Overview

overview

7

Static

static

3

Shift_Setup.exe

windows10-2004-x64

7

Shift_Setup.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    27s
  • max time network
    43s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/09/2026, 19:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Shift_Setup.exe
  • Size 34.6MB
  • Sample260912-x2d4wavyfv
  • SHA256 9b5dd932c7d63cd54163c35be21b9f5952086b52a1326a08eec09b0c603204b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\is-2H4XYKESZ4.tmp\Shift_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2H4XYKESZ4.tmp\Shift_Setup.tmp" /SL5="$400A2,35097505,893952,C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Users\Admin\AppData\Local\Temp\is-0ZMQVKT5GH.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-0ZMQVKT5GH.tmp\vc_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\Temp\{0300BFC4-04EA-4053-8A96-B21F6D5A9F4C}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{0300BFC4-04EA-4053-8A96-B21F6D5A9F4C}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-0ZMQVKT5GH.tmp\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7257CABA-C980-4856-AB62-CC0DEA87C912} {E1E1D345-681D-4786-AC08-5267E1EA3666} 3940
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1276
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1152 -burn.embedded BurnPipe.{D61B15C2-2F31-4888-8238-B5A1A6D61036} {DF70709F-BE92-4EBE-A988-BB0383730C12} 1276
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2412
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=584 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1152 -burn.embedded BurnPipe.{D61B15C2-2F31-4888-8238-B5A1A6D61036} {DF70709F-BE92-4EBE-A988-BB0383730C12} 1276
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4372
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:240
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5976
  • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260912202109.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5416
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260912202109.log" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D5551DFC-3A23-4DB8-B71B-FBB4B8486511} {D77071D8-3846-4E2F-A701-74E1A27F25F4} 4992
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{EB3840BD-A5D2-42AB-B7CE-9FBADD0FCCD5} {7F6088A1-E27E-4BFF-99FF-CB58C2A91D88} 4496
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2576
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{EB3840BD-A5D2-42AB-B7CE-9FBADD0FCCD5} {7F6088A1-E27E-4BFF-99FF-CB58C2A91D88} 4496
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5928
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{242CBA0E-D3C9-4058-ACEF-E161B85895B7} {0EC66A86-365A-48E7-B2BA-2CC4A396856E} 5928
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3340
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d
    1⤵
      PID:2404
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k CameraMonitor
      1⤵
        PID:2380

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e595b1b.rbs
            • Path C:\Config.Msi\e595b1b.rbs
            • Size 19KB
            • SHA256 4de019323a3eeb88362c902ec7ac28778ceaec904ec56292f2cd9637be9ecac9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e595b27.rbs
            • Path C:\Config.Msi\e595b27.rbs
            • Size 19KB
            • SHA256 a4e8f51791ff9792e2d451892f084a52d6f6ccb23babceb636fdb5eaaca2899e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e595b2e.rbs
            • Path C:\Config.Msi\e595b2e.rbs
            • Size 21KB
            • SHA256 b330bf786d71c3e7694ed87b456533bbbbcfc6d989ce3e4c47595d96fa237048
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e595b3d.rbs
            • Path C:\Config.Msi\e595b3d.rbs
            • Size 21KB
            • SHA256 f7941cf9a2de51756c247f0f62c83307a3c38b34dab9197a9026bb48f6fe1aa2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
            • Size 1000B
            • SHA256 c7e7476bbd1bea1f2a0d156155b0e1bc5d1ba8329110e6d67d8fa5671c45a7d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260912202109_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260912202109_000_vcRuntimeMinimum_x64.log
            • Size 2KB
            • SHA256 e240d03c9e46cb47f61d4bebb1cc34f03aa75fee40770be779a60cec2db08ede
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260912202109_001_vcRuntimeAdditional_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260912202109_001_vcRuntimeAdditional_x64.log
            • Size 4KB
            • SHA256 b40668234c2100232cfd4a3d9d9688bad8f231a3a914dabf70f26ba4020cb079
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-0ZMQVKT5GH.tmp\vc_redist.x64.exe
            • Size 24.4MB
            • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Shift_Setup.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-2H4XYKESZ4.tmp\Shift_Setup.tmp
            • Size 4.2MB
            • SHA256 1ee873a912a7581b83f5ff29e9eac1d5a642bdb658eb0d4a01924c25c01691ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Windows\Temp\{0300BFC4-04EA-4053-8A96-B21F6D5A9F4C}\.cr\vc_redist.x64.exe
            • Size 670KB
            • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\cab5046A8AB272BF37297BB7928664C9503
            • Size 964KB
            • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{6FA4C081-ADD0-416A-BB04-15371C3B3DF8}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            license.rtf
            • Path C:\Windows\Temp\{BD145A6E-40E3-4F65-9565-E7A1C2F040A8}\.ba\license.rtf
            • Size 9KB
            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{BD145A6E-40E3-4F65-9565-E7A1C2F040A8}\.ba\thm.wxl
            • Size 2KB
            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{BD145A6E-40E3-4F65-9565-E7A1C2F040A8}\.ba\thm.xml
            • Size 8KB
            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{BD145A6E-40E3-4F65-9565-E7A1C2F040A8}\.ba\wixstdba.dll
            • Size 191KB
            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1100-0-0x0000000000830000-0x0000000000919000-memory.dmp
            Download

            memory/1100-53-0x0000000000830000-0x0000000000919000-memory.dmp
            Download

            memory/1100-355-0x0000000000830000-0x0000000000919000-memory.dmp
            Download

            memory/2412-347-0x0000000000070000-0x00000000000E7000-memory.dmp
            Download

            memory/2576-332-0x0000000000070000-0x00000000000E7000-memory.dmp
            Download

            memory/3340-299-0x0000000000070000-0x00000000000E7000-memory.dmp
            Download

            memory/3612-203-0x0000000000DD0000-0x000000000121B000-memory.dmp
            Download

            memory/3612-55-0x0000000001670000-0x0000000001671000-memory.dmp
            Download

            memory/3612-54-0x0000000000DD0000-0x000000000121B000-memory.dmp
            Download

            memory/3612-353-0x0000000000DD0000-0x000000000121B000-memory.dmp
            Download

            memory/3612-354-0x0000000000DD0000-0x000000000121B000-memory.dmp
            Download

            memory/3612-6-0x0000000001670000-0x0000000001671000-memory.dmp
            Download

            memory/4372-346-0x0000000000070000-0x00000000000E7000-memory.dmp
            Download

            memory/5928-331-0x0000000000070000-0x00000000000E7000-memory.dmp
            Download

            memory/5976-351-0x0000017DCEC90000-0x0000017DCF634000-memory.dmp
            Download

            memory/5976-356-0x0000017DCEC90000-0x0000017DCF634000-memory.dmp
            Download