Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 08:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.msi
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target Loader.msi
- Size 27.6MB
- Sample260503-j6byesdy31
- SHA256 803da30b682d1f0cc0cdb316f2cfae462ef4b17146421768af60bbff17636339
- MD5 63c610620b039c8f05bc8e3d25aeacf7
- SHA1 455fa561dfb222061b7c85e6356e792d135569b6
- SHA512 626a9079a89850a62c969331a6580e2a8d0cb407f2389aa828df6c39c4e000b48a967d4a6c317147df6ef767e652949ab754bfc7851dfe81a20500f688244e24
- SSDEEP 786432:LgviMIjgNeZBFKdyIvItrYj+bF/BrZDi/2:Lgvij0xgtrPb74/
- TLSH T1C7573356C0721F1BED9B8C3498AA4341CAACBE361F734A1D2114B76764FBBF03176199
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 6024 RHzIskjyNuRthm.exe 4964 RHzIskjyNuRthm.exe - Loads dropped DLL 1 IoCs
pid Process 4964 RHzIskjyNuRthm.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{4D610814-CF1C-4CB6-A5B9-E2D9B7AA88C0} msiexec.exe File created C:\Windows\SystemTemp\~DFC1A5D1AE61D52B49.TMP msiexec.exe File opened for modification C:\Windows\Installer\e584234.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFA4E4F207AA945742.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4419.tmp msiexec.exe File created C:\Windows\Installer\e584236.msi msiexec.exe File created C:\Windows\SystemTemp\~DF3E6EA14A11214E74.TMP msiexec.exe File created C:\Windows\Installer\e584234.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFA7A66EB67B45D405.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4908 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001dfaa52160603e580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001dfaa5210000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001dfaa521000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1dfaa521000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1dfaa521000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5508 msiexec.exe 5508 msiexec.exe 4964 RHzIskjyNuRthm.exe 4964 RHzIskjyNuRthm.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4908 msiexec.exe Token: SeIncreaseQuotaPrivilege 4908 msiexec.exe Token: SeSecurityPrivilege 5508 msiexec.exe Token: SeCreateTokenPrivilege 4908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4908 msiexec.exe Token: SeLockMemoryPrivilege 4908 msiexec.exe Token: SeIncreaseQuotaPrivilege 4908 msiexec.exe Token: SeMachineAccountPrivilege 4908 msiexec.exe Token: SeTcbPrivilege 4908 msiexec.exe Token: SeSecurityPrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeLoadDriverPrivilege 4908 msiexec.exe Token: SeSystemProfilePrivilege 4908 msiexec.exe Token: SeSystemtimePrivilege 4908 msiexec.exe Token: SeProfSingleProcessPrivilege 4908 msiexec.exe Token: SeIncBasePriorityPrivilege 4908 msiexec.exe Token: SeCreatePagefilePrivilege 4908 msiexec.exe Token: SeCreatePermanentPrivilege 4908 msiexec.exe Token: SeBackupPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeShutdownPrivilege 4908 msiexec.exe Token: SeDebugPrivilege 4908 msiexec.exe Token: SeAuditPrivilege 4908 msiexec.exe Token: SeSystemEnvironmentPrivilege 4908 msiexec.exe Token: SeChangeNotifyPrivilege 4908 msiexec.exe Token: SeRemoteShutdownPrivilege 4908 msiexec.exe Token: SeUndockPrivilege 4908 msiexec.exe Token: SeSyncAgentPrivilege 4908 msiexec.exe Token: SeEnableDelegationPrivilege 4908 msiexec.exe Token: SeManageVolumePrivilege 4908 msiexec.exe Token: SeImpersonatePrivilege 4908 msiexec.exe Token: SeCreateGlobalPrivilege 4908 msiexec.exe Token: SeBackupPrivilege 1520 vssvc.exe Token: SeRestorePrivilege 1520 vssvc.exe Token: SeAuditPrivilege 1520 vssvc.exe Token: SeBackupPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe Token: SeTakeOwnershipPrivilege 5508 msiexec.exe Token: SeRestorePrivilege 5508 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4908 msiexec.exe 4908 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5508 wrote to memory of 5548 5508 msiexec.exe 83 PID 5508 wrote to memory of 2824 5508 msiexec.exe 85 PID 2824 wrote to memory of 6024 2824 cmd.exe 87 PID 6024 wrote to memory of 4964 6024 RHzIskjyNuRthm.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Loader.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4908
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5548
-
-
C:\Windows\system32\cmd.execmd.exe /c "PGLzmm.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\HQTta\RHzIskjyNuRthm.exe"RHzIskjyNuRthm.exe" "YfeqexIOizQ.js"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\HQTta\RHzIskjyNuRthm.exeC:\Users\Admin\AppData\Local\HQTta\RHzIskjyNuRthm.exe C:\Users\Admin\AppData\Local\HQTta\WlccHwbSxHFlZPUBXOo.dat4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e584235.rbs
- Size 9KB
- SHA256 7d8608fe43181f5868085e5ac10fce98a48ec549fe2a315a8369e25283674dbd
- MD5 865fafc03feba375978a51ae4be72187
- SHA1 33381855ac592d6d3a903f2677069389c48b0f73
- SHA512 26dc2a3d23afa5979a0f88e973fd2480defd606f298ead349cdcfb5db360c0f0a02f4b9a634fc70c454a4cafb5a654f489c0c226b3bc3071288948246a012941
- SSDEEP 96:yndxiSJUPTc+laCAO41UhBmCsThqxUhBmC6jambKThqkH7Kp4JFQxfb9NWC+pnBs:ynTfCqOb1ILb1VR8F+pC
- TLSH T124122041B2C0D892E49A3731CA1A475C3BB6D3DAD361335B168FD0644E03BECFAAD196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\PGLzmm.cmd
- Size 72B
- SHA256 cc265a02025220800d98717a5f5cae7acedfd8525831f8474ab55251aa3ac00c
- MD5 136a6ff2735d05064061250019f7dae1
- SHA1 af0f68ad34f22179c70b8c1586b4114ee500010e
- SHA512 98405a6fd82007fd7a8ed09f2aab1c99d3f145bfffc2a22bf3d4327c71869e2315b9471faeced675c016b385d612b4d104b91ef96558a536f8d532369888ed0f
- TLSH T1C0A002821822480565DB1C1558BF2DCAFE4BF1CA991C6A44716169684E8F9D4B2CF4E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\WlccHwbSxHFlZPUBXOo.dat
- Size 1.8MB
- SHA256 c821b155d58435c33da3f0ba54b6569b782643d26bcd6a31d389fbfe162f98f6
- MD5 7b1b0a2568d5f23e14afe7b09eed8df1
- SHA1 25cd59cdfb3feeab60f34cb59bbc5799c433c3a5
- SHA512 b5e4fdadc00b0a2425e5109cf0f8afb869a1d32ac387773398be1be78bf1ab9dbda156ca749d8a862126a86638a68e5b9c398ea15a6767b5bba93c62b038afd5
- SSDEEP 49152:2IcX+uRTjrYKN490RvM1L8wfN1E9s/rPRkpwKfze8k:h
- TLSH T1A8959ECDB48F64D4B8E587F46FDA7F6A85AB10D32C91FD0E702092744E1057EAB9E818
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\HQTta\YfeqexIOizQ.js
- Size 1KB
- SHA256 aad6a1ea24566e3df381ddc686f04414f7cf2309f6e4f33d3714d52e46b54fcc
- MD5 6b30d4fb96b41fa09799278e9475b09d
- SHA1 9b77deb6ef2bfaf4010d1a83cec6c43d9034fbd2
- SHA512 3a37ab2bd95aa99959027653a0152aefc5d6d81c224f18a8444bb0d0d236e6e878ce165c1e77701d9292922605c33802505a94bf613b6086e7f65d385768f553
- TLSH T18031EBBC1E00295A237676D7BD355E61CBA7CB0534644640D0AC91C23A8EE604E5FAEA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\o79ri998ce0aeace.node
- Size 354KB
- SHA256 9ef045c2833cfb263fb7d59410eaca0ff36f2fa10599564de7d1a7b0db97ef21
- MD5 84a75a9a35043f632aba2f6a27cf6aab
- SHA1 1922c15cb96217fe515bcea523a2ff8e45a40a18
- SHA512 f3d6df5080be82fb6c7e1ed2ae5ea423ddbc9a61b53b824b28303dbc2002bc3f02e63a981f951d67d3ed48e6313cc9a6236978b66f0ce70cafe696d7c5ac601f
- SSDEEP 6144:nVX6t4JL4+kQhPe71JaYG5VwYNc/fCfppZT+9rE/EOrCFMrzhDuxk:nVXDc+ksPe7rQ3wYXbA9bOmGlDc
- TLSH T10574AE5A72E40CB4E9A7927CC957490AE7F3BC020B60D7CF03A046AA9F677E0953E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e584234.msi
- Size 27.6MB
- SHA256 803da30b682d1f0cc0cdb316f2cfae462ef4b17146421768af60bbff17636339
- MD5 63c610620b039c8f05bc8e3d25aeacf7
- SHA1 455fa561dfb222061b7c85e6356e792d135569b6
- SHA512 626a9079a89850a62c969331a6580e2a8d0cb407f2389aa828df6c39c4e000b48a967d4a6c317147df6ef767e652949ab754bfc7851dfe81a20500f688244e24
- SSDEEP 786432:LgviMIjgNeZBFKdyIvItrYj+bF/BrZDi/2:Lgvij0xgtrPb74/
- TLSH T1C7573356C0721F1BED9B8C3498AA4341CAACBE361F734A1D2114B76764FBBF03176199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 026588f31e1d1fdb71374ae0bb5ca79e4a30f97c10e3ee3f6d671c485cc4d591
- MD5 475b404ffd8d3b3e2712da7f7e048da3
- SHA1 4dbe2bb433b6ea784de7eaa27ba74f21d7860f7d
- SHA512 26e048de50f550b2fc9b9c6a140946d3c9ad9e0c024ba151322888994332181259efe85c04b5748695b9e131ca99acef06c11f799c6ba81c432689c27150481f
- SSDEEP 24576:E2gmSp1CdoO/vvTLo2D+hUX6faZYQYHpWmwtn50za4q4k/HG4IiU7eJ0x:H
- TLSH T14947A32436F92210E7F79E3C6CF06A23493A7D5B9C16DE8D45421F4E0961BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{21a5fa1d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3bd5df1e-f832-4f7b-83ce-5feffeddb707}_OnDiskSnapshotProp
- Size 6KB
- SHA256 84c52e3f350030a4c615543912845c8715fa1af6dfb89a288b5eb09d2f0f76d8
- MD5 2dbf245512167ee0fd5ccef16d246680
- SHA1 33584916ae8fa50d842cc49a9a0cd386f45eb4a9
- SHA512 638bf003013d796650c4937531bc26fb4b5d2a8919b686bef9e0cd46b45e6912201807853d6181bc69448b17980b760b08ec35c5306de665eef86f7c9411428e
- SSDEEP 96:Fbn1L3vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Zrb++ZVmN
- TLSH T1BDD179085AF54711E2B3AB3229F14557A477B911EF33CB8E0198238E6670A10F976F5F
- MD5 SHA1 SHA512 SSDEEP TLSH