56b2811e4cc5a939c2fbc6f97f16562608aa641a8b3006214fe6cd9724409100

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC738.msi
Size 6.4MB
Sample260503-xd7fhsaz3m
SHA256 56b2811e4cc5a939c2fbc6f97f16562608aa641a8b3006214fe6cd9724409100
MD5 910024bfc80ee3e690891619178e2d5c
SHA1 86ecbd037b9ec2eed0365ac480bd6f0e4e7e419c
SHA512 1ee7bcc09aa347b98f57ff51a509b24e7d5f0b81016b9442a7fd76a320d729f4512ecbb24f2cce30f1f5ac5671606ada3ddb4c6426914d89b3fb84ecbf8539cf
SSDEEP 196608:ZEx4kBtzkqeUc0WF8RBS5F6xYmQHRi0Q7zO1wKfLR9I7rwx:ZEqkB44BS5sxiRi521lfLRee
TLSH
T1C9663385F4C05A3EF19ECD750CBAB628041B62135B204ADBF34B0955EE21FE249FE6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3316	Installer.exe
3860	Syncro.Installer.exe

Loads dropped DLL 6 IoCs

pid	Process
1572	MsiExec.exe
4032	rundll32.exe
4032	rundll32.exe
4032	rundll32.exe
4032	rundll32.exe
4032	rundll32.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4296	msiexec.exe
6	4296	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Diagnostics.EventLog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Syncro.Contracts.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\JetBrains.Annotations.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Serilog.Sinks.Console.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\RollbarSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Splat.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Runtime.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\UrlCombineLib.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\RepairTech.Common.Tools.dll	rundll32.exe
File created	C:\Windows\Installer\e584c46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Serilog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Numerics.Vectors.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Interop.NetFwTypeLib.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Flurl.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Flurl.Http.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\CSharpFunctionalExtensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Destructurama.Attributed.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Serilog.Sinks.File.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e584c46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\Serilog.Formatting.Compact.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\System.ValueTuple.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\WiX.CustomActions.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4296	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007d3725990023bfe00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007d3725990000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007d372599000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7d372599000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7d372599000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Syncro.Installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3104	msiexec.exe
3104	msiexec.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4296	msiexec.exe
Token: SeSecurityPrivilege	3104	msiexec.exe
Token: SeCreateTokenPrivilege	4296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4296	msiexec.exe
Token: SeLockMemoryPrivilege	4296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4296	msiexec.exe
Token: SeMachineAccountPrivilege	4296	msiexec.exe
Token: SeTcbPrivilege	4296	msiexec.exe
Token: SeSecurityPrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeLoadDriverPrivilege	4296	msiexec.exe
Token: SeSystemProfilePrivilege	4296	msiexec.exe
Token: SeSystemtimePrivilege	4296	msiexec.exe
Token: SeProfSingleProcessPrivilege	4296	msiexec.exe
Token: SeIncBasePriorityPrivilege	4296	msiexec.exe
Token: SeCreatePagefilePrivilege	4296	msiexec.exe
Token: SeCreatePermanentPrivilege	4296	msiexec.exe
Token: SeBackupPrivilege	4296	msiexec.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeShutdownPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	4296	msiexec.exe
Token: SeAuditPrivilege	4296	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4296	msiexec.exe
Token: SeChangeNotifyPrivilege	4296	msiexec.exe
Token: SeRemoteShutdownPrivilege	4296	msiexec.exe
Token: SeUndockPrivilege	4296	msiexec.exe
Token: SeSyncAgentPrivilege	4296	msiexec.exe
Token: SeEnableDelegationPrivilege	4296	msiexec.exe
Token: SeManageVolumePrivilege	4296	msiexec.exe
Token: SeImpersonatePrivilege	4296	msiexec.exe
Token: SeCreateGlobalPrivilege	4296	msiexec.exe
Token: SeBackupPrivilege	1412	vssvc.exe
Token: SeRestorePrivilege	1412	vssvc.exe
Token: SeAuditPrivilege	1412	vssvc.exe
Token: SeBackupPrivilege	3104	msiexec.exe
Token: SeRestorePrivilege	3104	msiexec.exe
Token: SeRestorePrivilege	3104	msiexec.exe
Token: SeTakeOwnershipPrivilege	3104	msiexec.exe
Token: SeRestorePrivilege	3104	msiexec.exe
Token: SeTakeOwnershipPrivilege	3104	msiexec.exe
Token: SeRestorePrivilege	3104	msiexec.exe
Token: SeTakeOwnershipPrivilege	3104	msiexec.exe
Token: SeDebugPrivilege	3860	Syncro.Installer.exe
Token: SeBackupPrivilege	5456	srtasks.exe
Token: SeRestorePrivilege	5456	srtasks.exe
Token: SeSecurityPrivilege	5456	srtasks.exe
Token: SeTakeOwnershipPrivilege	5456	srtasks.exe
Token: SeBackupPrivilege	5456	srtasks.exe
Token: SeRestorePrivilege	5456	srtasks.exe
Token: SeSecurityPrivilege	5456	srtasks.exe
Token: SeTakeOwnershipPrivilege	5456	srtasks.exe
Token: SeRestorePrivilege	3104	msiexec.exe
Token: SeTakeOwnershipPrivilege	3104	msiexec.exe
Token: SeRestorePrivilege	3104	msiexec.exe
Token: SeTakeOwnershipPrivilege	3104	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4296	msiexec.exe
4296	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 5456	3104	msiexec.exe	91
PID 3104 wrote to memory of 1572	3104	msiexec.exe	93
PID 1572 wrote to memory of 4032	1572	MsiExec.exe	94
PID 3104 wrote to memory of 3316	3104	msiexec.exe	95
PID 3316 wrote to memory of 3860	3316	Installer.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DOC738.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1DA81BCE1F2AEEDB8C3A8DEDD0BAD5C6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4D8F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668187 2 WiX.CustomActions!WiX.CustomActions.CustomActions.ReadConfigJson
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4032
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --msi --key "Owa1iH3zdWi9ju9WsqQNmQ" --customerid "1822037" --policyid "" --folderid "4952457" --config-json "ewogICJBdXRoVXJsIjogImh0dHBzOi8vYWRtaW4uc3luY3JvYXBpLmNvbSIsCiAgIkthYnV0b1VybCI6ICJodHRwczovL3JtbS5zeW5jcm9tc3AuY29tIiwKICAiU3luY3JvVXJscyI6IFsKICAgICJodHRwczovL3tzdWJkb21haW59LnN5bmNyb2FwaS5jb20iLAogICAgImh0dHBzOi8ve3N1YmRvbWFpbn0uc3luY3JvbXNwLmNvbSJdLAogICJMb2dEdW1wZXJVcmwiOiAiaHR0cHM6Ly9sZC5hdXJlbGl1cy5ob3N0IiwKICAiVXBkYXRlVXJsIjogImh0dHBzOi8vcHJvZHVjdGlvbi5rYWJ1dG9zZXJ2aWNlcy5jb20vc3luY3JvL21haW4vdXBkYXRlcy8iLAogICJPdmVybWluZFVwZGF0ZVVybCI6ICJodHRwczovL3Byb2R1Y3Rpb24ua2FidXRvc2VydmljZXMuY29tL3N5bmNyby9vdmVybWluZC91cGRhdGVzLyIsCiAgIkNob2NvbGF0ZXlJbnN0YWxsZXJVcmwiOiAiaHR0cHM6Ly9wcm9kdWN0aW9uLmthYnV0b3NlcnZpY2VzLmNvbS9jaG9jby9rYWJ1dG9fcGF0Y2hfbWFuYWdlciIsCiAgIldlYlNvY2tldFVybCI6ICJ3c3M6Ly9yZWFsdGltZS5rYWJ1dG9zZXJ2aWNlcy5jb20vc29ja2V0IiwKICAiQ2hhdFVybCI6ICJ3c3M6Ly9jaGF0LWNoYXQuc3luY3JvbXNwLmNvbS9zb2NrZXQiLAogICJfIjogIiIKfQo=" --jwt-payload ""
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe" --msi --key "Owa1iH3zdWi9ju9WsqQNmQ" --folderid "4952457" --customerid "1822037" --config-json "ewogICJBdXRoVXJsIjogImh0dHBzOi8vYWRtaW4uc3luY3JvYXBpLmNvbSIsCiAgIkthYnV0b1VybCI6ICJodHRwczovL3JtbS5zeW5jcm9tc3AuY29tIiwKICAiU3luY3JvVXJscyI6IFsKICAgICJodHRwczovL3tzdWJkb21haW59LnN5bmNyb2FwaS5jb20iLAogICAgImh0dHBzOi8ve3N1YmRvbWFpbn0uc3luY3JvbXNwLmNvbSJdLAogICJMb2dEdW1wZXJVcmwiOiAiaHR0cHM6Ly9sZC5hdXJlbGl1cy5ob3N0IiwKICAiVXBkYXRlVXJsIjogImh0dHBzOi8vcHJvZHVjdGlvbi5rYWJ1dG9zZXJ2aWNlcy5jb20vc3luY3JvL21haW4vdXBkYXRlcy8iLAogICJPdmVybWluZFVwZGF0ZVVybCI6ICJodHRwczovL3Byb2R1Y3Rpb24ua2FidXRvc2VydmljZXMuY29tL3N5bmNyby9vdmVybWluZC91cGRhdGVzLyIsCiAgIkNob2NvbGF0ZXlJbnN0YWxsZXJVcmwiOiAiaHR0cHM6Ly9wcm9kdWN0aW9uLmthYnV0b3NlcnZpY2VzLmNvbS9jaG9jby9rYWJ1dG9fcGF0Y2hfbWFuYWdlciIsCiAgIldlYlNvY2tldFVybCI6ICJ3c3M6Ly9yZWFsdGltZS5rYWJ1dG9zZXJ2aWNlcy5jb20vc29ja2V0IiwKICAiQ2hhdFVybCI6ICJ3c3M6Ly9jaGF0LWNoYXQuc3luY3JvbXNwLmNvbS9zb2NrZXQiLAogICJfIjogIiIKfQo="
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:3860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasterInstaller20260503.log

Path C:\ProgramData\Syncro\logs\MasterInstaller20260503.log
Size 1KB
SHA256 a5b76cca009237680017c449d96f9df46870d23841f396f6d21800cf42c9f8df
MD5 30b5c924f2c173e6cc587bee09c88a53
SHA1 1165eb520fca6c01ac52cd53ba5a66d5ad11a18d
SHA512 f015b76c42110f3d99b3458f830abd4a9cb01a58ce27b4877c78231eced9bf77df1acfc480b0801e0bc049a79663f6835d832f3bee36dbc7a63df59c0395cf2c
TLSH
T16931E960036F827B59165A1BB9336F7968A67141F2483FF03BE92B4D1AEBC375B04342
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 9355b858d3f1d6a3a03bf5d68cc80787904bb02b12b07e0e12dbd99f0bcb1290
MD5 918d27c5d293aeaef98b5423988bb13c
SHA1 cf8d8936c601648b425592009ac00f34f7fc5a45
SHA512 69da3ad42e65a90b99175c33ff6a9c038cc1cfbc93b0351ee5fe82a543965dedf76ad35e7283c831b0d9b48bbbd95f6bb53e1128eaca222e44c84cf2ce28846d
TLSH
T1ECF0D4EA59DDBC723857995C27FABAE160E8144920C64037783C24C4575A3F4924BC05
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_73594D3C4D57A2BC7615FC61F5F5BA2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_73594D3C4D57A2BC7615FC61F5F5BA2D
Size 727B
SHA256 fe8dd82cb5d28e5c938c32934452a8122aadcd5ec48c10f4043ec85556f78fb1
MD5 090d80dc66297bab4ba010ee1ab5fcf7
SHA1 af72cae892c56533dbd07374392d4c86e5f82b2a
SHA512 2cdbb4dfa9f585be473e0dcf86298abdd5fb6c59a71b457c590f7965e5613c5e8de657fe30737c195e01046d0c7a6d04ddee489245e18a6e7716c1c90bd6d00b
TLSH
T1410115473EE5B3D42B075D6865E696E039F5045B074F6D431417B04DE29C704B5CBA0C
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 ae479d4ecdc5eab901290785ee6e30fbcefb56fb3a8d8aa22e0e7c8e321d349e
MD5 d425d8e180ea9023a5e5f6cbb63b54c3
SHA1 f87badda86a7ed275e1413b2da74c5848f5e2781
SHA512 538a5753d27ff19d0aed42ad59e9f9da083e657db31ea6a050025a417d2b892ab744a8251628a8840fde9c56053e2a4fd6772845c43c43d4413d805f83fc8916
TLSH
T17301650255ACD75075008D22DBDCBEF4F16BE2E8398C0A90295C78EE0ABD315C1D6C50
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 44dd43c7ec34591601ab678fb7e5073a6a39a201d9247995bbe835133194689a
MD5 6cce0cc4d948670d34a1673ee3a35801
SHA1 ae90d973c6b13999440299583f5b02fa562ad086
SHA512 b4fddce93e5a3b199a698d2ebe4b8f4b363b0647b0dde70376c7154b20d5569faa30cb1c9ae91f9ddeb36bf2cd6e70a1c52cd9174c2398a5f5a92242f5946d5f
TLSH
T17CE0202037FA502FF1A0977842D6D1D5EF26F1122C7492BE0981556DAD069405CB2D31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_73594D3C4D57A2BC7615FC61F5F5BA2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_73594D3C4D57A2BC7615FC61F5F5BA2D
Size 404B
SHA256 50f0894dc13eed0c139f4f649d77022d19709e6407b1bc314cbc6ef89c93ac4b
MD5 2aaf8d442ac8c745d576c1f334fdbc4b
SHA1 26e1cdea735f8dd7a235b3e3c53ffd2a3dd2a78e
SHA512 0d34218a9b0e808bf9e2a5b0d9448e605fdb0b07c77bc828df30082634e01922c0d99e1c43ed6b1dbb2f35624b1a176078727d150105ef384e5a962ccd99f606
TLSH
T1E1E0C63022F5014EF1F0E03882FAAD2158AEF242241483A810A09B02EA12B808CE7238
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 72045d583b3dde40e444a97a98b94a09c870bd356ca8bcdd27b5b9e233b3a8ce
MD5 ec73c5086268c1bed6a557ab9a644ef0
SHA1 dc56916018406f9424ddbd91a99b0cf70200577a
SHA512 59735803d9cb18bc2c01b6115f0fde60363900de997c5bf6f4782e98e55fdd6deacab958d4aeb5a51c84ec8a4c77288be32bcc00713d8abfc534fdb411f10884
TLSH
T181E06F2C2AABB41EF290AC3882FAE5BA0D89E301249096B821918308BB03F405C10AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Installer.exe
Size 5.6MB
SHA256 e896a9d376bf451092291934cbe06b1cdddb2bc2ecf7f6b6e9af2c6d0d32a816
MD5 60e5973e0b2852add918916244a2a794
SHA1 246e20a65d7711f07e4a7c6624d35e4ebe81a33a
SHA512 dc469f5944e89e2c64a1739eaed19b7ccaa8d1fce7369141fe62c90c303384f779d2d53dd4864dfc79eb674c54f63e35625021dbd03907fd72b3475bc2b63123
SSDEEP 98304:Ah/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:Ah/ev5eTeW90kSIbDoUcfOhzT9cEt720
TLSH
T140461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Syncro.Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe
Size 5.5MB
SHA256 917106183d5a087832a8e68b68b6ebd126d3c6f857a4c89007010687fe87615a
MD5 549fe6d28b14f4b51b80b2f679fbbf0f
SHA1 16dfca5e70eaa515d5af8661646eb8a5edaa85b4
SHA512 aa1c74977c1b99322eb3adeb2457a990f8622489d4079b3b0a093a298e2e7498a0fbee9507ed6c00b5b082b63ee2dc6f097081a570b253def3b0be0fa2cca606
SSDEEP 98304:l/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIAC:l/ev5eTeW90kSIbDoUcfOhzT9cEt722t
TLSH
T1BD462204F7A5061DF076FAF62D11B11146A3BE479815C689D3B33488EA76E43CE6C2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4D8F.tmp

Path C:\Windows\Installer\MSI4D8F.tmp
Size 1.1MB
SHA256 ef93de320f24988e025032636a2ecf4b9371311f0b0347b095d334cd340b30fb
MD5 3498de01afbcb1cc1e1be11a4a36c1fd
SHA1 249debb938a44589db64eaf33729e5a26e11b90c
SHA512 75d6735a0ff1de0735f2a8cda05bf68a78e3da5c16c2e5cd4636a7e731af7d94e6c00a928a7869f0630842a5f0d8c6c17831a6347f0525d2908c71f74d33f2cd
SSDEEP 24576:3QXdYbCuddtt8k3ODIdjmHB2TlwewtEOXUMIVl9b:3QX+uuddf3OMdSH82Z+OXbIVl9b
TLSH
T19335125065D09176F0BF2C3810358AA41ABEB6305B709ACF6B590E7E9E303D28A75F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiX.CustomActions.dll

Path C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\WiX.CustomActions.dll
Size 11KB
SHA256 dafa3e86a979b284d23710d0174f391a0f008a5a3efb9992183167e47793adac
MD5 7a95512e04fd3b6c52275af6c0fd7bd7
SHA1 8e0765107ebec4f6ef308fb4ceb88d47b12766d1
SHA512 8788735aa79453f2fd8b3372c4af681f04586770694aabf75b0b89638ae19bacfc05a4757aeaf16a5432af19f0c8b2bf345c983e70e5da04a230c6b274abd6ba
SSDEEP 192:EWxZ1cBxk9BAKm7KgVzMpfiaLDIIQ/q+SIkOcvy:E+Ok9BAKTxQ/qs
TLSH
T177329540A3F84139E9F75F38FDBB06944A72BE425932CB5F1A49545E1C72244D9E3732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCAFD5DA3E23F47206A169ACC1D3F46176D\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 5d74d3c396e7ffaf41a99e9d4c2a27a188edd1f5eecee399823592bff3faf89b
MD5 4fe7a430855731acfa9bee6fae19f040
SHA1 64ec7c229a4b1ec43db1a8d83a52b1c999d60a6f
SHA512 e71299f8f761adb35b3c4383d912bd393006933538a0c3cb698ac085a8fa8c5f648fc932ddecd4ceefe02e29e02b3d98fde4160bbdf3af23f6828d2806a03e8e
SSDEEP 24576:4u8m+1zGdoO/vvTLr2deomap8UkzFltiBrm9vSsll068u6kA4PFUF7WhY:p
TLSH
T12D47D82836F92110E7F79E3C78F05A13893A7D579C16DE8D05811B8E0961BB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{36b4990f-5178-47c2-9150-c4b91990369c}_OnDiskSnapshotProp

Path \??\Volume{9925377d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{36b4990f-5178-47c2-9150-c4b91990369c}_OnDiskSnapshotProp
Size 6KB
SHA256 5fd1ac994aef6d5ac392222ed64692e909c3d2f80ed4d483b8e198320459f553
MD5 f00a99296a7363a9e2f3548c9f4c1c8f
SHA1 ddc48432cc849c4d7701fa8a3fe0964289091793
SHA512 d4ad625c93906cb841f96a361761ee932d40be1eaf00e44bdb5fdbf59d64648fe6fe13d674efbe56a1764ce24fad744954614e5d76e70caeb957e92072386ad7
SSDEEP 96:Fl0yuKAvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:bpab++ZVm
TLSH
T185D189085AF54711E2B3AB7128F14557A877B811EF33CB8E0198238E6671A10F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-17-0x0000024809E50000-0x0000024809F7A000-memory.dmp

Download

memory/1412-127-0x0000024809E50000-0x0000024809F7A000-memory.dmp

Download

memory/3104-125-0x000002CECEB90000-0x000002CECEC3C000-memory.dmp

Download

memory/3104-164-0x000002CECEB90000-0x000002CECEC3C000-memory.dmp

Download

memory/3104-13-0x000002CECEB90000-0x000002CECEC3C000-memory.dmp

Download

memory/3104-126-0x000002CECFAE0000-0x000002CECFAEC000-memory.dmp

Download

memory/3316-149-0x000000001B210000-0x000000001B33A000-memory.dmp

Download

memory/3316-131-0x000000001B210000-0x000000001B33A000-memory.dmp

Download

memory/3316-78-0x00000000000C0000-0x0000000000658000-memory.dmp

Download

memory/3860-112-0x0000023A69840000-0x0000023A6984E000-memory.dmp

Download

memory/3860-109-0x0000023A69860000-0x0000023A69882000-memory.dmp

Download

memory/3860-110-0x0000023A50E80000-0x0000023A50E8A000-memory.dmp

Download

memory/3860-146-0x0000023A4F5C0000-0x0000023A4F5CC000-memory.dmp

Download

memory/3860-115-0x0000023A698C0000-0x0000023A698C8000-memory.dmp

Download

memory/3860-116-0x0000023A698D0000-0x0000023A698F0000-memory.dmp

Download

memory/3860-117-0x0000023A69930000-0x0000023A699E2000-memory.dmp

Download

memory/3860-114-0x0000023A698A0000-0x0000023A698B0000-memory.dmp

Download

memory/3860-113-0x0000023A69880000-0x0000023A69888000-memory.dmp

Download

memory/3860-111-0x0000023A69850000-0x0000023A6985A000-memory.dmp

Download

memory/3860-118-0x0000023A698B0000-0x0000023A698C4000-memory.dmp

Download

memory/3860-119-0x0000023A69A10000-0x0000023A69A32000-memory.dmp

Download

memory/3860-120-0x0000023A69B40000-0x0000023A69B9C000-memory.dmp

Download

memory/3860-122-0x0000023A69900000-0x0000023A69908000-memory.dmp

Download

memory/3860-121-0x0000023A69910000-0x0000023A69918000-memory.dmp

Download

memory/3860-108-0x0000023A697B0000-0x0000023A69842000-memory.dmp

Download

memory/3860-105-0x0000023A50D80000-0x0000023A50DA6000-memory.dmp

Download

memory/3860-107-0x0000023A50DB0000-0x0000023A50DD4000-memory.dmp

Download

memory/3860-106-0x0000023A50E50000-0x0000023A50E78000-memory.dmp

Download

memory/3860-104-0x0000023A4ECB0000-0x0000023A4F22A000-memory.dmp

Download

memory/3860-145-0x0000023A69680000-0x0000023A697AA000-memory.dmp

Download

memory/3860-133-0x0000023A4F5C0000-0x0000023A4F5CC000-memory.dmp

Download

memory/3860-132-0x0000023A69680000-0x0000023A697AA000-memory.dmp

Download

memory/4032-68-0x0000000003050000-0x000000000305A000-memory.dmp

Download

memory/4032-64-0x0000000005400000-0x0000000005434000-memory.dmp

Download

memory/4296-11-0x000001E6C7C30000-0x000001E6C7CDC000-memory.dmp

Download

memory/4296-162-0x000001E6C7C30000-0x000001E6C7CDC000-memory.dmp

Download

memory/4296-163-0x000001E6CD500000-0x000001E6CD50C000-memory.dmp

Download

memory/4296-12-0x000001E6CD500000-0x000001E6CD50C000-memory.dmp

Download

memory/5456-134-0x000001B121FD0000-0x000001B1220FA000-memory.dmp

Download

memory/5456-130-0x000001B121FD0000-0x000001B1220FA000-memory.dmp

Download