Overview

overview

7

Static

static

1

FileConver...up.msi

windows11-ltsc_2024-x64

7

FileConver...up.msi

windows10-2004-x64

7

FileConver...up.msi

windows10-ltsc_2021-x64

7

FileConver...up.msi

windows11-21h2-x64

7

Analysis

  • max time kernel
    298s
  • max time network
    281s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FileConverter-2.2-x64-setup.msi
  • Size 57.7MB
  • Sample261002-ebptksscpc
  • SHA256 78bb9755b35a94e59a72f299b6b63b5da472deb5c2b03ce016e5fe9f116a3554
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 18 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FileConverter-2.2-x64-setup.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3016
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 4F544FD29D9DA88CDE0DF044CCD71300 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2904
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:6032
      • C:\Program Files\File Converter\FileConverter.exe
        "C:\Program Files\File Converter\FileConverter.exe" --register-shell-extension "C:\Program Files\File Converter\FileConverterExtension.dll"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe
          "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe" /codebase "C:\Program Files\File Converter\FileConverterExtension.dll"
          3⤵
          • Loads dropped DLL
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:628
      • C:\Program Files\File Converter\FileConverter.exe
        "C:\Program Files\File Converter\FileConverter.exe" --post-install-init
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4520
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2356

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59df8a.rbs
          • Path C:\Config.Msi\e59df8a.rbs
          • Size 19KB
          • SHA256 6d4a3d5b48dfcfd4b59c69a6988dd4e6a118622c04efbfd0d5c882756dde68ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CommunityToolkit.Mvvm.dll
          • Path C:\Program Files\File Converter\CommunityToolkit.Mvvm.dll
          • Size 112KB
          • SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileConverter.exe.config
          • Path C:\Program Files\File Converter\FileConverter.exe.config
          • Size 1KB
          • SHA256 2c71bdbefb2d86096b7e836d2952c8354e2e01ea193592d53bcc3da920d0d266
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FileConverterExtension.dll
          • Path C:\Program Files\File Converter\FileConverterExtension.dll
          • Size 319KB
          • SHA256 0c9083d43c29e3ea7e07e2fecc864057d74300882144846645c69b090bf08ab5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Bcl.AsyncInterfaces.dll
          • Path C:\Program Files\File Converter\Microsoft.Bcl.AsyncInterfaces.dll
          • Size 27KB
          • SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.DependencyInjection.Abstractions.dll
          • Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.Abstractions.dll
          • Size 64KB
          • SHA256 04f478ab7d1393686d55f80a79fac55f577b360f4424f7ea691a9eb979564977
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.DependencyInjection.dll
          • Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.dll
          • Size 99KB
          • SHA256 e4f80f6fa0a63cc895ad6acb4c7ab86f4da270e619d56f35d7379172da93aee3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Settings.default.xml
          • Path C:\Program Files\File Converter\Settings.default.xml
          • Size 95KB
          • SHA256 de9823cd862be7234513c4e0b76cc3d5fcb99ab2ab4f3c5d123c1be944dca8b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SharpShell.dll
          • Path C:\Program Files\File Converter\SharpShell.dll
          • Size 440KB
          • SHA256 63e0a221f9b84973195fb1514d06b26d7b5d539123ce010b7bbc3ee37ba0fca0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Tasks.Extensions.dll
          • Path C:\Program Files\File Converter\System.Threading.Tasks.Extensions.dll
          • Size 27KB
          • SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI78FF.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI78FF.tmp
          • Size 175KB
          • SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Icon.exe
          • Path C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe
          • Size 1.9MB
          • SHA256 162f16134c3ac80ff3322d2dce13d8fd4f0476108cb96415927ebea055abc241
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 76e015db1ada60c8e039ca38d17ce5bb6156ef8119e3c7c57103184729cb23e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {96a5eb37-251e-4bb3-974b-56cb94ccbab5}_OnDiskSnapshotProp
          • Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{96a5eb37-251e-4bb3-974b-56cb94ccbab5}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 4c6fa144b1af117053e07e1ec72446bb3c254058571f3656a41974723db50fb4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/628-102-0x000001838A370000-0x000001838A380000-memory.dmp
          Download

          memory/628-107-0x000001838C170000-0x000001838C1BA000-memory.dmp
          Download

          memory/2840-91-0x0000026EAEBA0000-0x0000026EAEBBC000-memory.dmp
          Download

          memory/2840-95-0x0000026EAD4F0000-0x0000026EAD4FA000-memory.dmp
          Download

          memory/2840-99-0x0000026EC7F90000-0x0000026EC7FE4000-memory.dmp
          Download

          memory/2840-93-0x0000026EAD340000-0x0000026EAD34A000-memory.dmp
          Download

          memory/2840-101-0x0000026EC8070000-0x0000026EC80E4000-memory.dmp
          Download

          memory/2840-89-0x0000026EAEB80000-0x0000026EAEB94000-memory.dmp
          Download

          memory/2840-87-0x0000026EAEB60000-0x0000026EAEB7A000-memory.dmp
          Download

          memory/2840-86-0x0000026EAEB40000-0x0000026EAEB60000-memory.dmp
          Download

          memory/2840-84-0x0000026EACC30000-0x0000026EACE10000-memory.dmp
          Download