Overview
overview
7Static
static
3ver2022s/V...64.msi
windows10-2004-x64
7ver2022s/V...64.msi
windows11-21h2-x64
7ver2022s/V...86.msi
windows10-2004-x64
6ver2022s/V...86.msi
windows11-21h2-x64
6ver2022s/V...64.msi
windows10-2004-x64
6ver2022s/V...64.msi
windows11-21h2-x64
6ver2022s/a...2S.dll
windows10-2004-x64
1ver2022s/a...2S.dll
windows11-21h2-x64
1ver2022s/i...2S.dll
windows10-2004-x64
3ver2022s/i...2S.dll
windows11-21h2-x64
3ver2022s/i...2S.dll
windows10-2004-x64
1ver2022s/i...2S.dll
windows11-21h2-x64
1ver2022s/setup.exe
windows10-2004-x64
7ver2022s/setup.exe
windows11-21h2-x64
7ver2022s/w...2S.dll
windows10-2004-x64
3ver2022s/w...2S.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 12:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ver2022s/Ver2022S_amd64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ver2022s/Ver2022S_amd64.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
ver2022s/Ver2022S_i386.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
ver2022s/Ver2022S_i386.msi
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
ver2022s/Ver2022S_ia64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
ver2022s/Ver2022S_ia64.msi
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
ver2022s/amd64/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ver2022s/amd64/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ver2022s/i386/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
ver2022s/i386/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
ver2022s/ia64/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ver2022s/ia64/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ver2022s/setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
ver2022s/setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral15
Sample
ver2022s/wow64/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
ver2022s/wow64/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target ver2022s/setup.exe
- Size 139KB
- Sample260422-phlqlsbs3w
- SHA256 b47eb424a2cd775dc657eb0d3f3818082eabdcaf56d496cacabc34037365e5f0
- MD5 616f969a20e980fab8d806999d60fbcd
- SHA1 cebc76924993cfcc340bb490ef69c8e6cc48f363
- SHA512 cf17ea9c1c68371ff2f5a81729c07130ec1322f91967bae3e5cb7a888d9eaa85005ab00d5e1e2eb6231ee51576b84968f0d9a9866d66cbf101f91dc6a6d6d9b5
- SSDEEP 3072:IzWP5D4zAed3ojyEKcJ3oUjoXper4GPT1Z/GdmkTdPiQg:5D4zAetIKdWoXeLrOdl5Pi
- TLSH T16FD3AE01B3D4D139F4F72A72E57951B24B3A7C366F31D38FA304562E2AB5A81DA31362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 864 MsiExec.exe 864 MsiExec.exe 864 MsiExec.exe 864 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: setup.exe File opened (read-only) \??\V: setup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: setup.exe File opened (read-only) \??\G: setup.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: setup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: setup.exe File opened (read-only) \??\I: setup.exe File opened (read-only) \??\L: setup.exe File opened (read-only) \??\N: setup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: setup.exe File opened (read-only) \??\X: setup.exe File opened (read-only) \??\Z: setup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: setup.exe File opened (read-only) \??\B: setup.exe File opened (read-only) \??\Y: setup.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: setup.exe File opened (read-only) \??\J: setup.exe File opened (read-only) \??\K: setup.exe File opened (read-only) \??\M: setup.exe File opened (read-only) \??\R: setup.exe File opened (read-only) \??\U: setup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: setup.exe File opened (read-only) \??\W: setup.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ver2022S.dll setup.exe File created C:\Windows\system32\Ver2022S.dll msiexec.exe File created C:\Windows\SysWOW64\Ver2022S.dll msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e5898a1.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A3F2520B-31FE-4F03-9381-C24471530283} msiexec.exe File opened for modification C:\Windows\Installer\MSI996C.tmp msiexec.exe File created C:\Windows\Installer\e5898a3.msi msiexec.exe File opened for modification C:\Windows\Installer\e5898a1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9A0A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9A68.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000550aa4e2285040970000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000550aa4e20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900550aa4e2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a550aa4e2000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d550aa4e2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\International\AcceptLanguage = "en-US,en;q=0.7,da;q=0.3" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4984 msiexec.exe 4984 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2204 setup.exe Token: SeIncreaseQuotaPrivilege 2204 setup.exe Token: SeSecurityPrivilege 4984 msiexec.exe Token: SeCreateTokenPrivilege 2204 setup.exe Token: SeAssignPrimaryTokenPrivilege 2204 setup.exe Token: SeLockMemoryPrivilege 2204 setup.exe Token: SeIncreaseQuotaPrivilege 2204 setup.exe Token: SeMachineAccountPrivilege 2204 setup.exe Token: SeTcbPrivilege 2204 setup.exe Token: SeSecurityPrivilege 2204 setup.exe Token: SeTakeOwnershipPrivilege 2204 setup.exe Token: SeLoadDriverPrivilege 2204 setup.exe Token: SeSystemProfilePrivilege 2204 setup.exe Token: SeSystemtimePrivilege 2204 setup.exe Token: SeProfSingleProcessPrivilege 2204 setup.exe Token: SeIncBasePriorityPrivilege 2204 setup.exe Token: SeCreatePagefilePrivilege 2204 setup.exe Token: SeCreatePermanentPrivilege 2204 setup.exe Token: SeBackupPrivilege 2204 setup.exe Token: SeRestorePrivilege 2204 setup.exe Token: SeShutdownPrivilege 2204 setup.exe Token: SeDebugPrivilege 2204 setup.exe Token: SeAuditPrivilege 2204 setup.exe Token: SeSystemEnvironmentPrivilege 2204 setup.exe Token: SeChangeNotifyPrivilege 2204 setup.exe Token: SeRemoteShutdownPrivilege 2204 setup.exe Token: SeUndockPrivilege 2204 setup.exe Token: SeSyncAgentPrivilege 2204 setup.exe Token: SeEnableDelegationPrivilege 2204 setup.exe Token: SeManageVolumePrivilege 2204 setup.exe Token: SeImpersonatePrivilege 2204 setup.exe Token: SeCreateGlobalPrivilege 2204 setup.exe Token: SeBackupPrivilege 1156 vssvc.exe Token: SeRestorePrivilege 1156 vssvc.exe Token: SeAuditPrivilege 1156 vssvc.exe Token: SeBackupPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe Token: SeTakeOwnershipPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2204 setup.exe 2204 setup.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4984 wrote to memory of 2164 4984 msiexec.exe 89 PID 4984 wrote to memory of 864 4984 msiexec.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ver2022s\setup.exe"C:\Users\Admin\AppData\Local\Temp\ver2022s\setup.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2204
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2164
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8354F5D88E1D133180391FD48AC708B52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:864
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5898a2.rbs
- Size 10KB
- SHA256 345e678f6cb264f306db3e76a748a59e6f77e0956d7d0aa6432f39142a6cf0a7
- MD5 0a74279769b4516076835402a34b207f
- SHA1 0e8e69199d3f3397a17ce2a26b31ec83df14e597
- SHA512 f3e2899a07bb4e6071d8be2be1747d11ab355fcf85445081157d3d11122fdb9cc45e78f69c5f3f141ce55223f8418b7e0104228acbac9a9825b99b60324da472
- SSDEEP 96:6mWqbT2Nm1x+azGTQUdUQhGmCsTlNUQhGmC6jOByndTlrbccUWSqZW/qBkljoDSn:bFn3qazGr2wG1I8wG1JACzupAtUYh
- TLSH T1E632FF00726086D2E8A61B31CF574B153773D3D9C266634B0ACC92745E43BDC6ED96CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9A0A.tmp
- Size 54KB
- SHA256 a99b13b3d61026bec3f47e6a79cb0b301fe52db7320faa3a9c36d62a50061916
- MD5 45a758aa7e855f3f3d0be3997371219a
- SHA1 596f0afb1dd993c2819d84d13deead5b7274a6a6
- SHA512 e4735e42d46c67530a384a4b59961e3c4f25863502deb7227a8f62693cfe2cffd9a85ee46658db077863ef47a7a458a12da4250b5bd901deae3d9d99ea43aea1
- SSDEEP 768:H+VX3KRO3SgvI8uMW10++cPuGbBinCi6u0Vsr:H+VXJ3lIMW10i2AinCNu0Vy
- TLSH T133438E06B764D052E8E61870857AC9E2693FFDB55B21C58BE605B6AF3C353C2EE31306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ver2022S.dll
- Size 7KB
- SHA256 4e4cb5980a2df611af67fb6444d03cbba6edb4ca33503b20dd4541a62e219f7e
- MD5 d18c72ebd9725d0803856fdd99676383
- SHA1 7380c006f9752c906df1e359f4ab2768958396bf
- SHA512 f2997a3178a1d53182c59ea8012e891f6ffc10fb64b3c34fc7c1125651de2f5f136c0369c63bcb285642218a20e902f82aa9d63c7512856d9a7bc2d80cb95826
- SSDEEP 96:71avKxHfu4FcEmZ8GldmmKBqYUk6RVEm6BCo7:71ai5W4FceSEVdtCo
- TLSH T164F19511DBF4107EF2FFE63C69F36116A853BC2144F6D15D05800A8B5979640ABAEF3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 c4530c4730b8f619ecd98aa32c15cab795d8e17f99c4a1b8f46ba3cc6ecb3ecb
- MD5 52a1a18257fdd53e31bd6fd34b40c1c0
- SHA1 36f96e5fc9ae50be73287e9585796de82c3e77ff
- SHA512 7c02e7d19577418e13c4030ee3de107f11378dc1f4ee9ab78a5dfef91a4f0cce502e374594f5bf6c47783c154ebdff15393b05c6395c72a2c11ec38ce3362cac
- SSDEEP 24576:Du8m+1z/doO/vvTLLWO+bGaKvX0T21eiCYGNshfFG06fOZ3TIPVX2oFx7:X
- TLSH T12E47D52436FD2110E7F79E3C78F46A23893A7D5B9C15DE8D05461B4E0A21BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e2a40a55-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d8e43ee4-07c0-4ba4-9f91-c994e4aa9a68}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0a036687fdc0ce6bb52d2aef38d830fbe3e7fc461b098237ad11975133c6a9f1
- MD5 a97f3dfa9fcfe3991170b4c60c63528c
- SHA1 324310224bc165c361de18420bb5ee63119e151b
- SHA512 f55e20519fea7cf61f268e3b4c6ed55587f7b5da5fc96e1b9129cd4a5776908f64adc82cb0f78f50a6798b15c35f16ec4f2af3ad1e3860a541d37df3c86a7c2c
- SSDEEP 96:FZNc8vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:T9b++ZVm
- TLSH T11ED189085AF54311E2B3AB7229F54557A877B911EF33CB8E0198238E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH