Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dropras.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
dropras.msi
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target dropras.msi
- Size 644KB
- Sample260506-w2x2bagt21
- SHA256 4285548e097f66195f1e1efc202f76b977db9048f82ba0482da437824b2807b1
- MD5 ea3c7c9c8b001dd1b7d58239003945fa
- SHA1 caeca7a97df367ec31c91db96e5cd08beda7b12f
- SHA512 f151074aff0de9b2b01b193560f4d09a6fecca6017e93fc973a6bbb3c200d4d5c4ce32d5d5a3c4f9e8c93f01d66ed93ca613dc2c0a208bfdf9dfc849b9a1b97c
- SSDEEP 12288:rAe5j8u7NAcp0hUy3MjxZaN0uWHsrp5/D5PzG6:8gjXNAGGUyoxZaN0zHsrpZtzG
- TLSH T1F1E4235A7040A35BC2CE013A614EA7D8E716ED1D3F165D1930297BFEAE329A02473ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2888 G2M.exe 4176 G2M.exe - Loads dropped DLL 2 IoCs
pid Process 2888 G2M.exe 4176 G2M.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoToMeetingUpdater = "C:\\Users\\Admin\\AppData\\Roaming\\GoToMeeting\\G2M.exe" msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e5847d4.msi msiexec.exe File created C:\Windows\SystemTemp\~DF2B82EFA8856F9E82.TMP msiexec.exe File created C:\Windows\Installer\e5847d2.msi msiexec.exe File opened for modification C:\Windows\Installer\e5847d2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFC0F97601A5B5EFF8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4929.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2324DA8719DC40B3.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{BDE09A7E-2C43-489A-BEB4-A3B120B9D113} msiexec.exe File created C:\Windows\SystemTemp\~DFC3E85EAB6B22F75E.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3292 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language G2M.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language G2M.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3428 msiexec.exe 3428 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3292 msiexec.exe Token: SeIncreaseQuotaPrivilege 3292 msiexec.exe Token: SeSecurityPrivilege 3428 msiexec.exe Token: SeCreateTokenPrivilege 3292 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3292 msiexec.exe Token: SeLockMemoryPrivilege 3292 msiexec.exe Token: SeIncreaseQuotaPrivilege 3292 msiexec.exe Token: SeMachineAccountPrivilege 3292 msiexec.exe Token: SeTcbPrivilege 3292 msiexec.exe Token: SeSecurityPrivilege 3292 msiexec.exe Token: SeTakeOwnershipPrivilege 3292 msiexec.exe Token: SeLoadDriverPrivilege 3292 msiexec.exe Token: SeSystemProfilePrivilege 3292 msiexec.exe Token: SeSystemtimePrivilege 3292 msiexec.exe Token: SeProfSingleProcessPrivilege 3292 msiexec.exe Token: SeIncBasePriorityPrivilege 3292 msiexec.exe Token: SeCreatePagefilePrivilege 3292 msiexec.exe Token: SeCreatePermanentPrivilege 3292 msiexec.exe Token: SeBackupPrivilege 3292 msiexec.exe Token: SeRestorePrivilege 3292 msiexec.exe Token: SeShutdownPrivilege 3292 msiexec.exe Token: SeDebugPrivilege 3292 msiexec.exe Token: SeAuditPrivilege 3292 msiexec.exe Token: SeSystemEnvironmentPrivilege 3292 msiexec.exe Token: SeChangeNotifyPrivilege 3292 msiexec.exe Token: SeRemoteShutdownPrivilege 3292 msiexec.exe Token: SeUndockPrivilege 3292 msiexec.exe Token: SeSyncAgentPrivilege 3292 msiexec.exe Token: SeEnableDelegationPrivilege 3292 msiexec.exe Token: SeManageVolumePrivilege 3292 msiexec.exe Token: SeImpersonatePrivilege 3292 msiexec.exe Token: SeCreateGlobalPrivilege 3292 msiexec.exe Token: SeBackupPrivilege 1404 vssvc.exe Token: SeRestorePrivilege 1404 vssvc.exe Token: SeAuditPrivilege 1404 vssvc.exe Token: SeBackupPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe Token: SeTakeOwnershipPrivilege 3428 msiexec.exe Token: SeRestorePrivilege 3428 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3292 msiexec.exe 3292 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2888 G2M.exe 4176 G2M.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3428 wrote to memory of 1328 3428 msiexec.exe 83 PID 3428 wrote to memory of 2564 3428 msiexec.exe 85 PID 3428 wrote to memory of 3896 3428 msiexec.exe 87 PID 3896 wrote to memory of 2888 3896 cmd.exe 90 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dropras.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3292
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1328
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4CC9C1C44C6340B36FDD0EF1F11D81CF2⤵
- System Location Discovery: System Language Discovery
PID:2564
-
-
C:\Windows\system32\cmd.execmd.exe /c start "" "C:\Users\Admin\AppData\Roaming\GoToMeeting\G2M.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Roaming\GoToMeeting\G2M.exe"C:\Users\Admin\AppData\Roaming\GoToMeeting\G2M.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
C:\Users\Admin\AppData\Roaming\GoToMeeting\G2M.exeC:\Users\Admin\AppData\Roaming\GoToMeeting\G2M.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4176
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5847d3.rbs
- Size 8KB
- SHA256 6e847d04d517c173ae4d33035c1695c85ae62f5da0286674d41e3577e33a48a6
- MD5 9ed52b42fe273aa32c58df7c6a7ca8a5
- SHA1 076cf3e3d1e6011f685d5f3b72c8c8238f09514e
- SHA512 08de17421034522c484aed8e7e5c2a81833447b3fc23e00667ac2725c3723742cdfb195a779c0992806657bcbaff7290e46984b61c487af20914c80338d05ed7
- SSDEEP 192:C7Pq+t/C0OeOSOI7SO7mSwLbQB9mTYHrLpSmVXMS1qxXa:C7rOVSRSgmSwHQB9mTYH4mVXMS1qxXa
- TLSH T12D021D0AB250D7E1D4A92336BB170B113FBBD7E9C646771F048E85A41F43BD88B891C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\GoToMeeting\G2M.exe
- Size 31KB
- SHA256 4dc4c0bdce7d711bd4160beebbfe67d64a65a5c083429cb222926d7bd095b353
- MD5 aa6abf41a80d736c27c168e834baf3c7
- SHA1 67a0d3fd95af5ad86d978054008c9f3c9e65c335
- SHA512 9e223027f21df20bbc2b4a5953beaf4059946e288579ea55280f4d0b69282eb9179864c7a5c696d759f06d5cf1ce5c59707a459a3542ca2afb4f3345ad2abd37
- SSDEEP 384:o8Kk/M8uEryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2Sf1R+CxXBhgBx4eMDP:oD4Jr+VWOV+csoHViBBnXRbIqeMDGe
- TLSH T1ECE24A97EFC86852D07646397966EAB20B37FF67260C0567B49D6202AF71383243351F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\GoToMeeting\g2m.dll
- Size 653KB
- SHA256 78e25964c009618203fb765cfa505a0a610164847d52e73d5cca0c4fed4ff8bb
- MD5 8d1f08c28125e93bc4128bb803fdfcf4
- SHA1 9b08f37f729a69e858e308210a45311cdcffe691
- SHA512 04f7a012be0b1d94ff26929291ea2762ff549f9591d79613e41d941814cc8c5a69f0482aa9716013285e8edc659b4cf3a940045448b0111a81de04886822b99f
- SSDEEP 12288:Ue51syV6EFjqu/NA6p00Ua3MpxZANPuWH1rp5vg5P:b5uydjhNAQ9UaUxZANPzH1rpu
- TLSH T15EE4024470A2C473D5AE15394468AFA9532F6D24EFA08DFB23941FFE4E702D09D32DA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5847d2.msi
- Size 644KB
- SHA256 4285548e097f66195f1e1efc202f76b977db9048f82ba0482da437824b2807b1
- MD5 ea3c7c9c8b001dd1b7d58239003945fa
- SHA1 caeca7a97df367ec31c91db96e5cd08beda7b12f
- SHA512 f151074aff0de9b2b01b193560f4d09a6fecca6017e93fc973a6bbb3c200d4d5c4ce32d5d5a3c4f9e8c93f01d66ed93ca613dc2c0a208bfdf9dfc849b9a1b97c
- SSDEEP 12288:rAe5j8u7NAcp0hUy3MjxZaN0uWHsrp5/D5PzG6:8gjXNAGGUyoxZaN0zHsrpZtzG
- TLSH T1F1E4235A7040A35BC2CE013A614EA7D8E716ED1D3F165D1930297BFEAE329A02473ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 7bc340dcdc060c81a997dfcd4898821cb9acf01d0d850880a2865c3ba5c4388c
- MD5 c1b65c1e5a3944745593276306bf595e
- SHA1 70ab7c84f0ff3801a276bbf40640f1753e210b84
- SHA512 e2473e75aa67358787383ed9b7d05316a670471ba1688164000eb6b8e371b24cc657eebd43b09cab8bb9ad16595d646d0d4bf649e7db5e1284e20ca333996612
- SSDEEP 24576:Q2gmSp1LdoO/vvTLEGveR0Xaf6pEQYrVWWMN3pkP2U64EjL6o0O47CFox:O
- TLSH T16F47D12432FD2240E7F79E3D6CF0AA27493A7D5B9C159E8D45421B4E0921BB0E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{a37a13d3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{15ad48cb-4138-406e-9ee9-340b8865cfd8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4ec4692c6d1339046df29972b9e05179d3039679f946b2c043223f888919ec27
- MD5 d8f5bd7fbec0a42dbddfbfb1615a4e34
- SHA1 179f07c762514bf63bf43f563ea2d6ebeb44640f
- SHA512 59e5e167cbc91b4b660744b420009965fd6866df73467593f448fa07ffa2585f08e1a12899cfcad692732ab13d4a52ace40fa877bafc305415b0bce6c3f544b3
- SSDEEP 96:FnKmmsKtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:lKmUb++ZVm
- TLSH T106D18A185AF54311E2B3AB7129F18557A477B812EF33CB8E0198638E2670A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH