Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp0oz8zwtl.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp0oz8zwtl.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp0oz8zwtl.msi
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target tmp0oz8zwtl.msi
- Size 1.9MB
- Sample260518-2mrtmsdx4w
- SHA256 7b939d1d59b370c836fea6703a254127de36ac0259538809535bb136b6725c72
- MD5 bdc8b7229eaa7473c25a37f08ba79189
- SHA1 9699c8b0f0235bae5285a80b3e3b8c447d2aad0c
- SHA512 1332bfad5da5c8fce17cf374ff1012831744e3e69cea4b87607eb9dc95b6ebc51c91a6766ee186d5ee8a5e027111ec74a644bd470fb891c60240239f727b3e17
- SSDEEP 24576:kt9cpVDhI6DDys5Rtmi/Bt3O79TqszKlGEa7vFLf2nxh7H7mGV:jpRhFnywtmABg7Qm+GlDFLfax17m
- TLSH T1449578D13784C027E84B09314E67C79D976DFCA4AA30B08737B0BB6E5A3A9D39E64741
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3728 install.exe - Loads dropped DLL 1 IoCs
pid Process 5036 MsiExec.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 4380 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e585678.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C0815896-DCF1-4D15-BCAD-6F5C47806CBD} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5743.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e585678.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4948 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 896 msiexec.exe 896 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 4948 msiexec.exe Token: SeIncreaseQuotaPrivilege 4948 msiexec.exe Token: SeSecurityPrivilege 896 msiexec.exe Token: SeCreateTokenPrivilege 4948 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4948 msiexec.exe Token: SeLockMemoryPrivilege 4948 msiexec.exe Token: SeIncreaseQuotaPrivilege 4948 msiexec.exe Token: SeMachineAccountPrivilege 4948 msiexec.exe Token: SeTcbPrivilege 4948 msiexec.exe Token: SeSecurityPrivilege 4948 msiexec.exe Token: SeTakeOwnershipPrivilege 4948 msiexec.exe Token: SeLoadDriverPrivilege 4948 msiexec.exe Token: SeSystemProfilePrivilege 4948 msiexec.exe Token: SeSystemtimePrivilege 4948 msiexec.exe Token: SeProfSingleProcessPrivilege 4948 msiexec.exe Token: SeIncBasePriorityPrivilege 4948 msiexec.exe Token: SeCreatePagefilePrivilege 4948 msiexec.exe Token: SeCreatePermanentPrivilege 4948 msiexec.exe Token: SeBackupPrivilege 4948 msiexec.exe Token: SeRestorePrivilege 4948 msiexec.exe Token: SeShutdownPrivilege 4948 msiexec.exe Token: SeDebugPrivilege 4948 msiexec.exe Token: SeAuditPrivilege 4948 msiexec.exe Token: SeSystemEnvironmentPrivilege 4948 msiexec.exe Token: SeChangeNotifyPrivilege 4948 msiexec.exe Token: SeRemoteShutdownPrivilege 4948 msiexec.exe Token: SeUndockPrivilege 4948 msiexec.exe Token: SeSyncAgentPrivilege 4948 msiexec.exe Token: SeEnableDelegationPrivilege 4948 msiexec.exe Token: SeManageVolumePrivilege 4948 msiexec.exe Token: SeImpersonatePrivilege 4948 msiexec.exe Token: SeCreateGlobalPrivilege 4948 msiexec.exe Token: SeBackupPrivilege 1644 vssvc.exe Token: SeRestorePrivilege 1644 vssvc.exe Token: SeAuditPrivilege 1644 vssvc.exe Token: SeBackupPrivilege 896 msiexec.exe Token: SeRestorePrivilege 896 msiexec.exe Token: SeRestorePrivilege 896 msiexec.exe Token: SeTakeOwnershipPrivilege 896 msiexec.exe Token: SeRestorePrivilege 896 msiexec.exe Token: SeTakeOwnershipPrivilege 896 msiexec.exe Token: SeBackupPrivilege 4364 srtasks.exe Token: SeRestorePrivilege 4364 srtasks.exe Token: SeSecurityPrivilege 4364 srtasks.exe Token: SeTakeOwnershipPrivilege 4364 srtasks.exe Token: SeBackupPrivilege 4364 srtasks.exe Token: SeRestorePrivilege 4364 srtasks.exe Token: SeSecurityPrivilege 4364 srtasks.exe Token: SeTakeOwnershipPrivilege 4364 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4948 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 896 wrote to memory of 4364 896 msiexec.exe 94 PID 896 wrote to memory of 5036 896 msiexec.exe 96 PID 5036 wrote to memory of 4380 5036 MsiExec.exe 97 PID 5036 wrote to memory of 4716 5036 MsiExec.exe 99 PID 5036 wrote to memory of 3728 5036 MsiExec.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0oz8zwtl.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4948
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C4DE9F94BC8F917473AC546EA7E44B7E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4380
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\files\install.exe"C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\files\install.exe" /VERYSILENT /VERYSILENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3728
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\files.cab
- Size 1.6MB
- SHA256 3fb44f2533de3106494be7f12fb2a7f3fe9453384385e5b2d489788dbc150bab
- MD5 dde33cc7bc57e73262a9587e6fd2c73b
- SHA1 429a01f8dd68c1d46f32a3a13e4b5051803139a3
- SHA512 31f0d86a3638341e40f949cf9f386abe843afa3a04abe36ac26071b63507a5c19fcc54f594cc280bc1969bed7879163324477027bff0f1a68e5ef09f27b60d66
- SSDEEP 24576:VDys5Rtmi/Bt3O79TqszKlGEa7vFLf2nxh7H7mGVM:5ywtmABg7Qm+GlDFLfax17mn
- TLSH T12B7501D577909027EC8B5C205E47878CA7ADEC94A974744337B6F70E2A7EDA31EA0B04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\msiwrapper.ini
- Size 386B
- SHA256 669288118275ba01ab000cc9326ddc7bbcbb710dd4b55e1f7e2e95d3eb5aa921
- MD5 602e16f742600222795e9b340de2480d
- SHA1 28c40e029c8be5393e5eb4f2f77c817dcec70be4
- SHA512 b61cdbdab7e5afedf7cd1ed2988a77af07b7cbc25e80eb338bb6ca6a27fb51b3d3774d84683ccf3ee1798a14a6c01d425be62e155ded636ea35063b869fb35cc
- TLSH T1C2E0D8553FD4213AB0B38D70EDF154856D3A3C001C51C41C1151910A0DB2E9BDCB133A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\msiwrapper.ini
- Size 1KB
- SHA256 8debfcd6f0bb6cf6021c43ee2e13542126d9f5b64f9eef3c7c1a4c4cee1a5ec7
- MD5 2a633711d12dedec7e53a4c3336a3365
- SHA1 711b24001bebf4e106c1ab5ea1ffffa4d43a59dc
- SHA512 438a24a1722dc736f3bc5b251cc7969116d7d02a44775c69d6b03f2626f0c5a0e6814202a53c6490e2af66e774252ee15913bbdb599faf0037a6b5436ad74e3e
- TLSH T11B11EC246BE81066F6F3AD91EAF55087E66778122C009C0D1096024A0CA2F59ED6273D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MW-e8a0ea5e-303d-4810-b54d-f0226bfc05b8\msiwrapper.ini
- Size 1KB
- SHA256 518f04ac6fef9c4315906a16dbc94e424b20cc97974b1ec1bd163784b1e8b961
- MD5 73d6bed56ebc36f18b8cde78f363fd2e
- SHA1 734df5a083b73254b1cdeccc84571a56496b2923
- SHA512 b4237893979eb307bc0a659d260285c7945b6ccc7864e0dd4fb4a8617e2c149ea1d56a4699d7aa0b0900e55e08dbf5dc5103ddcae984af919c39c5b6b3f91fac
- TLSH T1E0212C206BE81461F6F36EA1FEF560D6DA677C222C10EC1D00C6028A0DB2B49D9B2339
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI5743.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- TLSH T1F1246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 547dfb37b68fc4b128c3c18469f16451ef168d87a8681ba626e2389f8077d63d
- MD5 d6e3b7176fbfd256944bf0a2ca055142
- SHA1 f7bf459f14c747ef3378d129c8b4316c3bfe4368
- SHA512 56926cde1011033cff54717dc6226c94be40c74d5cbc3fff8fe1668cd581c9724b6a554479082a5f6e285e03106285a04b7ec7e895c87d8bb4a7a1c3c0e82ac4
- SSDEEP 24576:2u8m+1zndoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:O
- TLSH T1D347F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d9d3d6a2-0ae7-4e81-9c78-679cfbdd49a1}_OnDiskSnapshotProp
- Size 6KB
- SHA256 413af2f7eb9b70f58d036c85eb24d1a73b952cf1d3941afa160f0f3ce460c6f1
- MD5 6b623bc3dd0f8cf5ef5e26f884b1af17
- SHA1 ba943ebd342969c26111672af5da89c0df7d4fb7
- SHA512 7b546203591426aecbea5a3abe87ba49e126bf4d09fbac1ae4e99a20d9d49b495a84a5e7dcf0db69bdee4ea1c9b0e4a28888ee99e76e326f431e6ab9b146f381
- SSDEEP 96:FpepfF+kvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:6hZb++ZVm
- TLSH T132D19A085AF54711E2B3AB3229F14557A837B911EF33CB8E0198238E6670A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH