Analysis
- max time kernel
300s - max time network
253s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 15:11
General
- Target Shift_Setup.exe
- Size 34.6MB
- Sample260925-sk2rdsfa88
- SHA256 9b5dd932c7d63cd54163c35be21b9f5952086b52a1326a08eec09b0c603204b8
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 19 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ET3R8PPZO6.tmp\Shift_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ET3R8PPZO6.tmp\Shift_Setup.tmp" /SL5="$4011A,35097505,893952,C:\Users\Admin\AppData\Local\Temp\Shift_Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OPWBG2YGI5.tmp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-OPWBG2YGI5.tmp\vc_redist.x64.exe" /install /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{332A5AB5-B194-4F40-8D0D-B09CDCBD3864}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{332A5AB5-B194-4F40-8D0D-B09CDCBD3864}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OPWBG2YGI5.tmp\vc_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{3A5070FC-2E17-48BD-8422-9233CE7A06AE}\.be\VC_redist.x64.exe"C:\Windows\Temp\{3A5070FC-2E17-48BD-8422-9233CE7A06AE}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8D113875-827E-480A-BF99-6B43A1F05347} {1220B66F-ED42-4893-8D6C-F3F1AFD54AC6} 60245⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\Shift\Shift.exe"C:\Users\Admin\AppData\Roaming\Shift\Shift.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /F /T /IM ShiftBridge.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Shift_Setup.tmp
vc_redist.x64.exe
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Svg.dll
Qt6Widgets.dll
Shift.exe
bz2.dll
qsvgicon.dll
qgif.dll
qico.dll
qjpeg.dll
qsvg.dll
qwindows.dll
qmodernwindowsstyle.dll
zip.dll
zlib1.dll
vc_redist.x64.exe
logo.png
wixstdba.dll
memory/3444-178-0x0000020750BF0000-0x00000207511C4000-memory.dmp
memory/3444-153-0x00007FF97F540000-0x00007FF97FB74000-memory.dmp
memory/4500-12-0x0000000000DB0000-0x00000000011FB000-memory.dmp
memory/4500-159-0x0000000000DB0000-0x00000000011FB000-memory.dmp
memory/4500-9-0x0000000000DB0000-0x00000000011FB000-memory.dmp
memory/4500-10-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4500-6-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4500-176-0x0000000000DB0000-0x00000000011FB000-memory.dmp
memory/4500-127-0x0000000000DB0000-0x00000000011FB000-memory.dmp
memory/4512-1-0x0000000000FD0000-0x00000000010B9000-memory.dmp
memory/4512-8-0x0000000000FD0000-0x00000000010B9000-memory.dmp
memory/4512-177-0x0000000000FD0000-0x00000000010B9000-memory.dmp