeinstaller.7z
        • Size 38.4MB
        • SHA256 0a873825d94fcce9ab96b83ea904f83d27546b026ad187e664822c264de31114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download