Overview
overview
8Static
static
5AVEVA PROI...64.dll
windows10-2004-x64
5AVEVA PROI...64.dll
windows11-21h2-x64
5AVEVA PROI...on.dll
windows10-2004-x64
1AVEVA PROI...on.dll
windows11-21h2-x64
1AVEVA PROI...22.msi
windows10-2004-x64
8AVEVA PROI...22.msi
windows11-21h2-x64
8AVEVA PROI...ed.pdf
windows10-2004-x64
3AVEVA PROI...ed.pdf
windows11-21h2-x64
3AVEVA PROI...NU.exe
windows10-2004-x64
4AVEVA PROI...NU.exe
windows11-21h2-x64
4AVEVA PROI...64.exe
windows10-2004-x64
4AVEVA PROI...64.exe
windows11-21h2-x64
4AVEVA PROI...86.exe
windows10-2004-x64
4AVEVA PROI...86.exe
windows11-21h2-x64
4AVEVA PROI...86.exe
windows10-2004-x64
AVEVA PROI...86.exe
windows11-21h2-x64
AVEVA PROI...64.exe
windows10-2004-x64
7AVEVA PROI...64.exe
windows11-21h2-x64
7AVEVA PROI...86.exe
windows10-2004-x64
7AVEVA PROI...86.exe
windows11-21h2-x64
7AVEVA PROI...64.exe
windows10-2004-x64
4AVEVA PROI...64.exe
windows11-21h2-x64
4AVEVA PROI...86.exe
windows10-2004-x64
4AVEVA PROI...86.exe
windows11-21h2-x64
4AVEVA PROI...es.pdf
windows10-2004-x64
3AVEVA PROI...es.pdf
windows11-21h2-x64
3AVEVA PROI...up.exe
windows10-2004-x64
5AVEVA PROI...up.exe
windows11-21h2-x64
4AVEVA PROI...de.pdf
windows10-2004-x64
3AVEVA PROI...de.pdf
windows11-21h2-x64
3AVEVA PROI...EN.msi
windows10-2004-x64
6AVEVA PROI...EN.msi
windows11-21h2-x64
6Analysis
- max time kernel
149s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 01:35
Behavioral task
behavioral1
Sample
AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
AVEVA PROII Simulation 2022 x64/Crack/version.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AVEVA PROII Simulation 2022 x64/Crack/version.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral6
Sample
AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi
Resource
win11-20260130-en
windows11-21h2-x64
25 signatures
150 seconds
Behavioral task
behavioral7
Sample
AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral10
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe
Resource
win11-20250619-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral16
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral21
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
AVEVA PROII Simulation 2022 x64/Setup/Setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
AVEVA PROII Simulation 2022 x64/Setup/Setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral29
Sample
AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral30
Sample
AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
- Size 984KB
- Sample260506-bzsnlag16w
- SHA256 790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90
- MD5 87372f7b0014340126726043765b3b2e
- SHA1 d310c4c831f00ac99ae3743dfe8281016ffc7ab9
- SHA512 bfe4fc0f53a0544825028aa4e24da8c99f56924776ec3cd7f54b45a29c844bd17edc812f52af2d59a9db81773a1f39fed65f193527d1f9275a6e37d1bcb0cdd4
- SSDEEP 6144:1zPOBWsREaeSaRJ4JRpz/I/WP3M8XF9iyW1y48BxiKnWQ3:1zPOBbRmSxJb7I/Wk8Xle7Q
- TLSH T10B2519447AC601B8C65502774E3923B7E6979E1287D2A99A435C330CCEBFCF4A745ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 5292 msiexec.exe 6 5292 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\CAPE-OPEN\Reference Assemblies\CAPE-OPENv1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Common Files\CAPE-OPEN\Type Libraries\CAPE-OPENv1-1-0.tlb msiexec.exe File created C:\Program Files (x86)\Common Files\CAPE-OPEN\Licence\CAPE-OPEN License.pdf msiexec.exe File created C:\Program Files (x86)\Common Files\CAPE-OPEN\Reference Assemblies\CAPE-OPENv1-0-0.dll msiexec.exe File created C:\Program Files (x86)\Common Files\CAPE-OPEN\Type Libraries\CAPE-OPENv1-0-0.tlb msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\assembly\tmp\LR82JY2E\CAPE-OPENv1-0-0.dll msiexec.exe File opened for modification C:\Windows\Installer\{D03DC879-E534-4B0D-BA60-0F55B032F6B8}\colan.ico msiexec.exe File created C:\Windows\Installer\e5930f9.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3232.tmp msiexec.exe File created C:\Windows\assembly\tmp\PVQRL694\CAPE-OPENv1-1-0.dll msiexec.exe File created C:\Windows\Installer\e5930fb.msi msiexec.exe File created C:\Windows\Installer\{D03DC879-E534-4B0D-BA60-0F55B032F6B8}\colan.ico msiexec.exe File opened for modification C:\Windows\Installer\e5930f9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{D03DC879-E534-4B0D-BA60-0F55B032F6B8} msiexec.exe File created C:\Windows\assembly\GACLock.dat msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002b6acb6f52f0180a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002b6acb6f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809002b6acb6f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a2b6acb6f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2b6acb6f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{052DAFEF-0F43-4F4D-88AB-50F6AD8FC0EB} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09CD-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0A9B-0100-11D2-A67D-00105A42887F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B72-0100-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0A9C-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B13-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B21-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B6D-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{638D84DC-84E9-4AEA-83A4-0BB8852832E9}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C099C-0093-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C09AF-7D66-11D2-A67D-00105A42887F}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09B3-7D66-11D2-A67D-00105A42887F}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B07-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B10-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B1C-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B27-7D66-11D2-A67D-00105A42887F}\ = "ECapePersistenceSystemError" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{CF51E385-0110-4ed8-ACB7-B50CFDE6908E}\409 = "CAPE-OPEN Physical Property Calculators" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B1E-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B71-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B72-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B82-0100-11D2-A67D-00105A42887F}\ = "ICapeNumericBasicEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B8C-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3E9CF96-DF8F-40F3-9543-E8D17CABBF96}\TypeLib\Version = "1.1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}\1.0\0\win32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25BC241A-8110-4806-AF7A-CB6CFA7B9A57}\TypeLib\Version = "1.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C099D-0093-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AA0-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0AFA-0100-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B19-7D66-11D2-A67D-00105A42887F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B1F-7D66-11D2-A67D-00105A42887F}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B7A-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B8A-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C099A-0093-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AF9-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B24-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B84-0100-11D2-A67D-00105A42887F}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B86-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B8D-0100-11D2-A67D-00105A42887F}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9304E044-3311-41ED-8766-0123CB44038A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C099C-0093-11D2-A67D-00105A42887F}\ = "ICapeParameterSpec" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C099D-0093-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AFC-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B17-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{78DEFBBD-ED69-4F81-90A4-6B636CE13164}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F840ECA2-941B-4AF7-84DB-47E2187430A2}\ProxyStubClsid msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\CAPE-OPENv1-0-0,version="1.0.0.0",culture="neutral",publicKeyToken="10A1040E6624C81D",processorArchitecture="MSIL" = 79004f00770077006b0045007e0049002d004000520052006800440043006600640079004d0064003e007a00320047007e0029007a007000400058003900380052004b004b00510051004300630057003f0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\978CD30D435ED0B4AB06F0550B236F8B\Version = "33619968" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{678c09aa-7d66-11d2-a67d-00105a42887f}\409 = "CAPE-OPEN Physical Property Database (PPDB) Servers" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0992-7D66-11D2-A67D-00105A42887F}\ = "ICapeThermoReliability" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0A9F-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AA1-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AA2-7D66-11D2-A67D-00105A42887F}\ = "ICapeThermoPropertyPackageManager" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B72-0100-11D2-A67D-00105A42887F} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B78-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0AFC-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B12-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E29E42B3-E481-45C6-A737-78F4A7FC0391}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{052DAFEF-0F43-4F4D-88AB-50F6AD8FC0EB}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C099B-0093-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09AF-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AA1-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B0F-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B27-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4616 msiexec.exe 4616 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5292 msiexec.exe Token: SeIncreaseQuotaPrivilege 5292 msiexec.exe Token: SeSecurityPrivilege 4616 msiexec.exe Token: SeCreateTokenPrivilege 5292 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5292 msiexec.exe Token: SeLockMemoryPrivilege 5292 msiexec.exe Token: SeIncreaseQuotaPrivilege 5292 msiexec.exe Token: SeMachineAccountPrivilege 5292 msiexec.exe Token: SeTcbPrivilege 5292 msiexec.exe Token: SeSecurityPrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeLoadDriverPrivilege 5292 msiexec.exe Token: SeSystemProfilePrivilege 5292 msiexec.exe Token: SeSystemtimePrivilege 5292 msiexec.exe Token: SeProfSingleProcessPrivilege 5292 msiexec.exe Token: SeIncBasePriorityPrivilege 5292 msiexec.exe Token: SeCreatePagefilePrivilege 5292 msiexec.exe Token: SeCreatePermanentPrivilege 5292 msiexec.exe Token: SeBackupPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeShutdownPrivilege 5292 msiexec.exe Token: SeDebugPrivilege 5292 msiexec.exe Token: SeAuditPrivilege 5292 msiexec.exe Token: SeSystemEnvironmentPrivilege 5292 msiexec.exe Token: SeChangeNotifyPrivilege 5292 msiexec.exe Token: SeRemoteShutdownPrivilege 5292 msiexec.exe Token: SeUndockPrivilege 5292 msiexec.exe Token: SeSyncAgentPrivilege 5292 msiexec.exe Token: SeEnableDelegationPrivilege 5292 msiexec.exe Token: SeManageVolumePrivilege 5292 msiexec.exe Token: SeImpersonatePrivilege 5292 msiexec.exe Token: SeCreateGlobalPrivilege 5292 msiexec.exe Token: SeBackupPrivilege 3732 vssvc.exe Token: SeRestorePrivilege 3732 vssvc.exe Token: SeAuditPrivilege 3732 vssvc.exe Token: SeBackupPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe Token: SeTakeOwnershipPrivilege 4616 msiexec.exe Token: SeRestorePrivilege 4616 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5292 msiexec.exe 5292 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4360 4616 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AVEVA PROII Simulation 2022 x64\Setup\ThirdPartySoftware\CAPE-OPEN\CAPE-OPEN.msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5292
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4360
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3732
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5930fa.rbs
- Size 81KB
- SHA256 3043a0f72a9f55108a3c2fa55a71f00933197a64fbabe92d02229767167d4632
- MD5 468d91d5631caa2b7e157163269a2791
- SHA1 27386f55d1638caedc7523d58e6c53dec6de9e4c
- SHA512 760a1ae2d12fbc1768427171924f8265f4187b388582f611c287922f006b03543f3991358b1c61896cd1613922af2677f3dad457970256c2f5dcdaf1104c6354
- SSDEEP 1536:GhQwEI+S17TgARz7imRhSTdR63E0RH6NLR44OSRdw/pRmadQQRDP53REha+RZyUj:GiwEI+S17TgARz7imRhSTdR63E0RH6Nv
- TLSH T130839D89338511D5CA04073902237EFA96ADFB1D89C2D5ED027EA29D1D6B9ECD840FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
- Size 471B
- SHA256 e41806d129790d608dd8de6340fb9a5aff4524d31c73dcabab81e0acd9e0ebe0
- MD5 afb26b701092e75c0f5368dc6f1f41e7
- SHA1 6ba900066852e2de2a53db7a4fc481967337c7bb
- SHA512 a07db8fdd6b9d37a74f8b9c5a2a1077c0b192619ecb19f07d03b4b5b2a4aebe2789345e6a8ac7e63fe22266f23b7e90ee4a58e6667ec3165b55d97659ebe0eb6
- TLSH T1E4F0DC724825C96A54429D4817D0EE2D34BF2F8D08C7486B283531DA49DC694A70ED0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_720871D5D7BC085DFDB2F51126DF7B12
- Size 471B
- SHA256 1719aaf427c54dc8b3db9f37cd81837133cba54910df8a9a7f4e1058214d74d3
- MD5 5da4f6671b292182d82d511549bf480f
- SHA1 76e283c192b02ab585af978004aa684ecd0ac845
- SHA512 66a786faf5584e6f67e9d69a02d89ea61b1323171d7197cde1259ca55cf913f2f424d55af61bd617801964dcd9da92dfa2e923b76d52bdeecf1f3ecfe5f81cfd
- TLSH T1DDF0D41508F0C4156E28ECC53BBCE7707110539814CBCA8EF970B6A000296FA7E3E4D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
- Size 404B
- SHA256 dbe54d082752aa46e352ea1da964ba8c44685abd04d06c4853ae2c5fed9a5643
- MD5 7fd470d39edcd10a64c316d89bf84038
- SHA1 a8cac3eb9e96c529a26e871fa7cfdcf24a4b53a0
- SHA512 dac1a15db16e6ce1e2ab8112e5343e06643bdb304076e31597eca08c7acfa2e1877774fa38afe9d167ac2b29631c53bc372beefde537adbc5e237094481ae149
- TLSH T1DDE0C02016BF202EF0609F3C03D990F9EF55F1013C6096BD0C91411EBB11E008C21839
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_720871D5D7BC085DFDB2F51126DF7B12
- Size 404B
- SHA256 c189f423f9bc5317640a332e0bb523f8ad06e6733538da12ebfcad6cafcb387e
- MD5 ac2db8893d2030f0ae925f77b4fcef4a
- SHA1 b6092857a0ed433a2cb285a1553f040e130af681
- SHA512 90f398be480d9d785dcc1ac12b24f4cc8b9749e385f88e94832c2c28246f94d9271bb61925b89ae87421d21d84c46a6f0423e955411aec07712248bd84bf86ba
- TLSH T142E0C62070FD466CF9E0C93006DEB0B14AA6F2008850CBAA24A0120DBB00E80CCA3A3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5930f9.msi
- Size 984KB
- SHA256 790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90
- MD5 87372f7b0014340126726043765b3b2e
- SHA1 d310c4c831f00ac99ae3743dfe8281016ffc7ab9
- SHA512 bfe4fc0f53a0544825028aa4e24da8c99f56924776ec3cd7f54b45a29c844bd17edc812f52af2d59a9db81773a1f39fed65f193527d1f9275a6e37d1bcb0cdd4
- SSDEEP 6144:1zPOBWsREaeSaRJ4JRpz/I/WP3M8XF9iyW1y48BxiKnWQ3:1zPOBbRmSxJb7I/Wk8Xle7Q
- TLSH T10B2519447AC601B8C65502774E3923B7E6979E1287D2A99A435C330CCEBFCF4A745ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\tmp\LR82JY2E\CAPE-OPENv1-0-0.dll
- Size 67KB
- SHA256 63749f19b4e78152125c9b434a9d2f7a594ed750f930c6c8bb211396a7e6364c
- MD5 0dd810e82e08b4b9924d74de367ebabe
- SHA1 e7f1e1873c988f520302a8810496a6d39a864324
- SHA512 da86318437f7d2c4bf1fcc2969c5971a6722354fc8db57cfc63ff507b30dd055e0e08faa5d086cf28beb3c627159854f24181feb2d94d4f4fd27fd711f7de069
- SSDEEP 768:v9WRf0bvhtMoj2vkzVsGaVT6TZu9qwSHxt9RSQYXgeO2xQj/M8hn7KLiK4VhMaVS:v9W27Moj2sexGTTR/D4pkqVTD9
- TLSH T1B463F89EB3145A98CA86CFFB6C91AA775730E746D2A1CE6D110D032D0F869A0DE10F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\tmp\PVQRL694\CAPE-OPENv1-1-0.dll
- Size 71KB
- SHA256 a22f4e5ce389949423bed6569523462a17b88408125813464c51217611d60a21
- MD5 03c1af077a31ce324eb65ebba5bf467e
- SHA1 23971b967dcdfb7312011ada59acfe1ce8724229
- SHA512 083e9e47ef9c1f252ea2f2d8c6eec7e7b4c548bad115919a118e86352aac3b5189e19bd2a91b2d1e72b46185a4ecda20dfed8fa48514331408bf1da3489aac91
- SSDEEP 768:5UlAH1iYnzM9HS9Kqup/nHvKh616/QtZZb3UxTdJq9qySHxtfAI0SQuXgeO2xQdV:+lAHnz/uZnHvKh6y834vHR27VbpUp0J
- TLSH T1CE63E87B331855A8DB95CFBE1CA26A7B8730D705D2E1DE69011D032C4F9B9A0CA11E7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 0fa37260da35d09506936b85fe82ffa198da1641e8c0484944c7ecce71ed732b
- MD5 3100a8bf95b57a22c2b48732f55365b9
- SHA1 6f62167d77f613d96f97dbcddaa19a7da432e56b
- SHA512 d6de85bc4ed6a8b9fb316b6bd8dc74cef634547fec56c957083b6349ff15cbd96fa4f79ef1c8b28e9d1816417d7107987eaf4cbb93d8a821f80c1d44f0eb7567
- SSDEEP 24576:Hu8m+1zndoO/vvTLL2rOOWafqiEjj1byn9mNpka1DU6qeMS2I/liDdQRe:j
- TLSH T1F047A32436F92100E7B79E3D78F06A634D3A7D6BAC169E8D45411B4E0921FB0E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6fcb6a2b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{37378ebd-4b41-47b7-a2c9-258fe5e460fa}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ecb288b9a9add532c8fd377fa5b397c69d7a899345a4c0a966ddffdb9b4af4da
- MD5 ad17f37d3080c62707d959dbb6384152
- SHA1 e7ef2aa6d3810b1fc37d3c5452cbbd248468a2b7
- SHA512 a743239f0541fc8761b357466b9e35a45a08e57b7c2428c314fd8be137b74c3bf56952e14a23c10ac46fce918dfa77d37e1e06696bf76985594fc2d7cc0bffc8
- SSDEEP 96:FhFc23Svc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:14b++ZVmN
- TLSH T1CCD189085AF54311E2B3AB7229F18557A877B911FF33CB8E0198638E2670910F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH