Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/04/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target Setup.exe
- Size 36.7MB
- Sample260429-2prxesg17z
- SHA256 fab5f7b81e5afd283ee929f648841576fbb250bac4a778d2011a022e973d53d3
- MD5 a51dd84a9d10ef44849c50a387580e0b
- SHA1 3c67f3665c75fe2e77650f4961d5eabc2f7fb90f
- SHA512 f363c07a8b3f2af889904e768e97fe4a7312358948a2c43d299177508eec8cc21e9ca6b741e7cfaaf5c554a190708609a2acbc69c8fab8e3ec8131ce19b17b8d
- SSDEEP 786432:bY1vpxYzmFlWDhaGcwv6t8l8E5Bl45qZB5lrBW6QzMbnli:bYE80VaJvJOa5oBz1czanw
- TLSH T1A98733E3C72F81F2E720E1317BD465B6BD647AE96C6328114B47F88526B9C0650FCC9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4116 MSI4E75.tmp - Loads dropped DLL 1 IoCs
pid Process 3676 MsiExec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5708 MSIEXEC.EXE 3 5708 MSIEXEC.EXE 4 5708 MSIEXEC.EXE 5 5708 MSIEXEC.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files (x86)\KORG\KORG Legacy\WAVESTATION.exe msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\WAVESTATION.dll msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\audioio\directsound.dll msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\audioio\mme.dll msiexec.exe File created C:\Program Files (x86)\Common Files\KORG\WAVESTATION\WAVESTATION RTAS.nfo msiexec.exe File created C:\Program Files (x86)\Common Files\KORG\Plug-Ins\VST\WAVESTATION.dll msiexec.exe File created C:\Program Files (x86)\Common Files\KORG\WAVESTATION\WAVESTATION.nfo msiexec.exe File created C:\Program Files (x86)\Common Files\KORG\WAVESTATION\wsdatex msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\Documentation\ReadMe WAVESTATION(E).rtf msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\audioio\asio.dll msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\language\Legacy1041.dll msiexec.exe File created C:\Program Files\Common Files\KORG\WAVESTATION\WAVESTATION VST.nfo msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\Presets\WAVESTATION.fxb msiexec.exe File created C:\Program Files (x86)\Common Files\KORG\KORG Legacy\WAVESTATION Authorizer.exe msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\Documentation\ReadMe WAVESTATION(J).rtf msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\language\default.dll msiexec.exe File created C:\Program Files\Vstplugins\KORG\WAVESTATION.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Digidesign\DAE\Plug-Ins\WAVESTATION RTAS.dpm.rsr msiexec.exe File created C:\Program Files (x86)\Common Files\Digidesign\DAE\Plug-Ins\WAVESTATION RTAS.dpm msiexec.exe File created C:\Program Files (x86)\KORG\KORG Legacy\Presets\WAVESTATION_Init.fxb msiexec.exe File created C:\Program Files\Common Files\KORG\WAVESTATION\wsdatex msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFB2C6DC9B91AAF1F9.TMP msiexec.exe File created C:\Windows\Installer\e5948e9.msi msiexec.exe File created C:\Windows\SystemTemp\~DF84394B15C856AAE6.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\1033.MST msiexec.exe File created C:\Windows\Installer\e5948e6.msi msiexec.exe File created C:\Windows\Installer\e5948e7.mst msiexec.exe File created C:\Windows\SystemTemp\~DFA32CDBB059CC0005.TMP msiexec.exe File created C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\1033.MST msiexec.exe File opened for modification C:\Windows\Installer\e5948e6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e5948e7.mst msiexec.exe File created C:\Windows\Installer\SourceHash{6C2C56CC-9075-491D-9B29-55147B67B892} msiexec.exe File opened for modification C:\Windows\Installer\MSI4BE4.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF79854D0F7D06AD64.TMP msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI4E75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f1d998fde3c4bea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009f1d998f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009f1d998f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9f1d998f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9f1d998f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\WAVESTATION_RTAS = "RTAS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3F24BDAC144EFB48B18A0B5181DB99D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Transforms = "C:\\Windows\\Installer\\{6C2C56CC-9075-491D-9B29-55147B67B892}\\1033.MST" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\RTAS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\PackageCode = "0769FB6114B4F9D4EAC516B8D6255065" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\PackageName = "KORG Legacy Collection - WAVESTATION.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\VST msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\WAVESTATION = "Standalone" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Version = "17235968" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\ProductIcon = "C:\\Windows\\Installer\\{6C2C56CC-9075-491D-9B29-55147B67B892}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\AuthorizedLUAApp = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\ProductName = "KORG Legacy Collection - WAVESTATION" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\WAVESTATION_VST = "VST" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3F24BDAC144EFB48B18A0B5181DB99D\CC65C2C65709D194B9925541B7768B29 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\Standalone msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Net msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5824 msiexec.exe 5824 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5708 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5708 MSIEXEC.EXE Token: SeSecurityPrivilege 5824 msiexec.exe Token: SeCreateTokenPrivilege 5708 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5708 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5708 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5708 MSIEXEC.EXE Token: SeMachineAccountPrivilege 5708 MSIEXEC.EXE Token: SeTcbPrivilege 5708 MSIEXEC.EXE Token: SeSecurityPrivilege 5708 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 5708 MSIEXEC.EXE Token: SeLoadDriverPrivilege 5708 MSIEXEC.EXE Token: SeSystemProfilePrivilege 5708 MSIEXEC.EXE Token: SeSystemtimePrivilege 5708 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 5708 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 5708 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 5708 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 5708 MSIEXEC.EXE Token: SeBackupPrivilege 5708 MSIEXEC.EXE Token: SeRestorePrivilege 5708 MSIEXEC.EXE Token: SeShutdownPrivilege 5708 MSIEXEC.EXE Token: SeDebugPrivilege 5708 MSIEXEC.EXE Token: SeAuditPrivilege 5708 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 5708 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 5708 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 5708 MSIEXEC.EXE Token: SeUndockPrivilege 5708 MSIEXEC.EXE Token: SeSyncAgentPrivilege 5708 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 5708 MSIEXEC.EXE Token: SeManageVolumePrivilege 5708 MSIEXEC.EXE Token: SeImpersonatePrivilege 5708 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 5708 MSIEXEC.EXE Token: SeCreateTokenPrivilege 5708 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5708 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5708 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5708 MSIEXEC.EXE Token: SeMachineAccountPrivilege 5708 MSIEXEC.EXE Token: SeTcbPrivilege 5708 MSIEXEC.EXE Token: SeSecurityPrivilege 5708 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 5708 MSIEXEC.EXE Token: SeLoadDriverPrivilege 5708 MSIEXEC.EXE Token: SeSystemProfilePrivilege 5708 MSIEXEC.EXE Token: SeSystemtimePrivilege 5708 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 5708 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 5708 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 5708 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 5708 MSIEXEC.EXE Token: SeBackupPrivilege 5708 MSIEXEC.EXE Token: SeRestorePrivilege 5708 MSIEXEC.EXE Token: SeShutdownPrivilege 5708 MSIEXEC.EXE Token: SeDebugPrivilege 5708 MSIEXEC.EXE Token: SeAuditPrivilege 5708 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 5708 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 5708 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 5708 MSIEXEC.EXE Token: SeUndockPrivilege 5708 MSIEXEC.EXE Token: SeSyncAgentPrivilege 5708 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 5708 MSIEXEC.EXE Token: SeManageVolumePrivilege 5708 MSIEXEC.EXE Token: SeImpersonatePrivilege 5708 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 5708 MSIEXEC.EXE Token: SeCreateTokenPrivilege 5708 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5708 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5708 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5708 MSIEXEC.EXE 5708 MSIEXEC.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 900 wrote to memory of 5708 900 Setup.exe 80 PID 5824 wrote to memory of 3676 5824 msiexec.exe 82 PID 5824 wrote to memory of 5280 5824 msiexec.exe 86 PID 5708 wrote to memory of 4116 5708 MSIEXEC.EXE 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\KORG Legacy Collection - WAVESTATION.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\MSI4E75.tmp"C:\Users\Admin\AppData\Local\Temp\MSI4E75.tmp" SSJU2MP7C7GYIG6PLPBB7BK4822FC6MD2LWYFCFT4Z3P9XTDTK#3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4116
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CE0970FAA2FC6CC9F5F8CED623FC65C2 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3676
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5280
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:6092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5948e8.rbs
- Size 15KB
- SHA256 096c5b0fe1005e4cc09723c6e748c28f881892417dcda5aaf98fa3e434b76987
- MD5 d569ef878bf2f04d5da50097268de30b
- SHA1 81532993dacd1a45f44b3c1490f8415e38f7798a
- SHA512 dce1dcc9c2031c816ddeae8a180ce14f7490ef9268f56ecde73c0ed47a2df42b2d38fdd759361b6029ebf90655b58c5c259bf4bd35ef39584f9c30d5929b1abf
- SSDEEP 192:PCIFVUrIt1Zopk+FnTiG0Ae0xqG9xqrTgSuENZ3BuoY8sNdRW:PdFVUct7wfGqxzxQhEDW
- TLSH T1737241425700C2E2F9A20A30C7B31B523793EBD49B1A531F89DDD6324DC1B9E5AF906B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KORG\KORG Legacy\WAVESTATION.exe
- Size 469KB
- SHA256 d4436cd523fc4be4240673c81ec1c3f051db097198ea804eca3ce279c1ecb891
- MD5 3c047a77d56bceb1997162cdae48b70b
- SHA1 e72bd96d906a2b6f352127ab7c8358827181181a
- SHA512 97d62074bb85d12999d4a453967db7a445ad597e3bd145f122d8a9f1703ec27b80fd6002fbbe904b234e4bcfbe3929be70c68bb3ee10887cac805b09695b993c
- SSDEEP 6144:BeBjPwsxSionYf6chysLmdYut/VXLsch8bmZg7ZonAD1YZdaVx:Bqv7f6chryPLscmquoADWSx
- TLSH T1F6A49D11F3A181B3DA4A16390CBEB759897D9E994F298BC3A3D43D1EDD727C22833149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- Size 1KB
- SHA256 64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d
- MD5 f8d3904655f1dfd5082a1e9c68b3e526
- SHA1 d1df59f63a480c5615dc9e98659398b8406fb049
- SHA512 60bcfab16e91c4ac09fa3dbc710da31cb039678e979a70d0a11c1634c9c7f00f23e910e10990aa1ebec9846730dc4a85bb0a693caf1cfbe5d54962794c16330e
- TLSH T1243157690851377354A13775C99B8DD79EF293911BA2D84AC2644A460822FCA1FC80F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
- Size 26KB
- SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
- MD5 ff690102c64e4baa8bad0c6a7a0fcac2
- SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
- SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
- SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
- TLSH T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_C4776F43E34360B285B1E0E212F424A8
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
- Size 834B
- SHA256 de6bcf84b3f5959cfdf2f8b6622a68cbbbd52d804e59751a5e52a8ac985d369d
- MD5 4ae5d026e246530e8e5c389ad0814e17
- SHA1 e1c1a7225cac5fafcbb8bd8abf30559d2029914c
- SHA512 1d0139cf1270f44e1d0fcc8d9eca365fbb86bb3bcd0993904c02b581a20f51aeb14d1de32a9224337f35a2c61667e791bf3a965d34633a5905526e986f772170
- TLSH T1740112E6C1187921A4915725C19CFD5FC87473C95FC9D44A90F8C7CA2C63F986B4206B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- Size 182B
- SHA256 4f554cb0e35d13ea35920cd331935ca58e68ff82386ba0d44f08b2ee01cabbcc
- MD5 26c8d0cd2096fe13d4eba41b5dc14ee6
- SHA1 a699cb7fc2c1d1c7dd1978f5899fa37e5797d788
- SHA512 da7ba83e7768708ce6351fbd304cbd282777c989d95e88a1896d8ba9a5163cca84bc075864b16b255a255011774b18b35ab0a0ca4a3c5d65733990b4cb7833d9
- TLSH T102C02B042308C102F1910F7F0C614620DF343D10C753C32C473C131C8438E800C77801
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
- Size 212B
- SHA256 b153a0b7b352b7e8ac4ce4ba0789589b9497539ae98e0e9eee1b17a075a03cc9
- MD5 eb1263c822316b7d078816c6be783603
- SHA1 b6e2803c5fd76297baf11c61f21a7932294901f3
- SHA512 fb4c6c168ad05270d8da6dd64de6ab548e67de98e9ed5ecc1521bbe52b190e1db5cff53166d5a23047f42a497ab85becc084b20737f45ca3cda7c1f6f0270321
- TLSH T1BDD08C040B390243F1672B3E2AD21717AE26AFB24581CF0813B463594638F21AD38D27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_C4776F43E34360B285B1E0E212F424A8
- Size 408B
- SHA256 4db0399072844c9c073e0aa3e3d079e2d709bd672c80e4371484c192d30db2cb
- MD5 5f66eab956867d08873287dc135d6871
- SHA1 77bc86cc0514c04e0e3ea3d5f150c75035804c12
- SHA512 7ffc281f238fee3795495bc0a5dbdb5b1e95bfa38f498634cfb432ea188c471a0c7e281db9620bf40ebf97f03eb88ea33aac56883ebb937e3176e9cc566ee7ed
- TLSH T1BFE07D181B7D823DF136EE385AD9A268C45BEB1104A001A641C262477A21900EDE3539
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
- Size 404B
- SHA256 29d2d9658bcd596923ffbf854d02aae8db3c1b679962f2d8ef5ba721a129aa6f
- MD5 7662e6178ecddd6612c55f96f1210434
- SHA1 bc1885e110c24519ee703f4400e726ae5ae0a4f7
- SHA512 6e43cd96eead4ca04553e5532e58df204fd561341add8dae4ddabf4063f38603a18a7ada65f3b4751fb2b3492912bdca147311065b71ab982f7c17f2c47a30aa
- TLSH T100E07D1819FE51ADF1B5CE759BD555166A17F90104A003FA81C56202AA23E000CE1931
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
- Size 188B
- SHA256 ec23b0f43d6ccf6279e4e66136ac4ccded558367f1a5924a3e1a4dd6a13f05a5
- MD5 813a817b9a0ca171bce05917a9eb10c4
- SHA1 e054917877af2b91947dcc6ffa65aa6a86286506
- SHA512 b1dc32c6e061ea8bc71cb984c6379a3b3e7553613bdfbb6f0253b65c3064a72d6b6bde033674c88fe47250d4622b2576a2cf04a7c73be43abc79280562a4a32c
- TLSH T128C08C112796064FF965063E28350200BBA8BF118341C3050BF8101C993BE100CB1C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
- Size 408B
- SHA256 f19b702d20534c7bcc1650e84fd4d4bccf548270a56d501ff1027018cfcd0c84
- MD5 13042013155fc6401ffb03230efcbdb6
- SHA1 db6d5066892ccd32c17cd994a223a213639854be
- SHA512 a09aa7a4f3ac3d10c899ee8579934da83ae2c7de7d9156bcfd26e93d3c7e2408939f7631db19777801d656c8127d74eda5746c4f9070486a432fbf02f0930c57
- TLSH T1D3E07D0823FB826EF8A0D57889DDB13A592BF716054E51FA0094534DB752B011D63E31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4E75.tmp
- Size 61KB
- SHA256 e9309d28bd74a9f73a5c1ba8bbae66238ca555a6fb0556b9ddb27806ccc8e6b4
- MD5 5c11a7f40108fde1234b41aeddbf2eca
- SHA1 dfbed5b6c8dba817e3de6b71ac751da7c91dcfbb
- SHA512 52c69908c4e4a5f0780227512c173f2f083d21dd0bba0015ab5c2eb5d3a627c2c3abb35afec1073f1f2089a95a0c3cb58438fb55dabde80746778544eadaa189
- SSDEEP 768:g23K9B8Ze5OOomVam8LrEsk7dX30hZbv6KE7LBVToaBiPmlXgl7b2CL3qbK:af8kPom0mU07dUh5rE7LfTHSlOCOK
- TLSH T1FF539D0735A2D0B3CC45457408E9DB469F37F2110BF0D9833FA8165EAFA27E16A3A369
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI997C.tmp
- Size 96KB
- SHA256 18ffc2996e1a0f89a4018da7c9f3287b40b2c19ba9ec9b0265d2d27ac294d7a8
- MD5 f12f03b678df900492b14985e5b5fc73
- SHA1 87172dc3215fc168157b11d8fb026eaae98cb507
- SHA512 05ec9b0858153c96193ccab8e266719494b5170cd70e26ea436eab672bc85d81409319df958261cd7f43015e5e05e27ae98525f015beb080f17f06909b723850
- SSDEEP 1536:xVgNTb67hb2MwFTKySgE6bSKycjyc/jVl0TF84+:sb67hvw++SKycjyc/jVlwGt
- TLSH T19AA39E11BA9043BADA8D143018AA8F3BA77DB9A00FE184D39F75EB5D1C716A0F237147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\0x0409.ini
- Size 6KB
- SHA256 2a5eb805543b141d77ce7192c5f7e4e10ffb56de0a5a66905c79298dfc5ffbd5
- MD5 26a9b54f250e00693773481b837e03cc
- SHA1 554a407bf23984026785430e3bbdffdd1285be06
- SHA512 a9f141f96f7bb498c4326cab2e846ce0715830ec86b04a311ccb0c7f3eb6adcc62ec1412cbd8d230b957cd923ab3a81af34b40294297773395d53d8aa73f9073
- SSDEEP 96:VXoB2A2ul8/T3INLfRtMx76U0KOFWgVQMG2Uub0QAg80SbtEBapIx0KsLK3E0bT3:J0YT3wLfRA0v/tBAvCSEB90K
- TLSH T1F0D1644F4FA6837E2861031AB26F2651F322956D5363D167B1EF00587383E1893BB6E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\1033.MST
- Size 29KB
- SHA256 c7fe1c9c79ae7d66849f5475cbd2223c33f36454ea230b369152e0da42142e1b
- MD5 aeb46a432730d2ba209e2354306825c2
- SHA1 c194fa4318a961e2f9f147b8963af37898ae0242
- SHA512 267c060bc310b29c4cbdbf41901c1f889fa83bacf6505425916f6b9bead0770ab39698ed343cf724f533a1f415db4983292666ee4a1799fe915e94b68a5f644e
- SSDEEP 768:jY8jq2zt41yKlK6+jVyvLRIdP7rtLtdPYcP+qPCIZJkZ1tW:E05yjRIdP7rtLtdPYcP+qPCIZJkZ1tW
- TLSH T12FD25273E5803EF2C4E202B41D06E9993AF65C2970B6D3943951B09B51BFE3443F75AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\KORG Legacy Collection - WAVESTATION.msi
- Size 32.8MB
- SHA256 478a6b7f137f8b99c2fdcc38237fe4a625d3f3e479ea4cadcbf5d635ccb10762
- MD5 e7fb4879d4db363fdeee79454601b397
- SHA1 69a5f21070c711eaccbecc3a90b5c873742eb365
- SHA512 baa984c3a17d7eca013427f13c81af0d1b12fac0132d9e195e0c9ffafae7d8af570d79e82106e7f2ad4002f5f842c6818691fb8b0e9c449105056b232944e401
- SSDEEP 786432:9ZNJ6rA1nqroWRbwo6Hqv7/2dzPlG999pPKJ5H0drJMqJ:9ZT6r2QtUneTSc
- TLSH T127773361750A8231F1586138440B1B628BF7AD118B2897E777B8EE5F1CF3B60E6B91C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\Setup.INI
- Size 2KB
- SHA256 6b71557af4977b65cb6415a2d816a4956134cd80aa1b2e4ce8eb64267c436969
- MD5 50d9b11a74181b72d92da0f9163af0ae
- SHA1 974ae200f2caaddcd3d80ca172e26945eae161f5
- SHA512 62ead0ee72687b592f592c4c5eaf7ec108753494c95ceff8f033f878b6ec90c1532166c713b7c1be382531d9c244940010c6e9fedc7ebce3b731a7ed9f5f509f
- TLSH T1645130D131A718BD914B607729F722C325C929A009273205D7A44AA2DFDCA2B0B3F2B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\_ISMSIDEL.INI
- Size 545B
- SHA256 9fb09c48b4db08d5a659d149dc4b201bf0b1ea30097a522ecfede75e44e74f23
- MD5 5976b10082a1a25c6ad869fae3f337fc
- SHA1 87ed782fe1a326d02fcb11136cc3bd51c01964ac
- SHA512 241c2794f2f65634cda283da0c6852505e3fcf9469dc3b935778b16f64d255eac5c23ab6ec36e4e16834f2dddb65b1f173a204e42c1d6235ae4a7d8a0df725a5
- TLSH T12EF0C2345343EB2A981540330DA2C3CC86A2190C2ADA3B33ABF2D51CAD8D45ADA8A212
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\_ISMSIDEL.INI
- Size 105B
- SHA256 b96d9674d8885b0621c0de0e955a7af74bd029e2bc88a90981befebc0ea064bb
- MD5 b484820d6883d7c47f97dd8b84b8d3f4
- SHA1 a5aab13eae71ffab7b141066fea1711cbe4da06b
- SHA512 f83a1febcf271bb6ffc99ab7112a6a66a07c4b72046bbb7a507189a76ede1c93875e276dfb750b186462567756c3382c09e9f2fc3e541edba504226cdc4acb3c
- TLSH T11CB012248743DF1A9824202708BEC3888360140C57D1773362E1D40CDA5A509D04D218
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{76ADA73E-750F-4DFE-B744-732D4DF1068A}\_ISMSIDEL.INI
- Size 11B
- SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
- MD5 3fdd2635aa94921522af8186f3c3d736
- SHA1 0fe63553e9f993c0cb2cb36b8cdcfba4f4a2650d
- SHA512 ebdbeefbdc777937fce516a1cbd9af7c305fc242091d695ad919a27c98fac5b6b16b44130bdf97dbfd10561cce701180b1fbb303d848944c3b33b8a3c058653a
- MD5 SHA1 SHA512
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 f9beddc79e733c14857f2637935266c10510eb69087c51a59b0b602b9434f202
- MD5 fd04588e461df6a4c44a9fcc5621be92
- SHA1 6e0dde3947e21e55585b356478a9fdeffc44e86f
- SHA512 78356b0ef9e8a596c8075ca5f3da06f3c78a4f84022edc607998878963add457391854a537f220800207f9b2354e9fb233807ce919a63108672d0029de20899c
- SSDEEP 24576:42gmSp17doO/vvTLh2q+REnKfqJBg4eAWWp93Jkqzx6Ik2uv4Rb9bngNh:2
- TLSH T18B47A4243AF92120E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0921BB1E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{8f991d9f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3fe2e558-ef2f-48d7-8fd1-9176e16442ae}_OnDiskSnapshotProp
- Size 6KB
- SHA256 7bb86ea6846cb868d73746118ea8981ce0c2677b3cbaecf096a50723a65237b6
- MD5 e27dde68752e6c246802437024292530
- SHA1 a21d4b93ebe24de4679d6214e6a07d22f1515506
- SHA512 38c15c1d4dfdfe911594a94f85bacc15ed1d5f0211b39e655648a8e604e3c6d5b3e5da3713ea69d5ea5730002c107dc7a5f776d08ef2bd4ca23c5ad0eda95302
- SSDEEP 96:Fu8vXoOQhrvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:DvX4hBb++ZVmN
- TLSH T1E8D189085AF54711E2B3AB7229F14557A877B811EF33CB8E0298238E2670A10F835F5F
- MD5 SHA1 SHA512 SSDEEP TLSH