Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/05/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp0oz8zwtl.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp0oz8zwtl.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp0oz8zwtl.msi
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target tmp0oz8zwtl.msi
- Size 1.9MB
- Sample260518-2mrtmsdx4w
- SHA256 7b939d1d59b370c836fea6703a254127de36ac0259538809535bb136b6725c72
- MD5 bdc8b7229eaa7473c25a37f08ba79189
- SHA1 9699c8b0f0235bae5285a80b3e3b8c447d2aad0c
- SHA512 1332bfad5da5c8fce17cf374ff1012831744e3e69cea4b87607eb9dc95b6ebc51c91a6766ee186d5ee8a5e027111ec74a644bd470fb891c60240239f727b3e17
- SSDEEP 24576:kt9cpVDhI6DDys5Rtmi/Bt3O79TqszKlGEa7vFLf2nxh7H7mGV:jpRhFnywtmABg7Qm+GlDFLfax17m
- TLSH T1449578D13784C027E84B09314E67C79D976DFCA4AA30B08737B0BB6E5A3A9D39E64741
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1760 install.exe - Loads dropped DLL 1 IoCs
pid Process 5924 MsiExec.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 656 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\e586c32.msi msiexec.exe File opened for modification C:\Windows\Installer\e586c32.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF64431B8340647807.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6D9A.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{C0815896-DCF1-4D15-BCAD-6F5C47806CBD} msiexec.exe File created C:\Windows\SystemTemp\~DFC8BCA68963B3B6C8.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4272 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7671573c6f2ce060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b76715730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b7671573000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab7671573000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7671573000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5016 msiexec.exe 5016 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 5016 msiexec.exe Token: SeCreateTokenPrivilege 4272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4272 msiexec.exe Token: SeLockMemoryPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeMachineAccountPrivilege 4272 msiexec.exe Token: SeTcbPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 4272 msiexec.exe Token: SeTakeOwnershipPrivilege 4272 msiexec.exe Token: SeLoadDriverPrivilege 4272 msiexec.exe Token: SeSystemProfilePrivilege 4272 msiexec.exe Token: SeSystemtimePrivilege 4272 msiexec.exe Token: SeProfSingleProcessPrivilege 4272 msiexec.exe Token: SeIncBasePriorityPrivilege 4272 msiexec.exe Token: SeCreatePagefilePrivilege 4272 msiexec.exe Token: SeCreatePermanentPrivilege 4272 msiexec.exe Token: SeBackupPrivilege 4272 msiexec.exe Token: SeRestorePrivilege 4272 msiexec.exe Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeDebugPrivilege 4272 msiexec.exe Token: SeAuditPrivilege 4272 msiexec.exe Token: SeSystemEnvironmentPrivilege 4272 msiexec.exe Token: SeChangeNotifyPrivilege 4272 msiexec.exe Token: SeRemoteShutdownPrivilege 4272 msiexec.exe Token: SeUndockPrivilege 4272 msiexec.exe Token: SeSyncAgentPrivilege 4272 msiexec.exe Token: SeEnableDelegationPrivilege 4272 msiexec.exe Token: SeManageVolumePrivilege 4272 msiexec.exe Token: SeImpersonatePrivilege 4272 msiexec.exe Token: SeCreateGlobalPrivilege 4272 msiexec.exe Token: SeBackupPrivilege 5296 vssvc.exe Token: SeRestorePrivilege 5296 vssvc.exe Token: SeAuditPrivilege 5296 vssvc.exe Token: SeBackupPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeBackupPrivilege 5128 srtasks.exe Token: SeRestorePrivilege 5128 srtasks.exe Token: SeSecurityPrivilege 5128 srtasks.exe Token: SeTakeOwnershipPrivilege 5128 srtasks.exe Token: SeBackupPrivilege 5128 srtasks.exe Token: SeRestorePrivilege 5128 srtasks.exe Token: SeSecurityPrivilege 5128 srtasks.exe Token: SeTakeOwnershipPrivilege 5128 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4272 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5016 wrote to memory of 5128 5016 msiexec.exe 84 PID 5016 wrote to memory of 5924 5016 msiexec.exe 86 PID 5924 wrote to memory of 656 5924 MsiExec.exe 87 PID 5924 wrote to memory of 2012 5924 MsiExec.exe 89 PID 5924 wrote to memory of 1760 5924 MsiExec.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0oz8zwtl.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4272
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5128
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADABB419B6F9871B67C7C3B5FC3B610C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-048d9666-91a0-4040-be2a-ca288fd42c6b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:656
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\MW-048d9666-91a0-4040-be2a-ca288fd42c6b\files\install.exe"C:\Users\Admin\AppData\Local\Temp\MW-048d9666-91a0-4040-be2a-ca288fd42c6b\files\install.exe" /VERYSILENT /VERYSILENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-048d9666-91a0-4040-be2a-ca288fd42c6b\files.cab
- Size 1.6MB
- SHA256 3fb44f2533de3106494be7f12fb2a7f3fe9453384385e5b2d489788dbc150bab
- MD5 dde33cc7bc57e73262a9587e6fd2c73b
- SHA1 429a01f8dd68c1d46f32a3a13e4b5051803139a3
- SHA512 31f0d86a3638341e40f949cf9f386abe843afa3a04abe36ac26071b63507a5c19fcc54f594cc280bc1969bed7879163324477027bff0f1a68e5ef09f27b60d66
- SSDEEP 24576:VDys5Rtmi/Bt3O79TqszKlGEa7vFLf2nxh7H7mGVM:5ywtmABg7Qm+GlDFLfax17mn
- TLSH T12B7501D577909027EC8B5C205E47878CA7ADEC94A974744337B6F70E2A7EDA31EA0B04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MW-048d9666-91a0-4040-be2a-ca288fd42c6b\msiwrapper.ini
- Size 1KB
- SHA256 7b2e36c93b4c0d4b2771ee2ecdb1a80354a1b84826bb1eeded4309fc38d20a75
- MD5 38b9e5d2a990dd8bd9df384159baff10
- SHA1 79ab63a9ab6e99bee08fcb4419eadabb82b6914f
- SHA512 95801643be73d3d4f533ff8af38852ea9b081be5b47ec541f655b624000f032a14ae14b98934683cd559ca77859e206b4328c43b6ce20a06759642d777f8c835
- TLSH T132210715ABE91029F6B3AEA5FEF19093EE767C223C10DC1D40C1034A09B2E55ED7273A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI6D9A.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- TLSH T1F1246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 9be40065877432bba1cf8d47b6de92379e8c0ac7305650d917b3a668b7e669f1
- MD5 4c75796cab5feeec8ca40dbd3f7b348c
- SHA1 eba613a58adb47a93c99589d18cca71f0fc1dddc
- SHA512 1c43c9d3877442a1f63563f854ee6d4a8481665715af75f73e67bf10a116034c91a5947143ae62e5d06691503c1bab77358ee9da47147031d84a519aa7d5d463
- SSDEEP 24576:v2gmSp1+doO/vvTL5GSOh0nq/6p5Q4242WhdXJkC7J6oEeGHI5TVrPI1h:g
- TLSH T15B47A42436F92100E7F79E3D78F06A27493A7D5B9C15DE8D45411B8E0921BB0E8B2F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{731567b7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4e2b0c6a-f9e8-4eb8-b572-f1caf7545240}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4e95fe3e2c625ef98a505928be9f6826c7efc208ae64904c8fcf2ea9667915d2
- MD5 152834a959e7a0976509705142c93934
- SHA1 ad37184b6aaeeecc70d0e5670bd11d2763c5d23a
- SHA512 2b9ebf8e1380aebcd6dca89cee168ea92cc3aca8ec12d6d2ac6dd099a29bcd7d4dd9e202c188b6056c5a010704c403c1c1f7b71eed53da9262ea5d86b0c503e4
- SSDEEP 96:FpdpHIEvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:N3b++ZVm
- TLSH T1E0D188185AE54711E2B3AB3129F14557A877B811EF33CB8E0198638E2670A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH