Analysis
- user interaction
yes - max time kernel
143s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 15:16
General
- Target adguardVPNInstaller.exe
- Size 111KB
- Sample260815-snf9vsdm6x
- SHA256 fac72095a06474a8fb5a77dd72fd7a5b91e3184e1b0d4afa5f647e9fec656dba
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 3 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 10 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adguardVPNInstaller.exe"C:\Users\Admin\AppData\Local\Temp\adguardVPNInstaller.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adguard\setup.exeC:\Users\Admin\AppData\Local\Temp\adguard\setup.exe AID=18675_pagevpn_com2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{3DD8B0B8-204C-40AD-AB35-311459631E97}\.cr\setup.exe"C:\Windows\Temp\{3DD8B0B8-204C-40AD-AB35-311459631E97}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=788 -burn.filehandle.self=924 AID=18675_pagevpn_com3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{7F6268F3-6745-46A2-BE53-A5CD71225B45}\.be\adGuardVpnSetup.exe"C:\Windows\Temp\{7F6268F3-6745-46A2-BE53-A5CD71225B45}\.be\adGuardVpnSetup.exe" -q -burn.elevated BurnPipe.{55E0EA9A-80A1-4055-B665-B3353821C1D4} {BBD5A0C8-39D0-4766-A448-28ED3AA51FBF} 13404⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F2CEEF5EE6B9425D90F8F47551F44C972⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIABAE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240890109 2 AdGuardVpn.CustomActions!AdGuardVpn.CustomActions.CustomActions.OnFirstInstall3⤵
-
-
-
C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe"C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe"C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\AdguardVPN\AdguardVPN_20260815161641.log" AID=18675_pagevpn_com2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe"C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe" -burn.clean.room="C:\ProgramData\Package Cache\{9f0b3f39-4751-4e5e-8e52-582161ff6942}\adGuardVpnSetup.exe" -burn.filehandle.attached=576 -burn.filehandle.self=232 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\AdguardVPN\AdguardVPN_20260815161641.log" AID=18675_pagevpn_com3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 14764⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5880 -ip 58801⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
state.rsm
AdguardVPN_20260815161641_000_VpnMsi64BitPackage.log
MSIABAE.tmp
AdGuardVpn.CustomActions.dll
setup.exe
AdGuard.CrashReporter.dll
AdGuard.Utils.Base.dll
AdGuard.Utils.Installer.dll
AdGuard.Utils.UI.dll
AdGuard.Utils.dll
AdGuardVpn.Burn.dll
BootstrapperCore.config
BootstrapperCore.dll
Newtonsoft.Json.dll
SharpRaven.dll
mbahost.dll
VpnMsi64BitPackage
pay8A1E541BA08A80172A9729B3E2B567F1
memory/1340-184-0x000000000D250000-0x000000000D290000-memory.dmp
memory/1340-186-0x000000000C980000-0x000000000C9BE000-memory.dmp
memory/1340-148-0x00000000066D0000-0x00000000067C2000-memory.dmp
memory/1340-171-0x0000000006CB0000-0x0000000006CCE000-memory.dmp
memory/1340-140-0x0000000004060000-0x00000000040A8000-memory.dmp
memory/1340-177-0x0000000007510000-0x00000000075C2000-memory.dmp
memory/1340-181-0x00000000075D0000-0x000000000792B000-memory.dmp
memory/1340-180-0x00000000071A0000-0x00000000071C2000-memory.dmp
memory/1340-183-0x000000000D200000-0x000000000D208000-memory.dmp
memory/1340-153-0x00000000069D0000-0x0000000006BC6000-memory.dmp
memory/1340-185-0x000000000D240000-0x000000000D248000-memory.dmp
memory/1340-165-0x0000000006D10000-0x0000000006D8E000-memory.dmp
memory/1340-187-0x000000000C950000-0x000000000C95E000-memory.dmp
memory/1340-144-0x0000000003230000-0x0000000003242000-memory.dmp
memory/1340-160-0x0000000006E60000-0x0000000006F12000-memory.dmp
memory/1340-133-0x0000000002FA0000-0x0000000002FB8000-memory.dmp
memory/1484-331-0x000001E77D790000-0x000001E77D7BE000-memory.dmp
memory/1484-335-0x000001E77D830000-0x000001E77D88A000-memory.dmp
memory/1484-337-0x000001E77DE40000-0x000001E77E036000-memory.dmp
memory/1484-340-0x000001E77DD40000-0x000001E77DE32000-memory.dmp
memory/3900-0-0x0000000000CF2000-0x0000000000CF3000-memory.dmp
memory/3900-21-0x0000000000CE0000-0x0000000000D00000-memory.dmp
memory/3900-4-0x0000000000CE0000-0x0000000000D00000-memory.dmp