Analysis
- max time kernel
149s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 17:40
Behavioral task
behavioral1
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
SCAN-016063.pdf.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target SCAN-016063.pdf.msi
- Size 224KB
- Sample260415-v8797ahx41
- SHA256 face46e6593206867da39e47001f134a00385898a36b8142a21ad54954682666
- MD5 ff82937564ff59eb6207f079cdc8e43d
- SHA1 7cfe0a71c4a2508a1af80e640ec8b1b034edb604
- SHA512 4c4c2f59ef157de6570bf16daff958d9ccdafd8ba6cf3f946cabaa413c085c05242b2499552e789f0f0bc9e1cbf0b74ec6327340d29c80a694aeddf444788ee1
- SSDEEP 6144:o9F4SAoa1aq9oOGwFVL4/QUDDNHdOxOzdjNj:QF4SAoal9ogFVCDnNHdO+r
- TLSH T17A24024A77004538D11367395FABF6E687756C8C9FAB49622287F32C3DB346092635F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Matanbuchus
Matanbuchus is a loader sold as MaaS first seen in February 2021.
- Loads dropped DLL 1 IoCs
pid Process 5844 regsvr32.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5184 msiexec.exe 3 5184 msiexec.exe 4 5184 msiexec.exe 5 5184 msiexec.exe 6 5184 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e586666.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF0BFAA04996E08F2E.TMP msiexec.exe File created C:\Windows\Installer\e586668.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC6465D7B6BE8F274.TMP msiexec.exe File opened for modification C:\Windows\Installer\e586666.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{D20C245F-321F-453F-8139-C938C6F031A3} msiexec.exe File created C:\Windows\SystemTemp\~DF1C4083946A830E3C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI679E.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0423C31F3FFC992D.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5184 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f1d998fde3c4bea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009f1d998f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009f1d998f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9f1d998f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9f1d998f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2044 msiexec.exe 2044 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5184 msiexec.exe Token: SeIncreaseQuotaPrivilege 5184 msiexec.exe Token: SeSecurityPrivilege 2044 msiexec.exe Token: SeCreateTokenPrivilege 5184 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5184 msiexec.exe Token: SeLockMemoryPrivilege 5184 msiexec.exe Token: SeIncreaseQuotaPrivilege 5184 msiexec.exe Token: SeMachineAccountPrivilege 5184 msiexec.exe Token: SeTcbPrivilege 5184 msiexec.exe Token: SeSecurityPrivilege 5184 msiexec.exe Token: SeTakeOwnershipPrivilege 5184 msiexec.exe Token: SeLoadDriverPrivilege 5184 msiexec.exe Token: SeSystemProfilePrivilege 5184 msiexec.exe Token: SeSystemtimePrivilege 5184 msiexec.exe Token: SeProfSingleProcessPrivilege 5184 msiexec.exe Token: SeIncBasePriorityPrivilege 5184 msiexec.exe Token: SeCreatePagefilePrivilege 5184 msiexec.exe Token: SeCreatePermanentPrivilege 5184 msiexec.exe Token: SeBackupPrivilege 5184 msiexec.exe Token: SeRestorePrivilege 5184 msiexec.exe Token: SeShutdownPrivilege 5184 msiexec.exe Token: SeDebugPrivilege 5184 msiexec.exe Token: SeAuditPrivilege 5184 msiexec.exe Token: SeSystemEnvironmentPrivilege 5184 msiexec.exe Token: SeChangeNotifyPrivilege 5184 msiexec.exe Token: SeRemoteShutdownPrivilege 5184 msiexec.exe Token: SeUndockPrivilege 5184 msiexec.exe Token: SeSyncAgentPrivilege 5184 msiexec.exe Token: SeEnableDelegationPrivilege 5184 msiexec.exe Token: SeManageVolumePrivilege 5184 msiexec.exe Token: SeImpersonatePrivilege 5184 msiexec.exe Token: SeCreateGlobalPrivilege 5184 msiexec.exe Token: SeBackupPrivilege 6056 vssvc.exe Token: SeRestorePrivilege 6056 vssvc.exe Token: SeAuditPrivilege 6056 vssvc.exe Token: SeBackupPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5184 msiexec.exe 5184 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1624 2044 msiexec.exe 84 PID 2044 wrote to memory of 5920 2044 msiexec.exe 87 PID 2044 wrote to memory of 5428 2044 msiexec.exe 86 PID 5428 wrote to memory of 5844 5428 regsvr32.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SCAN-016063.pdf.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5184
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1624
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll2⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\regsvr32.exe-n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5844
-
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs2⤵PID:5920
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e586667.rbs
- Size 8KB
- SHA256 73a23d1c8c432d9f73f58d52e2061e933c8059d84fd1519ef51ebdce3ca0a8a3
- MD5 b2ff72bf8fcfc24dd3cb96b6ad172828
- SHA1 a5efb763f152fb77b180ff331523ecb39d8a941b
- SHA512 02673700762d7f429e36616c8469f3f82ad624c2185189678245c9ea19d2f460a44b62bd66cabbf8bfd5dfe2c0c97625dea0dab7fa37ab9cb4b0769ad4c948b7
- SSDEEP 96:tKHnj/i60LgHC5DRmUZnYaGCsThqo/bUZnYaGC6jZyMsThqofHPc4xh1oTcwYJwR:tKHj/rC/ZVYaVIb/IVYaV9bPE2py
- TLSH T154121341B34090A3ED5D5735D71727213763E7EA9380B30B25CED8641E97B8C9EAD88B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535
- Size 746B
- SHA256 9edc97afd55a323b866035ea793d6c589e6f7810391b498b94723a38e79bb109
- MD5 41b98cbe00e7fd11500bea8fd261465e
- SHA1 b47f3e47c118e66cab1313c26a83bc42cc8262ad
- SHA512 95239439b1fc3906adbe11667036516beb5a85ebf9742c1b2cb85a037c85d01c0a6231c67334336eb4b3c9e3a38ea4be40a146d469d8e28019913404278c6601
- TLSH T1A60199420E091B9DC012CCA0BBE8CF85BF1CC9A325CE829B537B065ED13C9350C0571D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
- Size 737B
- SHA256 454a60598f643818f8850a1bf889e3d87b587ac1d42908d38cf8d956529b083d
- MD5 83e3a679ee6a30f11bcf2bbc99dee013
- SHA1 b60e2d5739480df6c1c45f7d02ce2e382a7e06b0
- SHA512 197ba7a3b7b52545d3ae792edcae0f396981d99c61af820e898968177de315bd591a0220b23ae6b55c0672929c5b1bd09caf18f077d66ddcda2eee5153ab641f
- TLSH T1E50120338D804A09DE922DA13D5296A000ED15CD2951D2BFA224D5459AB176541AE0CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535
- Size 404B
- SHA256 710b532e0f5330735b40f4f0639e8d180a3fd31986d11f135107fca960ac8c5f
- MD5 83e6836a9240df70ca8dd5c31d2ffe3b
- SHA1 767935d89ce7f4028bf5b78fbb2e92eca37b695b
- SHA512 6ad54567dfc6dc6814e1c76c3da8c599edd94ec0e3d58df7befb797174e7d9670404633427764c21d10bbdbfa0fb474192d3339a86535d88105c60b7c06599ce
- TLSH T1BBE0203422F6075DF1F0E93447D6EC526C9AF1271555B2991150575ABE12B400DF3A24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
- Size 248B
- SHA256 cc0eb42a15d7ea79c8c91f9154fe34f3cdf7d603ba62b07b7ac1361eeb04ab71
- MD5 41793df810731fec921928155d0dec59
- SHA1 67e7d87d067f91926480af2f3788be97f6f4041b
- SHA512 2501ea26b63ee466817c1dcd7fc43e0e7ed9cf5a1a2322ecf5a4cfdd3e8e6f0f2c371c3ed0a2d3c47cc2e6005df94210e4fea0130f4348441d5c4418ecaba9a9
- TLSH T138D012246FF60357F1A4777A4D734A82A621BA72B56BCF0902F5058E1C34F056931A1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
- Size 401KB
- SHA256 14debc481aa0a26d3a0bdeed0e56b3ae9e301220f2606aae624d57a9d0617d6f
- MD5 8cb8cf84ab20159702e6803cd6ce364a
- SHA1 05103f90540f3e8a9599e9f1ab6a11c791aec393
- SHA512 9d9cb037b9c79f88fb89a9757f6c27848d7cc7c448594faf58cedb12925756206106235a2dd44142157e19e2c17535fa942156322768e62579aab55e6a6f64da
- SSDEEP 6144:KtugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg3o5:stWmTBpHtee6IcUWbHI/RRZMut
- TLSH T141949567C711921BE7973070C01CA6B2A01A17317E858896B351BF7EF3786C2A93DB67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs
- Size 68B
- SHA256 0a7e8fd68575db5f84c18b9a26e4058323d1357e2a29a5b12278e4bfa6939489
- MD5 0308aa2c8dab8a69de41f5d16679bb9b
- SHA1 c6827bf44a433ff086e787653361859d6f6e2fb3
- SHA512 1a1ca92e3c8d52c8b5adbb3117a88d8a2a8c33eaf2f7b0d620fe006653f57f4ba0b803884616594ca31e13a1b0b59ddae52cecf044621ec44371084dac6beb72
- TLSH T135A0025241385D17E3E90C442DD5E84A11C9F0A3A9E40452D34B31139DDA04DDFC0396
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e586666.msi
- Size 224KB
- SHA256 face46e6593206867da39e47001f134a00385898a36b8142a21ad54954682666
- MD5 ff82937564ff59eb6207f079cdc8e43d
- SHA1 7cfe0a71c4a2508a1af80e640ec8b1b034edb604
- SHA512 4c4c2f59ef157de6570bf16daff958d9ccdafd8ba6cf3f946cabaa413c085c05242b2499552e789f0f0bc9e1cbf0b74ec6327340d29c80a694aeddf444788ee1
- SSDEEP 6144:o9F4SAoa1aq9oOGwFVL4/QUDDNHdOxOzdjNj:QF4SAoal9ogFVCDnNHdO+r
- TLSH T17A24024A77004538D11367395FABF6E687756C8C9FAB49622287F32C3DB346092635F4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 ffb05bbeaca25fda807c74565976ed8166a3caccbb0a008df215dcc74c9a8b72
- MD5 ec07c314e3661182b05eb6d276877730
- SHA1 9f7dec9851f98bc969ff1faff8dd37bd9bf863e9
- SHA512 c3da19897cb8a0adb78bab1aefd2c26d5628790e0c5b67324ddeea5487d21411ffb39b25fa82f606aa6cbdd5056cda8dd0c666f0602c60faf69c1f43442f6d0c
- SSDEEP 24576:v2gmSp10doO/vvTLh2q+REnKfqJBg4eAWWp93Jkqzx6Ik2uv4Rb9bngNh:S
- TLSH T15E47A4243AF92120E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0921BB1E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{8f991d9f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e601639f-8539-48f9-bc8d-0e61e4fd4a5f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 92086b9bc02adc6dbc882cdb933dcda496ed4873441c4724e5833aed75f1456c
- MD5 aac846162c156a2041a3cb552130bed6
- SHA1 2918941fa3045628998b598e3bbfb00a57102529
- SHA512 ae886dd6d1d006d5fdc33b14e40e6cfdae62d3975526cc3390a9beb22e10d426019564b347939ef1d8e24e30c9d745d04fb90ad27cb9cc14b0756e3b82914a98
- SSDEEP 96:FdVDcC8OAhrvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:DVv8hBb++ZVmN
- TLSH T1E4D177085AF54711E2B3AB7229F14557A877B811EF33CB8E0198238E6670A11F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH