Analysis
- max time kernel
150s - max time network
151s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
18/05/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp0oz8zwtl.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp0oz8zwtl.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp0oz8zwtl.msi
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target tmp0oz8zwtl.msi
- Size 1.9MB
- Sample260518-2mrtmsdx4w
- SHA256 7b939d1d59b370c836fea6703a254127de36ac0259538809535bb136b6725c72
- MD5 bdc8b7229eaa7473c25a37f08ba79189
- SHA1 9699c8b0f0235bae5285a80b3e3b8c447d2aad0c
- SHA512 1332bfad5da5c8fce17cf374ff1012831744e3e69cea4b87607eb9dc95b6ebc51c91a6766ee186d5ee8a5e027111ec74a644bd470fb891c60240239f727b3e17
- SSDEEP 24576:kt9cpVDhI6DDys5Rtmi/Bt3O79TqszKlGEa7vFLf2nxh7H7mGV:jpRhFnywtmABg7Qm+GlDFLfax17m
- TLSH T1449578D13784C027E84B09314E67C79D976DFCA4AA30B08737B0BB6E5A3A9D39E64741
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4664 install.exe - Loads dropped DLL 1 IoCs
pid Process 4304 MsiExec.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 2624 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e581c4d.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C0815896-DCF1-4D15-BCAD-6F5C47806CBD} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e581c4d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI1D86.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 540 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d8913ae3c216a6080000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801d8913ae30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101d8913ae3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6fd8913ae300000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71d8913ae300000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 320 msiexec.exe 320 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 540 msiexec.exe Token: SeIncreaseQuotaPrivilege 540 msiexec.exe Token: SeSecurityPrivilege 320 msiexec.exe Token: SeCreateTokenPrivilege 540 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 540 msiexec.exe Token: SeLockMemoryPrivilege 540 msiexec.exe Token: SeIncreaseQuotaPrivilege 540 msiexec.exe Token: SeMachineAccountPrivilege 540 msiexec.exe Token: SeTcbPrivilege 540 msiexec.exe Token: SeSecurityPrivilege 540 msiexec.exe Token: SeTakeOwnershipPrivilege 540 msiexec.exe Token: SeLoadDriverPrivilege 540 msiexec.exe Token: SeSystemProfilePrivilege 540 msiexec.exe Token: SeSystemtimePrivilege 540 msiexec.exe Token: SeProfSingleProcessPrivilege 540 msiexec.exe Token: SeIncBasePriorityPrivilege 540 msiexec.exe Token: SeCreatePagefilePrivilege 540 msiexec.exe Token: SeCreatePermanentPrivilege 540 msiexec.exe Token: SeBackupPrivilege 540 msiexec.exe Token: SeRestorePrivilege 540 msiexec.exe Token: SeShutdownPrivilege 540 msiexec.exe Token: SeDebugPrivilege 540 msiexec.exe Token: SeAuditPrivilege 540 msiexec.exe Token: SeSystemEnvironmentPrivilege 540 msiexec.exe Token: SeChangeNotifyPrivilege 540 msiexec.exe Token: SeRemoteShutdownPrivilege 540 msiexec.exe Token: SeUndockPrivilege 540 msiexec.exe Token: SeSyncAgentPrivilege 540 msiexec.exe Token: SeEnableDelegationPrivilege 540 msiexec.exe Token: SeManageVolumePrivilege 540 msiexec.exe Token: SeImpersonatePrivilege 540 msiexec.exe Token: SeCreateGlobalPrivilege 540 msiexec.exe Token: SeBackupPrivilege 3136 vssvc.exe Token: SeRestorePrivilege 3136 vssvc.exe Token: SeAuditPrivilege 3136 vssvc.exe Token: SeBackupPrivilege 320 msiexec.exe Token: SeRestorePrivilege 320 msiexec.exe Token: SeRestorePrivilege 320 msiexec.exe Token: SeTakeOwnershipPrivilege 320 msiexec.exe Token: SeRestorePrivilege 320 msiexec.exe Token: SeTakeOwnershipPrivilege 320 msiexec.exe Token: SeBackupPrivilege 4864 srtasks.exe Token: SeRestorePrivilege 4864 srtasks.exe Token: SeSecurityPrivilege 4864 srtasks.exe Token: SeTakeOwnershipPrivilege 4864 srtasks.exe Token: SeBackupPrivilege 4864 srtasks.exe Token: SeRestorePrivilege 4864 srtasks.exe Token: SeSecurityPrivilege 4864 srtasks.exe Token: SeTakeOwnershipPrivilege 4864 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 540 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 320 wrote to memory of 4864 320 msiexec.exe 86 PID 320 wrote to memory of 4304 320 msiexec.exe 88 PID 4304 wrote to memory of 2624 4304 MsiExec.exe 89 PID 4304 wrote to memory of 4276 4304 MsiExec.exe 91 PID 4304 wrote to memory of 4664 4304 MsiExec.exe 93 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0oz8zwtl.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:540
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A8587A309A4BB3433FE8D5C4050BD9F92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-622fe988-ddde-460b-9e1d-f68313b3f8ed\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2624
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Users\Admin\AppData\Local\Temp\MW-622fe988-ddde-460b-9e1d-f68313b3f8ed\files\install.exe"C:\Users\Admin\AppData\Local\Temp\MW-622fe988-ddde-460b-9e1d-f68313b3f8ed\files\install.exe" /VERYSILENT /VERYSILENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-622fe988-ddde-460b-9e1d-f68313b3f8ed\files.cab
- Size 1.6MB
- SHA256 3fb44f2533de3106494be7f12fb2a7f3fe9453384385e5b2d489788dbc150bab
- MD5 dde33cc7bc57e73262a9587e6fd2c73b
- SHA1 429a01f8dd68c1d46f32a3a13e4b5051803139a3
- SHA512 31f0d86a3638341e40f949cf9f386abe843afa3a04abe36ac26071b63507a5c19fcc54f594cc280bc1969bed7879163324477027bff0f1a68e5ef09f27b60d66
- SSDEEP 24576:VDys5Rtmi/Bt3O79TqszKlGEa7vFLf2nxh7H7mGVM:5ywtmABg7Qm+GlDFLfax17mn
- TLSH T12B7501D577909027EC8B5C205E47878CA7ADEC94A974744337B6F70E2A7EDA31EA0B04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MW-622fe988-ddde-460b-9e1d-f68313b3f8ed\msiwrapper.ini
- Size 1KB
- SHA256 04f70682a4ecbcf65c0da532faa58b46bf447b4b68c6264c2bcf92b69d973750
- MD5 4a85ba8b14ee57797c77b578e82d99bc
- SHA1 12d0b79403c715dffb311784f0df8ff1931dbb61
- SHA512 0043c5bbcf2b1a963144b0a147fcb152d37482922ff9c8830f654301a15afaae23f353636099f6be9e541d4bae8693021d05f76231711c57362449a2419bcc55
- TLSH T18C210E24ABE51021F2B3AEA1FEF59096EA667C223C00AC1D40C5414A0DB3B46E9B2739
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI1D86.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- TLSH T1F1246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.0MB
- SHA256 2ce1b95b949960e576c16998b31153ce88ae58fa5bdc1764bcd4e494118b7024
- MD5 5ceb64fbe9b95171d194ccdebab3c9b2
- SHA1 7f711bd6413b2d464c553f3cb11090e448c10d0e
- SHA512 faa592a621e0b93dff8f810622ddcf474fce3190eca675a47fe9a7a235bc02564ffa6eddbfbbdb4fe66b5457d072b963548144ae15b69f371352d3509ad27894
- SSDEEP 24576:tEpmg3MGdoO/vvTLDe8+GZWykMbhh0DaAM4tajQO8Z6jQ2icop/GJAhHT9:Io
- TLSH T10647F62436F92210F7F39E3DACF06A2349397D579C16DE8D45421B4E0922B71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e33a91d8-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{11bf87aa-995e-4033-8844-acb9c61fcc67}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0eb5fc6269c6808f58f8a973e7231761bc5bde0675f0a579a33655ce57f0ef3a
- MD5 664d0224d231c125b03bd577875423f2
- SHA1 7257c3ffa6a9424fbc72f40cf04d97d2fb974d54
- SHA512 2f8a269f6b8909c22f05f6c1a4b4ec4a6b10ece44b36be8a47a43142b29097a0e122df4caff3ee6c6be5ffb792f5d5fc532f3ca42adade77aa4f3d310e367faf
- SSDEEP 96:F2pB2Bvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:kwb++ZVm
- TLSH T13BD19A085AF54711E2B3AB7129F14557A877B811EF33CB8E0198238E6671A10F836F6B
- MD5 SHA1 SHA512 SSDEEP TLSH