Overview

overview

7

Static

static

3

SecsToTool....5.exe

windows10-2004-x64

7

SecsToTool....5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    300s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecsToTool.Net_v3.2.5.exe
  • Size 60.0MB
  • Sample260826-phs5padb89
  • SHA256 f5456097e957ad2492ba146586e6637b94538461e597c092521d8bbe43deabdd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomware

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecsToTool.Net_v3.2.5.exe
    "C:\Users\Admin\AppData\Local\Temp\SecsToTool.Net_v3.2.5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}\SecsToTool.Net_v3.2.5.exe
      C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}\SecsToTool.Net_v3.2.5.exe /q"C:\Users\Admin\AppData\Local\Temp\SecsToTool.Net_v3.2.5.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}" /IS_temp
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Windows\system32\MSIEXEC.EXE
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{0621193E-73B2-4746-A935-6A06B6DBB3C5}\setup.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="SecsToTool.Net_v3.2.5.exe"
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4332
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}"
        3⤵
          PID:1360
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4764
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C5FDB0003977E1E95436713A45D455EF
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:6108
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1896

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59cd59.rbs
          • Path C:\Config.Msi\e59cd59.rbs
          • Size 223KB
          • SHA256 f1a33fde59a34f9957b7b3a0168e395525dab997870c56dc13b18041f5a7866d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDX.dll
          • Path C:\Program Files\INSPHERE TECHNOLOGY\SecsToTool.Net SDK\Utilities\Model Builder\SDX.dll
          • Size 131KB
          • SHA256 b406c82b5a98f8a92ac2010ac18254d3c699fb624ec625719932be8612ff25ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDX64.dll
          • Path C:\Program Files\INSPHERE TECHNOLOGY\SecsToTool.Net SDK\Utilities\Model Builder\SDX64.dll
          • Size 100KB
          • SHA256 c076121a986836da44316d23cec4a936c225a27e505553f92f4f0ee26038a8a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0x0409.ini
          • Path C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}\0x0409.ini
          • Size 22KB
          • SHA256 cdb316d7f9aa2d854eb28f7a333426a55cc65fa7d31b0bdf8ae108e611583d29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}\_ISMSIDEL.INI
          • Size 656B
          • SHA256 4697f0b0ce557f4dc9b058632462cd8dbdd52a8830ff6bf7186a19cdd1687078
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{2D2D40FE-9CCC-454C-9B27-AD538B805D65}\_ISMSIDEL.INI
          • Size 20B
          • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
          • MD5 SHA1 SHA512
          Submit Download

          ~C1E.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~C1E.tmp
          • Size 5KB
          • SHA256 be8aabde4fe2ef8071203be7763da5b38729c4a5f50389ed833c54fd1d78fb37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSID8A3.tmp
          • Path C:\Windows\Installer\MSID8A3.tmp
          • Size 335KB
          • SHA256 edc53d94e25c1f5272079c5efb1b2e9e2fe0f923f095f22c60c7b69d5f7a5e30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 6497b349b9c5e30836169e4e3f4ae320122d69335ee92a63b364fa05c27efbcf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {89706893-97ca-48da-a1b3-f25416f34192}_OnDiskSnapshotProp
          • Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{89706893-97ca-48da-a1b3-f25416f34192}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 3a0c526ab400e63e1de68095dfa7c28a9eac77f857c1a1b0a5a6c95c9c3a5882
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download