790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90

Analysis

max time kernel
149s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
Size 984KB
Sample260506-bzsnlag16w
SHA256 790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90
MD5 87372f7b0014340126726043765b3b2e
SHA1 d310c4c831f00ac99ae3743dfe8281016ffc7ab9
SHA512 bfe4fc0f53a0544825028aa4e24da8c99f56924776ec3cd7f54b45a29c844bd17edc812f52af2d59a9db81773a1f39fed65f193527d1f9275a6e37d1bcb0cdd4
SSDEEP 6144:1zPOBWsREaeSaRJ4JRpz/I/WP3M8XF9iyW1y48BxiKnWQ3:1zPOBbRmSxJb7I/Wk8Xle7Q
TLSH
T10B2519447AC601B8C65502774E3923B7E6979E1287D2A99A435C330CCEBFCF4A745ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4884	msiexec.exe
3	4884	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\CAPE-OPEN\Reference Assemblies\CAPE-OPENv1-0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\CAPE-OPEN\Type Libraries\CAPE-OPENv1-0-0.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\CAPE-OPEN\Reference Assemblies\CAPE-OPENv1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\CAPE-OPEN\Type Libraries\CAPE-OPENv1-1-0.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\CAPE-OPEN\Licence\CAPE-OPEN License.pdf	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA4338E8D2BD3BB3.TMP	msiexec.exe
File created	C:\Windows\assembly\tmp\ZUDXNR3I\CAPE-OPENv1-1-0.dll	msiexec.exe
File created	C:\Windows\Installer\e596e72.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596e70.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB84FD7B67FBF546.TMP	msiexec.exe
File created	C:\Windows\Installer\{D03DC879-E534-4B0D-BA60-0F55B032F6B8}\colan.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF094775B6B78507DE.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D03DC879-E534-4B0D-BA60-0F55B032F6B8}	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\{D03DC879-E534-4B0D-BA60-0F55B032F6B8}\colan.ico	msiexec.exe
File created	C:\Windows\Installer\e596e70.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FF6.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\XJGTCRNV\CAPE-OPENv1-0-0.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE9761C1A07A19D8.TMP	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e689d3d397d010a60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e689d3d30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e689d3d3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae689d3d3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de689d3d3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B26-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B6A-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{033AC3EF-7449-4113-A10E-D70161B3FC22}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0998-0100-11D2-A67D-00105A42887F}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0999-0093-11D2-A67D-00105A42887F}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0A9D-0100-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B23-7D66-11D2-A67D-00105A42887F}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B6E-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0993-7D66-11D2-A67D-00105A42887F}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C099B-0093-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C099C-0093-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C09CE-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AA0-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B14-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B1C-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3FF0B24B-4299-4DAC-A46E-7843728AD205}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0998-0100-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09A8-0093-11D2-A67D-00105A42887F}\ = "ICapeBooleanParameterSpec"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C09B5-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B18-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B25-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0A9D-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B6C-0100-11D2-A67D-00105A42887F}\ = "ICapeSMSTSequencing"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{033AC3EF-7449-4113-A10E-D70161B3FC22}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{638D84DC-84E9-4AEA-83A4-0BB8852832E9}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C09A9-0093-11D2-A67D-00105A42887F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0A9D-0100-11D2-A67D-00105A42887F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B8A-0100-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85E4C4E2-57FC-43AA-A39A-78D392947080}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Typelib\{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DD05FA1-EB10-4CBE-A94A-24F6EA7E7815}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C099E-0093-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09B6-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09CD-7D66-11D2-A67D-00105A42887F}\ = "ICapeMINLPSystem"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B80-0100-11D2-A67D-00105A42887F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B87-0100-11D2-A67D-00105A42887F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0998-0100-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{678c09a6-7d66-11D2-a67d-00105a42887f}\409 = "CAPE-OPEN Thermo Equilibrium Servers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0A9F-0100-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B25-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B6C-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B79-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9304E044-3311-41ED-8766-0123CB44038A}\TypeLib\ = "{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{45A1B544-4BE6-43F9-83A4-4A7CFEE802FE}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C09B6-7D66-11D2-A67D-00105A42887F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C09CD-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0A9E-0100-11D2-A67D-00105A42887F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B10-7D66-11D2-A67D-00105A42887F}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B82-0100-11D2-A67D-00105A42887F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B8D-0100-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Typelib\{4A5E2E81-C093-11D4-9F1B-0010A4D198C2}\1.1\FLAGS	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{25BC241A-8110-4806-AF7A-CB6CFA7B9A57}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0993-7D66-11D2-A67D-00105A42887F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0B1E-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B84-0100-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78DEFBBD-ED69-4F81-90A4-6B636CE13164}\ = "ICapePSPCollection"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F840ECA2-941B-4AF7-84DB-47E2187430A2}\ = "ICapePSP"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0999-0093-11D2-A67D-00105A42887F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C09CD-7D66-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0AFB-0100-11D2-A67D-00105A42887F}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B27-7D66-11D2-A67D-00105A42887F}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B5F-0100-11D2-A67D-00105A42887F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{678C0B71-0100-11D2-A67D-00105A42887F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678C0991-7D66-11D2-A67D-00105A42887F}\ = "ICapeThermoCalculationRoutine"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3208	msiexec.exe
3208	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4884	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4884	msiexec.exe
Token: SeSecurityPrivilege	3208	msiexec.exe
Token: SeCreateTokenPrivilege	4884	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4884	msiexec.exe
Token: SeLockMemoryPrivilege	4884	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4884	msiexec.exe
Token: SeMachineAccountPrivilege	4884	msiexec.exe
Token: SeTcbPrivilege	4884	msiexec.exe
Token: SeSecurityPrivilege	4884	msiexec.exe
Token: SeTakeOwnershipPrivilege	4884	msiexec.exe
Token: SeLoadDriverPrivilege	4884	msiexec.exe
Token: SeSystemProfilePrivilege	4884	msiexec.exe
Token: SeSystemtimePrivilege	4884	msiexec.exe
Token: SeProfSingleProcessPrivilege	4884	msiexec.exe
Token: SeIncBasePriorityPrivilege	4884	msiexec.exe
Token: SeCreatePagefilePrivilege	4884	msiexec.exe
Token: SeCreatePermanentPrivilege	4884	msiexec.exe
Token: SeBackupPrivilege	4884	msiexec.exe
Token: SeRestorePrivilege	4884	msiexec.exe
Token: SeShutdownPrivilege	4884	msiexec.exe
Token: SeDebugPrivilege	4884	msiexec.exe
Token: SeAuditPrivilege	4884	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4884	msiexec.exe
Token: SeChangeNotifyPrivilege	4884	msiexec.exe
Token: SeRemoteShutdownPrivilege	4884	msiexec.exe
Token: SeUndockPrivilege	4884	msiexec.exe
Token: SeSyncAgentPrivilege	4884	msiexec.exe
Token: SeEnableDelegationPrivilege	4884	msiexec.exe
Token: SeManageVolumePrivilege	4884	msiexec.exe
Token: SeImpersonatePrivilege	4884	msiexec.exe
Token: SeCreateGlobalPrivilege	4884	msiexec.exe
Token: SeBackupPrivilege	6048	vssvc.exe
Token: SeRestorePrivilege	6048	vssvc.exe
Token: SeAuditPrivilege	6048	vssvc.exe
Token: SeBackupPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4884	msiexec.exe
4884	msiexec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 5016	3208	msiexec.exe	82

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AVEVA PROII Simulation 2022 x64\Setup\ThirdPartySoftware\CAPE-OPEN\CAPE-OPEN.msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4884

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596e71.rbs

Path C:\Config.Msi\e596e71.rbs
Size 81KB
SHA256 1ed5970303f324d6ac98c50614f5fd042f69f7e8ea74be08077e7d4b2ccc9906
MD5 0db342af81afbe7964ce87f3028141d4
SHA1 cb7f43682ddfb8cdd9fc8bef7421c131862f7b4f
SHA512 090a9f474ebd4aa49b3de5db2e4527b2c4e816bec7cff733d41ccd38e979f631cd293c44f8ef730b7b643eed03ae55bb42db1376d125cf2f6f4fb498c67d6b1f
SSDEEP 1536:+vQwEI+S17TgARz7imRhSTdR63E0RH6NLR44OSRdw/pRmadQQRDP53REha+RZyU+:+4wEI+S17TgARz7imRhSTdR63E0RH6Na
TLSH
T1AD83AD89338511D5DA04073902237EFA96ADFB1D89C2D5ED027EA29D1D6B9ECD840FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Size 471B
SHA256 e41806d129790d608dd8de6340fb9a5aff4524d31c73dcabab81e0acd9e0ebe0
MD5 afb26b701092e75c0f5368dc6f1f41e7
SHA1 6ba900066852e2de2a53db7a4fc481967337c7bb
SHA512 a07db8fdd6b9d37a74f8b9c5a2a1077c0b192619ecb19f07d03b4b5b2a4aebe2789345e6a8ac7e63fe22266f23b7e90ee4a58e6667ec3165b55d97659ebe0eb6
TLSH
T1E4F0DC724825C96A54429D4817D0EE2D34BF2F8D08C7486B283531DA49DC694A70ED0F
MD5 SHA1 SHA512 TLSH

Submit Download

66AE3BFDF94A732B262342AD2154B86E_720871D5D7BC085DFDB2F51126DF7B12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_720871D5D7BC085DFDB2F51126DF7B12
Size 471B
SHA256 1719aaf427c54dc8b3db9f37cd81837133cba54910df8a9a7f4e1058214d74d3
MD5 5da4f6671b292182d82d511549bf480f
SHA1 76e283c192b02ab585af978004aa684ecd0ac845
SHA512 66a786faf5584e6f67e9d69a02d89ea61b1323171d7197cde1259ca55cf913f2f424d55af61bd617801964dcd9da92dfa2e923b76d52bdeecf1f3ecfe5f81cfd
TLSH
T1DDF0D41508F0C4156E28ECC53BBCE7707110539814CBCA8EF970B6A000296FA7E3E4D0
MD5 SHA1 SHA512 TLSH

Submit Download

42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Size 404B
SHA256 4918677696ce05d384ba6b2d25f13691ec53c6d5ddb4d6a23b5d232958c7c4de
MD5 6533814f8e641c6ddca9cf8f98af6464
SHA1 9c39a9b999f232c8439f97853b2dda2d05380a25
SHA512 8625710404353a80b45be3377bde676d2a1e4f9749ea4be054fb566682b976d8f5017d096fd1c66ceafd3447d69cf3cec50e18b6fd35e52776d70e7f123ea1f6
TLSH
T1AAE0202056BF211EF164AB7C03D991F9EF55F2023D6496BD0C91551EBB15E108D25839
MD5 SHA1 SHA512 TLSH

Submit Download

66AE3BFDF94A732B262342AD2154B86E_720871D5D7BC085DFDB2F51126DF7B12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_720871D5D7BC085DFDB2F51126DF7B12
Size 404B
SHA256 38a102607e8828852c3538901862bbc342043a46aac73814aed3b42ef87557c9
MD5 d4860f8781674f40fc7833c931177e33
SHA1 12c9b593e34a0c743491ce85182435605e5f0b32
SHA512 f82c3aff394538b62bd6eb4a85769b99e476b2d8ac1e27a42c3a710d022f307885ae78b5cf22289064d8087cd47324c51b54555bc2913a5da41baac98b63cca9
TLSH
T170E0262071FD66ACF5E4D9350ADF71B15AA5F2018854C7BA16A0260DFB00F90CC62E3B
MD5 SHA1 SHA512 TLSH

Submit Download

e596e70.msi

Path C:\Windows\Installer\e596e70.msi
Size 984KB
SHA256 790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90
MD5 87372f7b0014340126726043765b3b2e
SHA1 d310c4c831f00ac99ae3743dfe8281016ffc7ab9
SHA512 bfe4fc0f53a0544825028aa4e24da8c99f56924776ec3cd7f54b45a29c844bd17edc812f52af2d59a9db81773a1f39fed65f193527d1f9275a6e37d1bcb0cdd4
SSDEEP 6144:1zPOBWsREaeSaRJ4JRpz/I/WP3M8XF9iyW1y48BxiKnWQ3:1zPOBbRmSxJb7I/Wk8Xle7Q
TLSH
T10B2519447AC601B8C65502774E3923B7E6979E1287D2A99A435C330CCEBFCF4A745ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CAPE-OPENv1-0-0.dll

Path C:\Windows\assembly\tmp\XJGTCRNV\CAPE-OPENv1-0-0.dll
Size 67KB
SHA256 63749f19b4e78152125c9b434a9d2f7a594ed750f930c6c8bb211396a7e6364c
MD5 0dd810e82e08b4b9924d74de367ebabe
SHA1 e7f1e1873c988f520302a8810496a6d39a864324
SHA512 da86318437f7d2c4bf1fcc2969c5971a6722354fc8db57cfc63ff507b30dd055e0e08faa5d086cf28beb3c627159854f24181feb2d94d4f4fd27fd711f7de069
SSDEEP 768:v9WRf0bvhtMoj2vkzVsGaVT6TZu9qwSHxt9RSQYXgeO2xQj/M8hn7KLiK4VhMaVS:v9W27Moj2sexGTTR/D4pkqVTD9
TLSH
T1B463F89EB3145A98CA86CFFB6C91AA775730E746D2A1CE6D110D032D0F869A0DE10F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CAPE-OPENv1-1-0.dll

Path C:\Windows\assembly\tmp\ZUDXNR3I\CAPE-OPENv1-1-0.dll
Size 71KB
SHA256 a22f4e5ce389949423bed6569523462a17b88408125813464c51217611d60a21
MD5 03c1af077a31ce324eb65ebba5bf467e
SHA1 23971b967dcdfb7312011ada59acfe1ce8724229
SHA512 083e9e47ef9c1f252ea2f2d8c6eec7e7b4c548bad115919a118e86352aac3b5189e19bd2a91b2d1e72b46185a4ecda20dfed8fa48514331408bf1da3489aac91
SSDEEP 768:5UlAH1iYnzM9HS9Kqup/nHvKh616/QtZZb3UxTdJq9qySHxtfAI0SQuXgeO2xQdV:+lAHnz/uZnHvKh6y834vHR27VbpUp0J
TLSH
T1CE63E87B331855A8DB95CFBE1CA26A7B8730D705D2E1DE69011D032C4F9B9A0CA11E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 b9db363cfe896c50635954c0cfca9eb69c12b00f80e7d3af7ee911da844c4cb8
MD5 dc5d4fac594c045872fe2839c32e1a0f
SHA1 419e5f9221d380cfe01c4d43c0b54c94e8e94d19
SHA512 8ea97a0a21395a611a1c7bc81e6598a92b2d26e782f1f710d2a48945c50458e3d611c5d6a4a7575d5dcef2d33af5862be3761cc69c3e2c059155fca6413e49e2
SSDEEP 24576:02gmSp1GdoO/vvTLn2MeREnqfqpnA44mWWPd3pksVX6IkQIJ4Xdb7BmrB:T
TLSH
T14447052436F92110E7F79F3CA8F0AA23493A7D5B9C15DE8C46411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{68bd1d52-3e00-4fb0-8da0-a61e12655bae}_OnDiskSnapshotProp

Path \??\Volume{d3d389e6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{68bd1d52-3e00-4fb0-8da0-a61e12655bae}_OnDiskSnapshotProp
Size 6KB
SHA256 ec89f4cbff407accd5c5ebfdafb0b594f65810b110c11989f4df161708c9c2a0
MD5 d5d84d28e5a83c87b5e872561c644670
SHA1 33a7e869932732ccf3ecb4cb6c4245b0468b4420
SHA512 1c9a7669e14fb49a52cd415b0720e0cb1f393ac5c82756d215d6257b757d1b46ca392b71c7968dedc8295d86480f32ade119e347e6a026587294894d5da4e339
SSDEEP 96:FTc2Xawjtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:JKcb++ZVmN
TLSH
T134D189185AE54711E2B3AB3129F18557A877B811EF33CB8E0298638F2671910F935F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3208-29-0x0000020627590000-0x00000206275A2000-memory.dmp

Download

memory/3208-52-0x0000020627000000-0x000002062700C000-memory.dmp

Download

memory/3208-32-0x00000206275B0000-0x00000206275C4000-memory.dmp

Download

memory/4884-53-0x000002774D910000-0x000002774D91C000-memory.dmp

Download

memory/4884-8-0x000002774D910000-0x000002774D91C000-memory.dmp

Download