Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 08:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.msi
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target Loader.msi
- Size 27.6MB
- Sample260503-j6byesdy31
- SHA256 803da30b682d1f0cc0cdb316f2cfae462ef4b17146421768af60bbff17636339
- MD5 63c610620b039c8f05bc8e3d25aeacf7
- SHA1 455fa561dfb222061b7c85e6356e792d135569b6
- SHA512 626a9079a89850a62c969331a6580e2a8d0cb407f2389aa828df6c39c4e000b48a967d4a6c317147df6ef767e652949ab754bfc7851dfe81a20500f688244e24
- SSDEEP 786432:LgviMIjgNeZBFKdyIvItrYj+bF/BrZDi/2:Lgvij0xgtrPb74/
- TLSH T1C7573356C0721F1BED9B8C3498AA4341CAACBE361F734A1D2114B76764FBBF03176199
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5832 RHzIskjyNuRthm.exe 3376 RHzIskjyNuRthm.exe - Loads dropped DLL 1 IoCs
pid Process 3376 RHzIskjyNuRthm.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e583bdd.msi msiexec.exe File opened for modification C:\Windows\Installer\e583bdb.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{4D610814-CF1C-4CB6-A5B9-E2D9B7AA88C0} msiexec.exe File created C:\Windows\Installer\e583bdb.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3D43.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4400 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002b6acb6f52f0180a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002b6acb6f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809002b6acb6f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a2b6acb6f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2b6acb6f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4544 msiexec.exe 4544 msiexec.exe 3376 RHzIskjyNuRthm.exe 3376 RHzIskjyNuRthm.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4400 msiexec.exe Token: SeIncreaseQuotaPrivilege 4400 msiexec.exe Token: SeSecurityPrivilege 4544 msiexec.exe Token: SeCreateTokenPrivilege 4400 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4400 msiexec.exe Token: SeLockMemoryPrivilege 4400 msiexec.exe Token: SeIncreaseQuotaPrivilege 4400 msiexec.exe Token: SeMachineAccountPrivilege 4400 msiexec.exe Token: SeTcbPrivilege 4400 msiexec.exe Token: SeSecurityPrivilege 4400 msiexec.exe Token: SeTakeOwnershipPrivilege 4400 msiexec.exe Token: SeLoadDriverPrivilege 4400 msiexec.exe Token: SeSystemProfilePrivilege 4400 msiexec.exe Token: SeSystemtimePrivilege 4400 msiexec.exe Token: SeProfSingleProcessPrivilege 4400 msiexec.exe Token: SeIncBasePriorityPrivilege 4400 msiexec.exe Token: SeCreatePagefilePrivilege 4400 msiexec.exe Token: SeCreatePermanentPrivilege 4400 msiexec.exe Token: SeBackupPrivilege 4400 msiexec.exe Token: SeRestorePrivilege 4400 msiexec.exe Token: SeShutdownPrivilege 4400 msiexec.exe Token: SeDebugPrivilege 4400 msiexec.exe Token: SeAuditPrivilege 4400 msiexec.exe Token: SeSystemEnvironmentPrivilege 4400 msiexec.exe Token: SeChangeNotifyPrivilege 4400 msiexec.exe Token: SeRemoteShutdownPrivilege 4400 msiexec.exe Token: SeUndockPrivilege 4400 msiexec.exe Token: SeSyncAgentPrivilege 4400 msiexec.exe Token: SeEnableDelegationPrivilege 4400 msiexec.exe Token: SeManageVolumePrivilege 4400 msiexec.exe Token: SeImpersonatePrivilege 4400 msiexec.exe Token: SeCreateGlobalPrivilege 4400 msiexec.exe Token: SeBackupPrivilege 640 vssvc.exe Token: SeRestorePrivilege 640 vssvc.exe Token: SeAuditPrivilege 640 vssvc.exe Token: SeBackupPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeBackupPrivilege 5596 srtasks.exe Token: SeRestorePrivilege 5596 srtasks.exe Token: SeSecurityPrivilege 5596 srtasks.exe Token: SeTakeOwnershipPrivilege 5596 srtasks.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4400 msiexec.exe 4400 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4544 wrote to memory of 5596 4544 msiexec.exe 96 PID 4544 wrote to memory of 2324 4544 msiexec.exe 98 PID 2324 wrote to memory of 5832 2324 cmd.exe 100 PID 5832 wrote to memory of 3376 5832 RHzIskjyNuRthm.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Loader.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4400
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5596
-
-
C:\Windows\system32\cmd.execmd.exe /c "PGLzmm.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\HQTta\RHzIskjyNuRthm.exe"RHzIskjyNuRthm.exe" "YfeqexIOizQ.js"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\HQTta\RHzIskjyNuRthm.exeC:\Users\Admin\AppData\Local\HQTta\RHzIskjyNuRthm.exe C:\Users\Admin\AppData\Local\HQTta\WlccHwbSxHFlZPUBXOo.dat4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583bdc.rbs
- Size 9KB
- SHA256 74a36b6f98cba8a0e099639acaad60409e16b8df47a9bd24dbbb453350129935
- MD5 98fab3c53f4fd5aaf69669c6012571c0
- SHA1 273840af330244077008daf1ef4d8ae413f770a4
- SHA512 65df90f4f8c6e80c5348107ee10fde1cfe86e007a49d494305c81aaca69140774b459c54d8d13fb335ec4b674c4ba47801f064679b53489e2ef81bcb0d74df30
- SSDEEP 96:Un4xk0JUPTc+tze2Aj1UhBmCsThqxUhBmC6jxi6KThqkHDA0LJicdGTtNWC+pXBy:UngOePOb1ILb1rZqF+pc
- TLSH T1FD123490B2C0E5E2D8993635C72B0B5D3F75E7C6D321734B058A95248F07BECEB99282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\PGLzmm.cmd
- Size 72B
- SHA256 cc265a02025220800d98717a5f5cae7acedfd8525831f8474ab55251aa3ac00c
- MD5 136a6ff2735d05064061250019f7dae1
- SHA1 af0f68ad34f22179c70b8c1586b4114ee500010e
- SHA512 98405a6fd82007fd7a8ed09f2aab1c99d3f145bfffc2a22bf3d4327c71869e2315b9471faeced675c016b385d612b4d104b91ef96558a536f8d532369888ed0f
- TLSH T1C0A002821822480565DB1C1558BF2DCAFE4BF1CA991C6A44716169684E8F9D4B2CF4E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\WlccHwbSxHFlZPUBXOo.dat
- Size 1.8MB
- SHA256 7c5ba6d8b588c4c20dbbfefcf47c225eacf9983a6d3b7b9c7ee17b364f5e4c3f
- MD5 cabc6e469d23ad3da4ea827a342f6a1a
- SHA1 bc6129a97bc80951d3db735ea8b3a31f4bc1d3ea
- SHA512 d7b4434766500f8613ffac77dc236efe012c78669eadf7e12be6f48ab656cc54a1a76e80e014d425aaaafe29a5a68f07f62ae5e18ea6a2f27dbb5c3752b17702
- SSDEEP 49152:lcX+uRTjrYKN490RvM1L8wfN1E9s/rPRkpwKfze8k:5
- TLSH T194959EDDB08F64D4B8F587F46FDA7F2A86A710D32C91FD0E702092744E1057AAB9E819
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\WlccHwbSxHFlZPUBXOo.dat
- Size 1.8MB
- SHA256 c821b155d58435c33da3f0ba54b6569b782643d26bcd6a31d389fbfe162f98f6
- MD5 7b1b0a2568d5f23e14afe7b09eed8df1
- SHA1 25cd59cdfb3feeab60f34cb59bbc5799c433c3a5
- SHA512 b5e4fdadc00b0a2425e5109cf0f8afb869a1d32ac387773398be1be78bf1ab9dbda156ca749d8a862126a86638a68e5b9c398ea15a6767b5bba93c62b038afd5
- SSDEEP 49152:2IcX+uRTjrYKN490RvM1L8wfN1E9s/rPRkpwKfze8k:h
- TLSH T1A8959ECDB48F64D4B8E587F46FDA7F6A85AB10D32C91FD0E702092744E1057EAB9E818
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\YfeqexIOizQ.js
- Size 1KB
- SHA256 aad6a1ea24566e3df381ddc686f04414f7cf2309f6e4f33d3714d52e46b54fcc
- MD5 6b30d4fb96b41fa09799278e9475b09d
- SHA1 9b77deb6ef2bfaf4010d1a83cec6c43d9034fbd2
- SHA512 3a37ab2bd95aa99959027653a0152aefc5d6d81c224f18a8444bb0d0d236e6e878ce165c1e77701d9292922605c33802505a94bf613b6086e7f65d385768f553
- TLSH T18031EBBC1E00295A237676D7BD355E61CBA7CB0534644640D0AC91C23A8EE604E5FAEA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\uv60i4kdmpy5ll4h.node
- Size 354KB
- SHA256 9ef045c2833cfb263fb7d59410eaca0ff36f2fa10599564de7d1a7b0db97ef21
- MD5 84a75a9a35043f632aba2f6a27cf6aab
- SHA1 1922c15cb96217fe515bcea523a2ff8e45a40a18
- SHA512 f3d6df5080be82fb6c7e1ed2ae5ea423ddbc9a61b53b824b28303dbc2002bc3f02e63a981f951d67d3ed48e6313cc9a6236978b66f0ce70cafe696d7c5ac601f
- SSDEEP 6144:nVX6t4JL4+kQhPe71JaYG5VwYNc/fCfppZT+9rE/EOrCFMrzhDuxk:nVXDc+ksPe7rQ3wYXbA9bOmGlDc
- TLSH T10574AE5A72E40CB4E9A7927CC957490AE7F3BC020B60D7CF03A046AA9F677E0953E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e583bdb.msi
- Size 27.6MB
- SHA256 803da30b682d1f0cc0cdb316f2cfae462ef4b17146421768af60bbff17636339
- MD5 63c610620b039c8f05bc8e3d25aeacf7
- SHA1 455fa561dfb222061b7c85e6356e792d135569b6
- SHA512 626a9079a89850a62c969331a6580e2a8d0cb407f2389aa828df6c39c4e000b48a967d4a6c317147df6ef767e652949ab754bfc7851dfe81a20500f688244e24
- SSDEEP 786432:LgviMIjgNeZBFKdyIvItrYj+bF/BrZDi/2:Lgvij0xgtrPb74/
- TLSH T1C7573356C0721F1BED9B8C3498AA4341CAACBE361F734A1D2114B76764FBBF03176199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 618c69615be4713e467feb99e34aabb219de9269e8bea86b41fd76da9f6ea626
- MD5 b24c96dc6c8597c59bcce112e922a131
- SHA1 432cf56658bf2200cf978d7cd302e2736950e69c
- SHA512 e83f927fb7af6b17e30526392607a557289d1b59371a3a91fd83ae3b8686121d6bf73df421715397ba857a26289b4c603653f884ab71fa68b6fae8f23ccb5c56
- SSDEEP 24576:9u8m+1zudoO/vvTLL2rOOWafqiEjj1byn9mNpka1DU6qeMS2I/liDdQRe:M
- TLSH T13547A32436F92100E7B79E3D78F06A634D3A7D6BAC169E8D45411B4E0921FB0E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6fcb6a2b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{812aa890-1c5a-408b-85e1-d6c2fd0c8905}_OnDiskSnapshotProp
- Size 6KB
- SHA256 629179cbffb3c4e9b2488ab633686c2921043bdba0849ebb7bf9066915c36c95
- MD5 283cc627e755a7a5562eda6e84c20bc9
- SHA1 cdaf06b95e3f54bd3f153106fbfd47601f74ca36
- SHA512 82c141b0e5efc8e3b5aa5da3046525c2b8791fcf6bb1ad8c0af84e4310feda1cc5162d368010ca2dd98af68ced0f133b012ab685c5fbf40477e96693b0fbed50
- SSDEEP 96:F+tF13Lvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:WXb++ZVmN
- TLSH T182D189185AF54711E2B3AB3229F14557A477B911FF33CB8E0198638E2670910F875F5B
- MD5 SHA1 SHA512 SSDEEP TLSH