Overview

overview

7

Static

static

3

Shift_Setup.exe

windows10-2004-x64

Shift_Setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    38s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 15:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Shift_Setup.exe
  • Size 34.6MB
  • Sample260925-sk2rdsfa88
  • SHA256 9b5dd932c7d63cd54163c35be21b9f5952086b52a1326a08eec09b0c603204b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\is-K34OSTESFC.tmp\Shift_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-K34OSTESFC.tmp\Shift_Setup.tmp" /SL5="$B0068,35097505,893952,C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Users\Admin\AppData\Local\Temp\is-B6C9TKF7F6.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-B6C9TKF7F6.tmp\vc_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Windows\Temp\{909F198D-9834-4B18-89D6-2FCB6906ADDC}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{909F198D-9834-4B18-89D6-2FCB6906ADDC}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-B6C9TKF7F6.tmp\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3096
          • C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8580C64A-22BF-44CF-A7B5-7B667450BDBF} {FB3FE086-6C37-43AA-BAC7-CACCE2DB643A} 3096
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3788
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{AE88949B-58A0-4A9E-8C42-2B06AAB2610D} {99459AB6-8CA2-4B5E-BEA1-8E3E20EF6942} 3788
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4168
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{AE88949B-58A0-4A9E-8C42-2B06AAB2610D} {99459AB6-8CA2-4B5E-BEA1-8E3E20EF6942} 3788
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3860
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D040F97D-ADA1-430F-B31A-A7E4C27AA72C} {D0587400-23C7-4569-8EE9-4F93895E7EF4} 3860
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4968
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3764
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4816
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4068
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925161325.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925161325.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{91B38CB5-B5B1-4D18-B60A-6DB1AF288811} {80EFDB76-F743-4B72-8CCC-584B2DE70453} 1392
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4828
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3957055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2136

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e590fca.rbs
          • Path C:\Config.Msi\e590fca.rbs
          • Size 19KB
          • SHA256 07c1ba827dda304cc70876c9f863822938511e2f9dfb49c0c76d68177930c1f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590fd6.rbs
          • Path C:\Config.Msi\e590fd6.rbs
          • Size 19KB
          • SHA256 edd24384ecf9251fde7335236119819e19745696ab70916d9e1df7d1247a41d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590fdd.rbs
          • Path C:\Config.Msi\e590fdd.rbs
          • Size 21KB
          • SHA256 2c8966837b38370f9ecbb38eff83c44afd3be0c8076a61e36aca0d633b6b79d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590fec.rbs
          • Path C:\Config.Msi\e590fec.rbs
          • Size 21KB
          • SHA256 728bdf05e3f9671f1e93c8292ad43313e6c621bc50fd8fc68a2e3b168c2d418c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
          • Size 1000B
          • SHA256 28fb19c7012c266fa2addb2dffcb851958b9431af063a51319179643ceb19f33
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260925161325_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925161325_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 55e708f488687687fdabb7fe89a652ed1f75496edd049d07d707b48c420a0158
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260925161325_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925161325_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 9da9c9aa019b5da1af5a45bd753645973aecdefdbfed2a12c7ecc311a28411ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-B6C9TKF7F6.tmp\vc_redist.x64.exe
          • Size 24.4MB
          • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Shift_Setup.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-K34OSTESFC.tmp\Shift_Setup.tmp
          • Size 4.2MB
          • SHA256 1ee873a912a7581b83f5ff29e9eac1d5a642bdb658eb0d4a01924c25c01691ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\cab5046A8AB272BF37297BB7928664C9503
          • Size 964KB
          • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{144D2DCD-BF29-43E2-B53B-2B657CDBBD20}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{909F198D-9834-4B18-89D6-2FCB6906ADDC}\.cr\vc_redist.x64.exe
          • Size 670KB
          • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{9EAE9F3C-44AA-4EEB-9C82-9C27ED98741A}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{9EAE9F3C-44AA-4EEB-9C82-9C27ED98741A}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{9EAE9F3C-44AA-4EEB-9C82-9C27ED98741A}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{9EAE9F3C-44AA-4EEB-9C82-9C27ED98741A}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1836-122-0x0000000000F20000-0x0000000000F21000-memory.dmp
          Download

          memory/1836-72-0x0000000000A30000-0x0000000000E7B000-memory.dmp
          Download

          memory/1836-5-0x0000000000F20000-0x0000000000F21000-memory.dmp
          Download

          memory/1836-312-0x0000000000A30000-0x0000000000E7B000-memory.dmp
          Download

          memory/3860-306-0x0000000000940000-0x00000000009B7000-memory.dmp
          Download

          memory/4168-307-0x0000000000940000-0x00000000009B7000-memory.dmp
          Download

          memory/4968-303-0x0000000000940000-0x00000000009B7000-memory.dmp
          Download

          memory/4984-71-0x0000000000740000-0x0000000000829000-memory.dmp
          Download

          memory/4984-0-0x0000000000740000-0x0000000000829000-memory.dmp
          Download

          memory/4984-313-0x0000000000740000-0x0000000000829000-memory.dmp
          Download