Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/04/2026, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DoonTheLustsofMahdIb.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
DoonTheLustsofMahdIb.msi
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target DoonTheLustsofMahdIb.msi
- Size 27.4MB
- Sample260427-3b3mfaev3k
- SHA256 8e7fbd93d615e5143e9b2abf38eb1cc670c8bf59b7adc31c2d0bf5334d027a22
- MD5 76c83289f6ac6e15b47bc153693edaf3
- SHA1 d2718d657d24661df97cfaf894049fbcf9b6b8e9
- SHA512 0d98715427f4053818252b0719befbceaec1311df5a0fd7d30a1b67eccbfc4be487f63a4d4d55a9aad0d945ac1fb3c041799007f5095663d83a086e0dd2834ec
- SSDEEP 786432:hawzXsrEkqe3N/Qz4BRaRgEjyTeAu8EnF:haxrEk13FQz4XEjyqAO
- TLSH T14C5733D3D0B1068BDC3B88368678FA9901A9BD45DD42482EB65CF36984FB7D2B1FE015
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3248 LxiUdiWIvh.exe 1124 LxiUdiWIvh.exe - Loads dropped DLL 1 IoCs
pid Process 1124 LxiUdiWIvh.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{4775B19F-9A14-47CD-BA2A-10264B111D13} msiexec.exe File opened for modification C:\Windows\Installer\MSI3870.tmp msiexec.exe File created C:\Windows\Installer\e583728.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e58372a.msi msiexec.exe File opened for modification C:\Windows\Installer\e583728.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3676 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f6f843118761a0680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f6f843110000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f6f84311000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af6f84311000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df6f84311000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1616 msiexec.exe 1616 msiexec.exe 1124 LxiUdiWIvh.exe 1124 LxiUdiWIvh.exe 1124 LxiUdiWIvh.exe 1124 LxiUdiWIvh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3676 msiexec.exe Token: SeIncreaseQuotaPrivilege 3676 msiexec.exe Token: SeSecurityPrivilege 1616 msiexec.exe Token: SeCreateTokenPrivilege 3676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3676 msiexec.exe Token: SeLockMemoryPrivilege 3676 msiexec.exe Token: SeIncreaseQuotaPrivilege 3676 msiexec.exe Token: SeMachineAccountPrivilege 3676 msiexec.exe Token: SeTcbPrivilege 3676 msiexec.exe Token: SeSecurityPrivilege 3676 msiexec.exe Token: SeTakeOwnershipPrivilege 3676 msiexec.exe Token: SeLoadDriverPrivilege 3676 msiexec.exe Token: SeSystemProfilePrivilege 3676 msiexec.exe Token: SeSystemtimePrivilege 3676 msiexec.exe Token: SeProfSingleProcessPrivilege 3676 msiexec.exe Token: SeIncBasePriorityPrivilege 3676 msiexec.exe Token: SeCreatePagefilePrivilege 3676 msiexec.exe Token: SeCreatePermanentPrivilege 3676 msiexec.exe Token: SeBackupPrivilege 3676 msiexec.exe Token: SeRestorePrivilege 3676 msiexec.exe Token: SeShutdownPrivilege 3676 msiexec.exe Token: SeDebugPrivilege 3676 msiexec.exe Token: SeAuditPrivilege 3676 msiexec.exe Token: SeSystemEnvironmentPrivilege 3676 msiexec.exe Token: SeChangeNotifyPrivilege 3676 msiexec.exe Token: SeRemoteShutdownPrivilege 3676 msiexec.exe Token: SeUndockPrivilege 3676 msiexec.exe Token: SeSyncAgentPrivilege 3676 msiexec.exe Token: SeEnableDelegationPrivilege 3676 msiexec.exe Token: SeManageVolumePrivilege 3676 msiexec.exe Token: SeImpersonatePrivilege 3676 msiexec.exe Token: SeCreateGlobalPrivilege 3676 msiexec.exe Token: SeBackupPrivilege 540 vssvc.exe Token: SeRestorePrivilege 540 vssvc.exe Token: SeAuditPrivilege 540 vssvc.exe Token: SeBackupPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3676 msiexec.exe 3676 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2684 1616 msiexec.exe 90 PID 1616 wrote to memory of 3240 1616 msiexec.exe 92 PID 3240 wrote to memory of 3248 3240 cmd.exe 94 PID 3248 wrote to memory of 1124 3248 LxiUdiWIvh.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DoonTheLustsofMahdIb.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2684
-
-
C:\Windows\system32\cmd.execmd.exe /c "RUeExvQxSsQlExywkfGm.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\aSatEOp\LxiUdiWIvh.exe"LxiUdiWIvh.exe" "tIFvDgrpVSPx.js"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\aSatEOp\LxiUdiWIvh.exeC:\Users\Admin\AppData\Local\aSatEOp\LxiUdiWIvh.exe C:\Users\Admin\AppData\Local\aSatEOp\fjofaGqQpfxsUtpo.dat4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583729.rbs
- Size 9KB
- SHA256 a63b94be033cf00c7ee3a6171486add662d12b08b116da810a9381cf3e90b96e
- MD5 ad83be23ffd719515981713fbe3c14e8
- SHA1 05705fef839b63aa53b03ed6990cc12a9681b2a7
- SHA512 8274ab515b79ddd159e8585b6e84c0eddac7c01702aac47f886f68b6c4bca87c2987043926fe80a93245997b4063f5cd4a8142695815ecfb02785ee8dd55dbe6
- SSDEEP 96:5goyAXRS2PCIuPVb5u0xEoqHMf+7hIeGAvAmMUdr5UjcCsThqmAUdr5UjcC6j4A6:5raN3feZrM/IXM/aiO1kpZ
- TLSH T178129403B2D0C8F2D9991335C35B1F0837B6D3D6A206A76F0A8E95349F2BB9D8F59185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pwlgqmg978223juv.node
- Size 356KB
- SHA256 8b477dab403114209ec1258f6129f4634a61fa36421873dc3fcd8ab7ba0542aa
- MD5 fd9059a0fdb58255def1175ffa24f605
- SHA1 baccb39eb1dc65bec18719272c79d61524b5b371
- SHA512 ed264ec8e82340fa6af4a20cde42dc2e98c8e0334f157932a91a7a66abf7b63dc5e515802f8a568a9547970f4bf9afadb3afbba76fdbffa45e0a7b615ff869fa
- SSDEEP 6144:FVX6t4JL4+kQhPe71JaYG5VwYNc/fCfpH+iL+XYsnbyImnZp5:FVXDc+ksPe7rQ3wYXlYYsnby/nZj
- TLSH T19674AE5A72E40CB4E9A7917D89934A0AE7F3BC024B60D7CF03A056AB9F273D0953E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\RUeExvQxSsQlExywkfGm.cmd
- Size 69B
- SHA256 3935e4899dc641e3d8575ea0e3b137539f1a941dcf2ac43fe030e73156fa4b4a
- MD5 bee43d8d4df7f88ad9c776a507e249b5
- SHA1 f29888c5108408903a94c84e81bf8c0741917d77
- SHA512 d99ff9d1e651a5d8a8e2702c68e08f18fb571dad894278e8a0e27946428614b38b5bdd662013071af6d8b12285a8ed94846b2ed182cd81932a6f6dda734ab6d0
- TLSH T118A022002A200C0B08800C0020FF3008FCAFB0CAE0002C02000BCC3C2E0FC88A0CB0CB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\fjofaGqQpfxsUtpo.dat
- Size 1.7MB
- SHA256 3c3db0494561753ea3e659be0457d43e6d9158308e986591aaee82a8a4c31e71
- MD5 ec6ae944ebf1f2aa87dbc94a66bf47fd
- SHA1 f44a34770cff749dcc9fe5253a27ee7434748f32
- SHA512 b5881e13a955ad13c2755b077c2b3359e7916f48461b9939554c18c7efa8077898eadf57a892fc6e254c4809cea75958037d2e4010d92adede9a57f88c840c3e
- SSDEEP 49152:+djiCAEdlS1DFwtNwoaxIcFfPAjpxpIVACHPstc18DWzrSOM:q
- TLSH T13685AEDEB48F64D4B8F587F06FDA7F2A85AB50D32C81FD0E702092744E1057A9B9E819
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\fjofaGqQpfxsUtpo.dat
- Size 1.7MB
- SHA256 a143d9df934881da7a815978276e2ab777af61180598eba4e5bae4ec77cce306
- MD5 6dc173ea3248c0bea5fd1c0e34e93b74
- SHA1 7898af4cf5e13993933a0ca36ceb13229552bc94
- SHA512 2603d05ceaf83c92aa28aa0af8f0250b384ec639b6bdc285a0ca2af5e8cb27dfb0c4cc6a4c328da37746d04afb0c40b3a0a051deb26a9794852e5facd7ed782f
- SSDEEP 49152:2CAEdlS1DFwtNwoaxIcFfPAjpxpIVACHPstc18DWzrSOM:F
- TLSH T18A859ECEB48F64D4B9F587F06FDA7F6AC5AB50D32C81F90E702092744E1057A9B9E818
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\tIFvDgrpVSPx.js
- Size 2KB
- SHA256 84fd4a031f420fcbb69ad3925fc5c8ffe9a542dc845f1a2495b9e5fc9e542200
- MD5 1002821359ae052a16cfba830478e205
- SHA1 7f170b9e53ef7656294789caee19d4b1c876a8d0
- SHA512 35f2fe1b0fa314024101f1f8dad30b8224b2acced3bd2361bdb1e1f1df937a2ed2b6c3d97c54c03e03393dad293743829974af5c8bd24866ddecc3fee502056a
- TLSH T17151DD8C65C331A827CAB5E77627D8F0E45FCEBD342814BFC2886CD4290C525D6A62F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e583728.msi
- Size 27.4MB
- SHA256 8e7fbd93d615e5143e9b2abf38eb1cc670c8bf59b7adc31c2d0bf5334d027a22
- MD5 76c83289f6ac6e15b47bc153693edaf3
- SHA1 d2718d657d24661df97cfaf894049fbcf9b6b8e9
- SHA512 0d98715427f4053818252b0719befbceaec1311df5a0fd7d30a1b67eccbfc4be487f63a4d4d55a9aad0d945ac1fb3c041799007f5095663d83a086e0dd2834ec
- SSDEEP 786432:hawzXsrEkqe3N/Qz4BRaRgEjyTeAu8EnF:haxrEk13FQz4XEjyqAO
- TLSH T14C5733D3D0B1068BDC3B88368678FA9901A9BD45DD42482EB65CF36984FB7D2B1FE015
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 f1c63887741ddac9ef9d8cf094f68fa440052e8f0b06f5b524ccb589536fd284
- MD5 8abf5e8e9144a7cf3f16b13b1f1d190f
- SHA1 64060f9ef0b6e34e7645a2b1fbfc63210af6ecdd
- SHA512 fb98d25758fa181c5e4b353093123e45d7a161c95afc01cc6af6657f1db2b2c672cca8b6553766af3d09d4d5bfce31d9f6e8af36dd7b9b4c467b46b552f4b20a
- SSDEEP 24576:Pu8m+1zPdoO/vvTLbW0ORG6A1d0zMlUyYymt2r1VsUqVuzN54/19sSvBh:L
- TLSH T13F47B62436F92101E7F7AE3CB8F0AA234D3A7D579C19DE8D45411B4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{1143f8f6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9edbd8f9-a695-48a2-8218-c8d9c300bb3f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 34be2d6447071130c1d0253a41f42ca64c99005011b5d8e274b8a5f1378f1eea
- MD5 b07f9945a450c52ecb897278e988c32f
- SHA1 de51dc9d47efc5dea87408f2fa9305b4706ed210
- SHA512 77e4366966252a1be9a7e8d9eed12ac001fb6297dd73177082a94fd078e3884b34af4be7c1d4b536edff500975127fdf0e323007328b85602875b17f6ec565cd
- SSDEEP 96:FkOqjvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:yzb++ZVmN
- TLSH T1DDD18A085AF54711E2B3AB7229F18557A477B911EF33CB8E0298238E2670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH