Overview

overview

8

Static

static

5

VOCALOID7F...or.msi

windows10-2004-x64

7

VOCALOID7F...or.msi

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    551s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 02:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VOCALOID7FE Editor.msi
  • Size 312.0MB
  • Sample261113-c1ec2ay13j
  • SHA256 3a1347e384accf2bbd0900803f01772102e0885b2723697f67cb63fb3843e38d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\VOCALOID7FE Editor.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5684
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 48EF64D0CC8C0AA7C202413ADE71029F C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0759BC6E-DD3A-4617-86C1-5A11BC0BD190}
        3⤵
        • Executes dropped EXE
        PID:5688
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7916DFC4-730F-4D72-AECA-C1C34822D6AF}
        3⤵
        • Executes dropped EXE
        PID:1164
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52EB2139-68CB-4150-A018-E5E3AFCB9269}
        3⤵
        • Executes dropped EXE
        PID:3956
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3109936C-C145-4C49-8591-1163DDC426E4}
        3⤵
        • Executes dropped EXE
        PID:2284
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B9B8FC2-CD9D-4F72-BB70-B1B29B69C3D0}
        3⤵
        • Executes dropped EXE
        PID:6136
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4AB324A2-713B-4727-B6F7-79D4175FDEF1}
        3⤵
        • Executes dropped EXE
        PID:3516
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA2894A3-B78A-4B21-ABE5-2EB2020683BA}
        3⤵
        • Executes dropped EXE
        PID:1052
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21F1853E-804A-465A-8E4F-EF139F97753C}
        3⤵
        • Executes dropped EXE
        PID:1776
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC6E4732-7D8F-49D2-8943-56D6616155AE}
        3⤵
        • Executes dropped EXE
        PID:3580
      • C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
        C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95483F56-A267-40DF-ACE0-77CA70F76AE0}
        3⤵
        • Executes dropped EXE
        PID:1188
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4892
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4608
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4208
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2892
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4312
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:720

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI9531.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI9531.tmp
            • Size 649KB
            • SHA256 bc6f861394fb212c58c81172f9ab0280ead6b7f4388b0a67ab92d25d4e41d1ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI968A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI968A.tmp
            • Size 2.9MB
            • SHA256 0f6db888885834d033049353ebcd6fb8bb6ef81ea9ebe1f5f1d34308b4c35893
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIB32B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIB32B.tmp
            • Size 654KB
            • SHA256 68803a54c9f286f1ac0061718549fc5cc450c87d0d005b5458030884aeb23515
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ISRT.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\ISRT.dll
            • Size 1.1MB
            • SHA256 e5b8371c09ab79573c600d2a557e99510b581abbca3c8f8d2c940855f551ccb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IsConfig.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\IsConfig.ini
            • Size 212B
            • SHA256 841802f0b91600eb982aa94719c331e135f5aa87530bd690430b2a7a1ede8aef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _is9800.exe
            • Path C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_is9800.exe
            • Size 215KB
            • SHA256 18b2ed4d6780f2b3469a25a6f89440948e4f89005f3050418dfeeccae229d2a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _isres_0x0409.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{C197572F-59FE-4264-92DD-5267DBACA8C3}\_isres_0x0409.dll
            • Size 1.8MB
            • SHA256 3915698c45f46b27eb28881fca651d7672f90e15ca2110fd8093e1a467ef3a6a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2556-33-0x0000000004090000-0x0000000004257000-memory.dmp
            Download

            memory/4208-77-0x0000020C02C60000-0x0000020C02C80000-memory.dmp
            Download

            memory/4208-71-0x0000020C02D60000-0x0000020C02E60000-memory.dmp
            Download

            memory/4208-70-0x0000020C02920000-0x0000020C02940000-memory.dmp
            Download

            memory/4208-58-0x0000020C001E0000-0x0000020C002E0000-memory.dmp
            Download

            memory/4208-56-0x0000020C001E0000-0x0000020C002E0000-memory.dmp
            Download

            memory/4208-93-0x0000020C14140000-0x0000020C14160000-memory.dmp
            Download

            memory/4608-229-0x000000000D810000-0x000000000E08B000-memory.dmp
            Download

            memory/4608-261-0x000000000D810000-0x000000000E08B000-memory.dmp
            Download