Analysis
- max time kernel
149s - max time network
105s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
05/11/2025, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi
Resource
win10v2004-20251016-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi
Resource
win11-20250610-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target 4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi
- Size 14.9MB
- Sample251105-ls29kavrer
- SHA256 4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0
- MD5 de4bea25ca93e98bfd289250347a18ca
- SHA1 aea89f11b7914f44bce9cc35bc33965dd7ec85b6
- SHA512 18c8f57359f6258888340c3e9f2c2912f49ca66e31757b69539ca1e57928130eddaa6c6a25044ef883ff528c6a3a678f1b0a4031980ebb27724499d0397bc288
- SSDEEP 196608:X+xwjpbi3gdIN4c28yLVw2CgYCqUCAmDS1hcmIEcgZ:X+x484l8cVhCgYHUhmYhcXMZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies file permissions 1 TTPs 2 IoCs
pid Process 1860 ICACLS.EXE 5320 ICACLS.EXE -
resource yara_rule behavioral2/files/0x001900000002b17f-64.dat themida behavioral2/memory/5112-66-0x00000000008A0000-0x0000000000C46000-memory.dmp themida behavioral2/memory/5112-69-0x00000000008A0000-0x0000000000C46000-memory.dmp themida behavioral2/memory/5112-75-0x00000000008A0000-0x0000000000C46000-memory.dmp themida -
resource yara_rule behavioral2/files/0x001900000002b17f-64.dat vmprotect behavioral2/memory/5112-66-0x00000000008A0000-0x0000000000C46000-memory.dmp vmprotect behavioral2/memory/5112-69-0x00000000008A0000-0x0000000000C46000-memory.dmp vmprotect behavioral2/memory/5112-75-0x00000000008A0000-0x0000000000C46000-memory.dmp vmprotect - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7906.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF08B1C598DD8D1D6B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF8082CC65F34969EB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7888.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF91296FE9909D316C.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{C512005E-A880-4F3C-9E12-FBC862FB1FD3} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE1E4.tmp msiexec.exe File created C:\Windows\Installer\e57e07d.msi msiexec.exe File opened for modification C:\Windows\Installer\e57e07d.msi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File created C:\Windows\Installer\e57e07f.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC8B1AAA453B88A78.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI7878.tmp msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 5112 signed.exe - Loads dropped DLL 3 IoCs
pid Process 5056 MsiExec.exe 5056 MsiExec.exe 5056 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3004 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language signed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000039a5087841d0e4f50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000039a508780000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090039a50878000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d39a50878000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000039a5087800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\PackageCode = "222EF54FB0D46F34A8D956645D0C79A6" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C0201C4C5D9A46C448E44BDA3BA260F2\E500215C088AC3F4E921BF8C26BFF13D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\PackageName = "4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E500215C088AC3F4E921BF8C26BFF13D\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E500215C088AC3F4E921BF8C26BFF13D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\ProductName = "ASUS DialPad Driver - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C0201C4C5D9A46C448E44BDA3BA260F2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4568 msiexec.exe 4568 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3004 msiexec.exe Token: SeIncreaseQuotaPrivilege 3004 msiexec.exe Token: SeSecurityPrivilege 4568 msiexec.exe Token: SeCreateTokenPrivilege 3004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3004 msiexec.exe Token: SeLockMemoryPrivilege 3004 msiexec.exe Token: SeIncreaseQuotaPrivilege 3004 msiexec.exe Token: SeMachineAccountPrivilege 3004 msiexec.exe Token: SeTcbPrivilege 3004 msiexec.exe Token: SeSecurityPrivilege 3004 msiexec.exe Token: SeTakeOwnershipPrivilege 3004 msiexec.exe Token: SeLoadDriverPrivilege 3004 msiexec.exe Token: SeSystemProfilePrivilege 3004 msiexec.exe Token: SeSystemtimePrivilege 3004 msiexec.exe Token: SeProfSingleProcessPrivilege 3004 msiexec.exe Token: SeIncBasePriorityPrivilege 3004 msiexec.exe Token: SeCreatePagefilePrivilege 3004 msiexec.exe Token: SeCreatePermanentPrivilege 3004 msiexec.exe Token: SeBackupPrivilege 3004 msiexec.exe Token: SeRestorePrivilege 3004 msiexec.exe Token: SeShutdownPrivilege 3004 msiexec.exe Token: SeDebugPrivilege 3004 msiexec.exe Token: SeAuditPrivilege 3004 msiexec.exe Token: SeSystemEnvironmentPrivilege 3004 msiexec.exe Token: SeChangeNotifyPrivilege 3004 msiexec.exe Token: SeRemoteShutdownPrivilege 3004 msiexec.exe Token: SeUndockPrivilege 3004 msiexec.exe Token: SeSyncAgentPrivilege 3004 msiexec.exe Token: SeEnableDelegationPrivilege 3004 msiexec.exe Token: SeManageVolumePrivilege 3004 msiexec.exe Token: SeImpersonatePrivilege 3004 msiexec.exe Token: SeCreateGlobalPrivilege 3004 msiexec.exe Token: SeBackupPrivilege 4716 vssvc.exe Token: SeRestorePrivilege 4716 vssvc.exe Token: SeAuditPrivilege 4716 vssvc.exe Token: SeBackupPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeBackupPrivilege 4896 srtasks.exe Token: SeRestorePrivilege 4896 srtasks.exe Token: SeSecurityPrivilege 4896 srtasks.exe Token: SeTakeOwnershipPrivilege 4896 srtasks.exe Token: SeBackupPrivilege 4896 srtasks.exe Token: SeRestorePrivilege 4896 srtasks.exe Token: SeSecurityPrivilege 4896 srtasks.exe Token: SeTakeOwnershipPrivilege 4896 srtasks.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3004 msiexec.exe 3004 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4896 4568 msiexec.exe 82 PID 4568 wrote to memory of 4896 4568 msiexec.exe 82 PID 4568 wrote to memory of 5056 4568 msiexec.exe 84 PID 4568 wrote to memory of 5056 4568 msiexec.exe 84 PID 4568 wrote to memory of 5056 4568 msiexec.exe 84 PID 5056 wrote to memory of 1860 5056 MsiExec.exe 85 PID 5056 wrote to memory of 1860 5056 MsiExec.exe 85 PID 5056 wrote to memory of 1860 5056 MsiExec.exe 85 PID 5056 wrote to memory of 2316 5056 MsiExec.exe 87 PID 5056 wrote to memory of 2316 5056 MsiExec.exe 87 PID 5056 wrote to memory of 2316 5056 MsiExec.exe 87 PID 5056 wrote to memory of 5112 5056 MsiExec.exe 89 PID 5056 wrote to memory of 5112 5056 MsiExec.exe 89 PID 5056 wrote to memory of 5112 5056 MsiExec.exe 89 PID 5056 wrote to memory of 5320 5056 MsiExec.exe 90 PID 5056 wrote to memory of 5320 5056 MsiExec.exe 90 PID 5056 wrote to memory of 5320 5056 MsiExec.exe 90 PID 5056 wrote to memory of 3764 5056 MsiExec.exe 92 PID 5056 wrote to memory of 3764 5056 MsiExec.exe 92 PID 5056 wrote to memory of 3764 5056 MsiExec.exe 92 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3004
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CF38868D46FE4B40B8A24E7DFBFCA8482⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1860
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\files\signed.exe"C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\files\signed.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:5320
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\files"3⤵
- System Location Discovery: System Language Discovery
PID:3764
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4716
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57e07e.rbs
- Size 7KB
- SHA256 2de90c49c4d262df8a6d5e3ac291ece207f42e38c5e85e28483580615bb64d15
- MD5 b5f25239bac46db8cd71bfe6693f0a6e
- SHA1 3b2807b5283102991515f63cc377adbecd1cadb3
- SHA512 2648bb39b3b0f0f542035b3e6c3c376ba526544907555b0fe05a7a1f9d1dd41ade77a62f921bb78a13f03dad436ceb4bb76a6040205e1fe8147fa1ac9d9a9c5e
- SSDEEP 96:SOuAEguAOTCnTUaUf3TCsThqfUf3TC6ju1nWuA5Thq5HbuAl55cZWv3vOvrwuAvJ:SOuCuBCItfOIFfOWumiuS+0uxMp5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\files.cab
- Size 14.6MB
- SHA256 dd14dcbd48b63fba08e531f58bbb2c5db71cf5f545652bbcdb48aaaab8f72215
- MD5 541b727fbad9ff9e4fd99d52ad491fef
- SHA1 4761deb5a4666f894d33ec6cd2d9150b3ad7ff17
- SHA512 2a608e900877013876e7e03f3df58c043828bfa9bb250eefd197b457cbc5e76c5e081bb59644ba9b39489353239dad30418d7cca60b0ab506a2acadf8697f772
- SSDEEP 196608:s+xwjpbi3gdIN4c28yLVw2CgYCqUCAmDS1hcmIEcgZd:s+x484l8cVhCgYHUhmYhcXMZd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\files\signed.exe
- Size 14.6MB
- SHA256 5b2adba1eeb0f5e756cfc94641ab4ad2bc9c8ec61c11938537b69c31cc992540
- MD5 3c267a7fb03d334d5d00679fbc5a0bff
- SHA1 40d3aadc398b991b875d5f74fd00db369187c5ad
- SHA512 fa8bcb0438f8dfa56159b492e52e6b9d33d1d91a70be62233a46e17f441961214ea11d7e1bbd927fc7a0decae6f6cb6b11d7cf625ee04949961def3ef3b5378e
- SSDEEP 196608:XosodFvI8od3rHsjnZSUB4RNzB4xfZyeyB2S1vsYLTA:XosW4HQnQUGRNzWxRyJ2Sl/TA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\msiwrapper.ini
- Size 1KB
- SHA256 e19099c289cd99bb69d325a4a0c9d44116b60cf3e36df51a25aa444d73821d74
- MD5 ff6a6ffe1b49c2b15d357aab28dac22c
- SHA1 6af43eb584d269a4e50a77dda212798214306cb4
- SHA512 0a8dd6c0c487520c36c2875f11c0b6c3ba44f49ea19edd72dd86bb9ba8ca433cf9bd2910e744f43d7852b189d117d8d1859837a41cf33ded159d6505464e7e9f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-1ba4a63d-bd50-4854-bac9-2639e5f841b3\msiwrapper.ini
- Size 1KB
- SHA256 d7af17e79363248f3ada441db3423ec7f689299c8b50aa2ccaaf228c8eb44682
- MD5 7c81231591834bbb8e5f33a0a505dddf
- SHA1 c338749e0d0caed8149d2499a768bb4f5084a061
- SHA512 59e155ccff565fdae92f8bf90be85b0ee652b0a136674ac273a86945f95b151a7a24866dda1984072532803ad525763cc30af65d73dcca96c815003bebb9ff12
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIE1E4.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 ded9e9ab861dc089a419a5c837b880c310131ca1f70c5a377874b57afe817d02
- MD5 9533438830bb235045c8811ac5f1088e
- SHA1 2cfe681d332486abd2bc4a21feca5e372b267ce4
- SHA512 c1ce9e10997a6f7edad01741a5c14244a774ad56d0a52ab6ebf8a28c7d8130b70628652b5bfbde56006a917b0e99b4ab51b9f4983ed8d843a152084a41a2b739
- SSDEEP 24576:sZ1mSpt5doO/vvTLcWXOR0X6Pq1/Q4D9GWkNHJkXOcKYkLTi4cG6LL9gr:2
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{7808a539-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e477b180-858b-49a8-bbca-e57fe5abd121}_OnDiskSnapshotProp
- Size 6KB
- SHA256 334041cf4f72389b85ecb667f69088098c75dfd7a58a93dc8c2667f18bb832b6
- MD5 a6b995aa292970b8bbf2c6b69e15373c
- SHA1 779c7c520de835d9e199c1da1d2291010dcfc7bb
- SHA512 37e15d9da27636af3f1b15cd0e43ce3da94f358459cfc449725bbb9ce4d2a69168388ff22639569641921c3b1a670c6c9e0c26ebab3ced9e16eead14e97c1573
- SSDEEP 96:F+SK6LMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:La1b++ZVm
- MD5 SHA1 SHA512 SSDEEP