Overview

overview

8

Static

static

3

Installato...�w.exe

windows10-2004-x64

7

Installato...�w.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    900s
  • max time network
    553s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 17:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    InstallatorAntyKrzaków.exe
  • Size 11.8MB
  • Sample261107-vtx6nsfd79
  • SHA256 d00e2625e596fe3980f2487c8299a0ab5cd3a2e5d9e661f2ed8db31d58b012c1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 10 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallatorAntyKrzaków.exe"
      2⤵
      • Loads dropped DLL
      PID:2980
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2212
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4652
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4804
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:3232

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\VCRUNTIME140.dll
            • Size 174KB
            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\_bz2.pyd
            • Size 86KB
            • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\_lzma.pyd
            • Size 157KB
            • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _tkinter.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\_tkinter.pyd
            • Size 69KB
            • SHA256 ee3eb2cdac591821cf71cda8035a6bc9b148d92996dd45b24e3ae3715613315d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\_zstd.pyd
            • Size 491KB
            • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\base_library.zip
            • Size 1.3MB
            • SHA256 7318b24c8e944c627d8679039de8480584029eb5abc0f2fcffd967493db5e12e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libtommath.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\libtommath.dll
            • Size 93KB
            • SHA256 bf18448a56de62e56adb5a50040c08648f0bcf556217de90eca283490ee8c0c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\python314.dll
            • Size 6.5MB
            • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tcl90.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\tcl90.dll
            • Size 3.2MB
            • SHA256 ecf6c76a725d082a0f00c5940d39a5a71087d0e9d166eaa07d1d6b122a195020
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tcl9tk90.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\tcl9tk90.dll
            • Size 2.1MB
            • SHA256 6e81d58860701540042b8168af929c54437b3f4143bf1b8f6114e56c3b9a8df0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000007182\zlib1.dll
            • Size 114KB
            • SHA256 6bc87ac126b343f794ff14254d2cb6fbfbeef5476c0272e7297c5b4e8acfc353
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2212-217-0x000000000E790000-0x000000000F00B000-memory.dmp
            Download

            memory/2212-248-0x000000000E790000-0x000000000F00B000-memory.dmp
            Download

            memory/2424-102-0x000001EB141D0000-0x000001EB141F0000-memory.dmp
            Download

            memory/2424-69-0x000001EB02E90000-0x000001EB02F90000-memory.dmp
            Download

            memory/2424-74-0x000001EB02D70000-0x000001EB02D90000-memory.dmp
            Download

            memory/2424-68-0x000001EB02930000-0x000001EB02950000-memory.dmp
            Download

            memory/2424-60-0x000001EB001E0000-0x000001EB002E0000-memory.dmp
            Download