Overview

overview

7

Static

static

1

FileConver...up.msi

windows11-ltsc_2024-x64

7

FileConver...up.msi

windows10-2004-x64

7

FileConver...up.msi

windows10-ltsc_2021-x64

7

FileConver...up.msi

windows11-21h2-x64

7

Analysis

  • max time kernel
    298s
  • max time network
    154s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/10/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FileConverter-2.2-x64-setup.msi
  • Size 57.7MB
  • Sample261002-ebptksscpc
  • SHA256 78bb9755b35a94e59a72f299b6b63b5da472deb5c2b03ce016e5fe9f116a3554
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 14 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FileConverter-2.2-x64-setup.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4228
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 88AAB13ABDE29CB12B5E1E9FECD991AA C
      2⤵
      • Loads dropped DLL
      PID:4464
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3736
      • C:\Program Files\File Converter\FileConverter.exe
        "C:\Program Files\File Converter\FileConverter.exe" --register-shell-extension "C:\Program Files\File Converter\FileConverterExtension.dll"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe
          "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe" /codebase "C:\Program Files\File Converter\FileConverterExtension.dll"
          3⤵
          • Loads dropped DLL
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:1236
      • C:\Program Files\File Converter\FileConverter.exe
        "C:\Program Files\File Converter\FileConverter.exe" --post-install-init
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:752
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:216

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e595fda.rbs
          • Path C:\Config.Msi\e595fda.rbs
          • Size 19KB
          • SHA256 02eb00acf460e8067c3dbd040df41f4e838008b4a989dff9a558a3940b1f4dcd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CommunityToolkit.Mvvm.dll
          • Path C:\Program Files\File Converter\CommunityToolkit.Mvvm.dll
          • Size 112KB
          • SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileConverter.exe.config
          • Path C:\Program Files\File Converter\FileConverter.exe.config
          • Size 1KB
          • SHA256 2c71bdbefb2d86096b7e836d2952c8354e2e01ea193592d53bcc3da920d0d266
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FileConverterExtension.dll
          • Path C:\Program Files\File Converter\FileConverterExtension.dll
          • Size 319KB
          • SHA256 0c9083d43c29e3ea7e07e2fecc864057d74300882144846645c69b090bf08ab5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Bcl.AsyncInterfaces.dll
          • Path C:\Program Files\File Converter\Microsoft.Bcl.AsyncInterfaces.dll
          • Size 27KB
          • SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.DependencyInjection.Abstractions.dll
          • Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.Abstractions.dll
          • Size 64KB
          • SHA256 04f478ab7d1393686d55f80a79fac55f577b360f4424f7ea691a9eb979564977
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.DependencyInjection.dll
          • Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.dll
          • Size 99KB
          • SHA256 e4f80f6fa0a63cc895ad6acb4c7ab86f4da270e619d56f35d7379172da93aee3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Settings.default.xml
          • Path C:\Program Files\File Converter\Settings.default.xml
          • Size 95KB
          • SHA256 de9823cd862be7234513c4e0b76cc3d5fcb99ab2ab4f3c5d123c1be944dca8b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SharpShell.dll
          • Path C:\Program Files\File Converter\SharpShell.dll
          • Size 440KB
          • SHA256 63e0a221f9b84973195fb1514d06b26d7b5d539123ce010b7bbc3ee37ba0fca0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Tasks.Extensions.dll
          • Path C:\Program Files\File Converter\System.Threading.Tasks.Extensions.dll
          • Size 27KB
          • SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
          • Size 1KB
          • SHA256 ba5575b889306c1396506b2df949b195c0c8debf811ee162529139f1f908c34e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
          • Size 2KB
          • SHA256 31de46dbb31d694e7c183e7edb4416aae1391fd512b07857ee817de36b5dc3b0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
          • Size 1KB
          • SHA256 d2de0d894af355675fc898026096f8db7284cbe4fb75f592846214b0f7033e68
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
          • Size 412B
          • SHA256 588706d88547a3afe0c14ce2c6b2a09f770a6e53629955ba913c6987bc94f11c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
          • Size 416B
          • SHA256 2d75d7479f29bf2e8a421bc5e353057609ef5271fa6e4b5ce6dd4358d2aa6394
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
          • Size 412B
          • SHA256 a1cd0f8b8ccc8d7be81ff69c681d046bf7c537f89db52998d0d48f3a7641800a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FileConverter.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FileConverter.exe.log
          • Size 1KB
          • SHA256 d921bfa997c2c1891a4eb4f99ffeecef1a4edb39832b304edc48484e2aa641c1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI3CF.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI3CF.tmp
          • Size 175KB
          • SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Icon.exe
          • Path C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe
          • Size 1.9MB
          • SHA256 162f16134c3ac80ff3322d2dce13d8fd4f0476108cb96415927ebea055abc241
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.0MB
          • SHA256 02acd2f968718ce57f37e55cb67ac54980a6146eea5ea0caa3ded66dc24ab223
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {51a3b9ab-694b-45c4-9d3d-0bec706bf262}_OnDiskSnapshotProp
          • Path \??\Volume{139eaa61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{51a3b9ab-694b-45c4-9d3d-0bec706bf262}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 bb03eacc0caf74b02161d95fb59cb3820924f0b4319e93c2a2eb6f87f8a7b9f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4220-106-0x000002641EF00000-0x000002641EF0A000-memory.dmp
          Download

          memory/4220-102-0x000002641EEE0000-0x000002641EEFC000-memory.dmp
          Download

          memory/4220-104-0x0000026406690000-0x000002640669A000-memory.dmp
          Download

          memory/4220-110-0x0000026421600000-0x0000026421654000-memory.dmp
          Download

          memory/4220-112-0x0000026421660000-0x00000264216D4000-memory.dmp
          Download

          memory/4220-100-0x000002641EEC0000-0x000002641EED4000-memory.dmp
          Download

          memory/4220-98-0x00000264066C0000-0x00000264066DA000-memory.dmp
          Download

          memory/4220-97-0x00000264066A0000-0x00000264066C0000-memory.dmp
          Download

          memory/4220-95-0x0000026404870000-0x0000026404A50000-memory.dmp
          Download