Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ESysLauncherPremiumSetup_2.8.0_Build_143.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
ESysLauncherPremiumSetup_2.8.0_Build_143.msi
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target ESysLauncherPremiumSetup_2.8.0_Build_143.msi
- Size 12.3MB
- Sample260506-b3vmcsdt2n
- SHA256 881480752da7ceba309f95a75ce89dc34fac906702ecbe843213213017ec5ad0
- MD5 1c0915634e2b5d27e8ee2ef37fb123e7
- SHA1 7f3b6d4472b7fdbebc32f682675713d90cee26e2
- SHA512 06b80429a3691a069cb5154855018a5e865e19b54b0063f0f9b93a8bd76f10c3edfd59d6caf4a1a18f5ba284d5668909fef8b43f62b0dda7ed239148fd0f3caa
- SSDEEP 393216:BmWi9HoAghPxi31DVdoB0asEEDp6Q0VYBppkv:YWgoAQPCjd4saVVY
- TLSH T19AD63302B1D94E36F2AF05702575973A8774BC118E72C41B336C2A4C2FB279167F6B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
pid Process 2440 MsiExec.exe 2440 MsiExec.exe 2440 MsiExec.exe 2440 MsiExec.exe 2440 MsiExec.exe 2440 MsiExec.exe 4140 MsiExec.exe 4140 MsiExec.exe 2440 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 28 IoCs
description ioc Process File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\BouncyCastle.Crypto.sig msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ICSharpCode.SharpZipLib.sig msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ESysLauncher.exe msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\E-Sys Launcher.pdf msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\PSdZdata.dat msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\otakar.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\BouncyCastle.Crypto.dll msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\Content.sig msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\CryptoLib.sig msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ICSharpCode.SharpZipLib.dll msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\aknight720.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\Botho.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\dmnc02.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\ruben_17non.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\TMD29.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\ekfxisid.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\packetpilot.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ESysLauncher.exe.config msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\Un.lck msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\Changelog.txt msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\aboulfad.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\FDLCodes.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\SergAA.xml msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\Dat1.bin msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\CryptoLib.dll msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ESysLauncher.sig msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ReadMe.txt msiexec.exe File created C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\FDLCodes\Almaretto.xml msiexec.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\Installer\e5891ea.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9248.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File created C:\Windows\Installer\e5891ec.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE429CFE78A8BEAF7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF34FA8908DE033D2C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF218CCF4E3349CFFF.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9363.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI92B7.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File opened for modification C:\Windows\Installer\e5891ea.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF7AB4F32E4FDD7DD1.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{80B0B27D-3336-44F3-8F88-7405C58F59E1} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\D72B0B0863333F44F88847505CF8951E\2.8.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8 msiexec.exe File created C:\Windows\Installer\{80B0B27D-3336-44F3-8F88-7405C58F59E1}\ESys2.exe msiexec.exe File opened for modification C:\Windows\Installer\{80B0B27D-3336-44F3-8F88-7405C58F59E1}\ESys2.exe msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4896 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\PackageName = "ESysLauncherPremiumSetup_2.8.0_Build_143.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D72B0B0863333F44F88847505CF8951E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\PackageCode = "133A3ABE4EA6EC14F8BAC0FC7920E90F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\168B56E23E07FA8408C7AC3BB78AEAB5\D72B0B0863333F44F88847505CF8951E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\ProductName = "E-Sys Launcher Premium" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\Version = "34078720" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\Media\2 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\ProductIcon = "C:\\Windows\\Installer\\{80B0B27D-3336-44F3-8F88-7405C58F59E1}\\ESys2.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\168B56E23E07FA8408C7AC3BB78AEAB5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D72B0B0863333F44F88847505CF8951E\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D72B0B0863333F44F88847505CF8951E\InstanceType = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5384 msiexec.exe 5384 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4896 msiexec.exe Token: SeIncreaseQuotaPrivilege 4896 msiexec.exe Token: SeSecurityPrivilege 5384 msiexec.exe Token: SeCreateTokenPrivilege 4896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4896 msiexec.exe Token: SeLockMemoryPrivilege 4896 msiexec.exe Token: SeIncreaseQuotaPrivilege 4896 msiexec.exe Token: SeMachineAccountPrivilege 4896 msiexec.exe Token: SeTcbPrivilege 4896 msiexec.exe Token: SeSecurityPrivilege 4896 msiexec.exe Token: SeTakeOwnershipPrivilege 4896 msiexec.exe Token: SeLoadDriverPrivilege 4896 msiexec.exe Token: SeSystemProfilePrivilege 4896 msiexec.exe Token: SeSystemtimePrivilege 4896 msiexec.exe Token: SeProfSingleProcessPrivilege 4896 msiexec.exe Token: SeIncBasePriorityPrivilege 4896 msiexec.exe Token: SeCreatePagefilePrivilege 4896 msiexec.exe Token: SeCreatePermanentPrivilege 4896 msiexec.exe Token: SeBackupPrivilege 4896 msiexec.exe Token: SeRestorePrivilege 4896 msiexec.exe Token: SeShutdownPrivilege 4896 msiexec.exe Token: SeDebugPrivilege 4896 msiexec.exe Token: SeAuditPrivilege 4896 msiexec.exe Token: SeSystemEnvironmentPrivilege 4896 msiexec.exe Token: SeChangeNotifyPrivilege 4896 msiexec.exe Token: SeRemoteShutdownPrivilege 4896 msiexec.exe Token: SeUndockPrivilege 4896 msiexec.exe Token: SeSyncAgentPrivilege 4896 msiexec.exe Token: SeEnableDelegationPrivilege 4896 msiexec.exe Token: SeManageVolumePrivilege 4896 msiexec.exe Token: SeImpersonatePrivilege 4896 msiexec.exe Token: SeCreateGlobalPrivilege 4896 msiexec.exe Token: SeCreateTokenPrivilege 4896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4896 msiexec.exe Token: SeLockMemoryPrivilege 4896 msiexec.exe Token: SeIncreaseQuotaPrivilege 4896 msiexec.exe Token: SeMachineAccountPrivilege 4896 msiexec.exe Token: SeTcbPrivilege 4896 msiexec.exe Token: SeSecurityPrivilege 4896 msiexec.exe Token: SeTakeOwnershipPrivilege 4896 msiexec.exe Token: SeLoadDriverPrivilege 4896 msiexec.exe Token: SeSystemProfilePrivilege 4896 msiexec.exe Token: SeSystemtimePrivilege 4896 msiexec.exe Token: SeProfSingleProcessPrivilege 4896 msiexec.exe Token: SeIncBasePriorityPrivilege 4896 msiexec.exe Token: SeCreatePagefilePrivilege 4896 msiexec.exe Token: SeCreatePermanentPrivilege 4896 msiexec.exe Token: SeBackupPrivilege 4896 msiexec.exe Token: SeRestorePrivilege 4896 msiexec.exe Token: SeShutdownPrivilege 4896 msiexec.exe Token: SeDebugPrivilege 4896 msiexec.exe Token: SeAuditPrivilege 4896 msiexec.exe Token: SeSystemEnvironmentPrivilege 4896 msiexec.exe Token: SeChangeNotifyPrivilege 4896 msiexec.exe Token: SeRemoteShutdownPrivilege 4896 msiexec.exe Token: SeUndockPrivilege 4896 msiexec.exe Token: SeSyncAgentPrivilege 4896 msiexec.exe Token: SeEnableDelegationPrivilege 4896 msiexec.exe Token: SeManageVolumePrivilege 4896 msiexec.exe Token: SeImpersonatePrivilege 4896 msiexec.exe Token: SeCreateGlobalPrivilege 4896 msiexec.exe Token: SeCreateTokenPrivilege 4896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4896 msiexec.exe Token: SeLockMemoryPrivilege 4896 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4896 msiexec.exe 4896 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5384 wrote to memory of 2440 5384 msiexec.exe 80 PID 5384 wrote to memory of 5900 5384 msiexec.exe 84 PID 5384 wrote to memory of 4140 5384 msiexec.exe 86 PID 2440 wrote to memory of 1632 2440 MsiExec.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ESysLauncherPremiumSetup_2.8.0_Build_143.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4896
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DAA93BF1EA390E0BEA3E4D12D9911E32 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ReadMe.txt3⤵
- System Location Discovery: System Language Discovery
PID:1632
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5900
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D0659D903778F43B513D2BBB852345AF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4140
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5891eb.rbs
- Size 15KB
- SHA256 28ab901ef674a9a48f6dcc6b917d4762ff5aa34ac29962ad3eaa22908c650ba4
- MD5 1d2bb5d2574ec47e410ab9e3dcef5197
- SHA1 999f509fca47f85bb96bc38c7c6cf91a26d96564
- SHA512 c6851928395f92d0dd2e07633f6ed041ddeab3aa527ccc5920537566a98f6fa78c08d139f3c9d5b404f039ceabee711f4459fbc75f9573f7ec35c830cfc10d28
- SSDEEP 192:2ry/8vvDiCeM7DLAIqDLARgfMY5QpU4/4:2rAk2uLWLW2H
- TLSH T1547241011E41C6C3E8A62770D78B67107323CBD4B3186B274ADD82724E977993FDAAE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ESysLauncher.exe
- Size 4.5MB
- SHA256 0c1c17a74e54010467915c40140a5155c02491e2f2cdaec5ca0676c7ff13a0df
- MD5 1a483607df9d719dedeb1a66e1bdd774
- SHA1 e5abcc0772991dd835366e039ea5430f6647499a
- SHA512 097a89a9f23a44fbbc8c62e4118988d035ee5234771c799a0cc9ad23b79ffda509b6b5365372c511e1d1f99f47f09b7479d8a5d080e94af232882f96b8850711
- SSDEEP 98304:ZyaY5J7dl9qrj+QtdytCL4IpifXGXjAUGbK87RBA0H9r/TWro1dNG6rhHB:kaYpl9qrlz0C4IMoAB33H9r/TWro1dN/
- TLSH T1C1260153784B6261D59E5FBE93563028B46C407285B3C9CA10633E8B78EC2E19F56CEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TokenMaster\E-Sys Launcher Premium\ReadMe.txt
- Size 2KB
- SHA256 37e3288fb87d56ae50935fb7e8317b715c81771267ee22727839b669c72be230
- MD5 e5cdb691f6f702afa270d7d2ec788758
- SHA1 841eab8d0a0936f2c8398cce814f3df89631c820
- SHA512 ec24e50fbdcf470301c0ecbd5a80c17234ab06b2da8bcb914a5625a2dcc06060186fc0cc8ffc3f7e0e32632f8492452105a2acc6c2c1f2d54955140bb71128c7
- TLSH T1CB51852E96CBB2650FA31A45760E9651C701574C77BB93417CB8C90C33EB6CE62A78F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA5B.tmp
- Size 216KB
- SHA256 5ecd3ff2fb862db239babc08ffab2e380cb7663f5bb4643ce5613691c5206808
- MD5 8a9c3b572d894ed3e8aad61848fc390f
- SHA1 07b782f5092f065ecedd25ce3f2e5effe3db8141
- SHA512 a867c1a2417667f5ae086b25fbae1e532f7d0a41c3152f5cdecf63174599e902c74e25be85228a4d563cfea75b409da9302d2176060adee5d124ee8f89142daa
- SSDEEP 3072:5jqWWzOhoEbuZBYuHu1zzXuqWH28PjYdiNUW1/a4j/Q5U9uO/MgsQtTZVd/jbCLl:ohSozBDu1zSqWH1jVn9nQ/EPs
- TLSH T122246C0175D4883AF3BF1A302EB796105A7EF8610E71C85FA35C5D4E5EB0681AA39B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC53.tmp
- Size 375KB
- SHA256 25b3d017d4dcce1268193fd0127cd784dec9ef4d9ce7920fce6234fabc7df215
- MD5 63ff2a7c757db2a75db0f3d992c40754
- SHA1 66602a2318176c216b9b589f2194c9cc21f8567a
- SHA512 c33b213fd5e0fdf77c2720c9ba5dcfd9b859a253bad510060122285a2fd774ccea987fccaf3c53cf2636a5cc1077232129ff452df648998238064891baf87e79
- SSDEEP 6144:+alZPCicynleBCroV+qZz6pPQwTngbotofAO8iWhdR3t5te+sx:+alZPCiPnjro4qZzIQj8KebRBe+sx
- TLSH T1A4849C00B5F985B6F0BF19B47A70D6B9E5A9B4A19DB3C42B53A1021E0E337819D12F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5891ec.msi
- Size 12.3MB
- SHA256 881480752da7ceba309f95a75ce89dc34fac906702ecbe843213213017ec5ad0
- MD5 1c0915634e2b5d27e8ee2ef37fb123e7
- SHA1 7f3b6d4472b7fdbebc32f682675713d90cee26e2
- SHA512 06b80429a3691a069cb5154855018a5e865e19b54b0063f0f9b93a8bd76f10c3edfd59d6caf4a1a18f5ba284d5668909fef8b43f62b0dda7ed239148fd0f3caa
- SSDEEP 393216:BmWi9HoAghPxi31DVdoB0asEEDp6Q0VYBppkv:YWgoAQPCjd4saVVY
- TLSH T19AD63302B1D94E36F2AF05702575973A8774BC118E72C41B336C2A4C2FB279167F6B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 e77f30d65f8bc5c8d2922b9fbe104a7c7addafe46e2ca21170f4d05031dc1325
- MD5 83ef0d5c5232051ef1c41a1cd915b246
- SHA1 2802079d2a1459fd3aa62bc649cdb32b485837c7
- SHA512 2a509fcdb342c6fc1f1df884c48360e780bdee7f73d2ab7ddbcf24f67399c61a0b46c36c37e84ffa1e5e72f2b5e4c4c6d96eabed63d123555decb2e32f41136b
- SSDEEP 24576:f2gmSp1ldoO/vvTLvmEuB0Hq/6pPwYgOWWXd3JEUN/6IkIQRoPFjr5eDB:P
- TLSH T10947D12436F92210E7B39E3C6CF06A234D3A7D5B9C15DE8D05461B8E0961FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{f5ca1e61-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{19031db6-b39f-4a77-b87d-2c1d95969bfe}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4927b1e953221f8ac992a37322df14639b4526f0f56c63d9c7223c3aa7c9f924
- MD5 a03d49b2e21833d53236e2b2e85bae17
- SHA1 a10135425373123bd2efe96938189f3434ad29b6
- SHA512 3216328d99ec731a6a5703ca360af59eaadf39181ef3e6f0e8097fbbfb8cc26c6fe8cb845fa1921d9b129f2ac8554be24e73e7f86a42127fd5428f5dacbeb342
- SSDEEP 96:FEumj9vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Kuab++ZVm
- TLSH T1BAD19A085AF54311E2B3AB3129F18557A877B911EF33CB8E0298638E6670914F835F6F
- MD5 SHA1 SHA512 SSDEEP TLSH