Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 12:16
Behavioral task
behavioral1
Sample
Setup-VirtualPrinter-Client.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup-VirtualPrinter-Client.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target Setup-VirtualPrinter-Client.exe
- Size 11.5MB
- Sample260527-pfsfdads2q
- SHA256 b961ccef4189c379ba4a61319bad26a05a846959f4796ac205eea59ba9d32415
- MD5 2e1758b8998cfb59a2d1599d819344af
- SHA1 eb85597272b52b26a4638029f1f5a12fb2c5ce5b
- SHA512 269ed6732ae9846f82f7aaf95adf552d15c647141b8a8943be6d2427f8d4eb1e88eb652e623548e847cd97a77f7063bf5f0217f1ebb32fe7b57f5f3d6280b7d5
- SSDEEP 196608:kUnoD2fgpyyZsnM0b6Kir0JJTLlKhuNRHbUsZT/qoS/tUTK3b0JA2:krD2CK4YJUENRgeDRY3b8A2
- TLSH T16CC62313B2CBA13EF45E473B01B2A16494FB7761A523ED6687F488ACCF250641E3E647
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
pid Process 4420 Setup-VirtualPrinter-Client.tmp 1116 ftnlsv.exe 4792 vpprint.exe 2312 vpprint.exe 4944 ftnliu.exe 1684 unins000.exe 2748 _unins.tmp - Loads dropped DLL 5 IoCs
pid Process 4728 MsiExec.exe 3748 MsiExec.exe 3748 MsiExec.exe 1116 ftnlsv.exe 4792 vpprint.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FabulaTech Netlink 3 Install Utility = "C:\\Program Files\\Common Files\\FabulaTech\\Netlink 3\\ftnliu.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vpprint = "vpprint.exe" msiexec.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 984 msiexec.exe 3 984 msiexec.exe 4 984 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\vpprint.exe msiexec.exe File opened for modification C:\Windows\system32\FxsTmp\fxsEF8B.tmp vpprint.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlping.exe msiexec.exe File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnliu.exe msiexec.exe File created C:\Program Files (x86)\Setup Virtual Printer Client\unins000.dat Setup-VirtualPrinter-Client.tmp File opened for modification C:\Program Files (x86)\Setup Virtual Printer Client\unins000.dat Setup-VirtualPrinter-Client.tmp File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlapi.dll msiexec.exe File created C:\Program Files (x86)\Common Files\FabulaTech\Netlink 3\ftvchan.dll msiexec.exe File created C:\Program Files (x86)\Common Files\FabulaTech\Netlink 3\ftnlrdp.dll msiexec.exe File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlrdp.dll msiexec.exe File opened for modification C:\Program Files\Common Files\FabulaTech\Netlink 3\ftdcvproxy.json ftnlsv.exe File opened for modification C:\Program Files (x86)\Setup Virtual Printer Client\unins000.dat _unins.tmp File created C:\Program Files (x86)\Setup Virtual Printer Client\is-VJISU.tmp Setup-VirtualPrinter-Client.tmp File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftdcvproxy.json msiexec.exe File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftdcvproxy.exe msiexec.exe File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnldynrdp.dll msiexec.exe File created C:\Program Files (x86)\Common Files\FabulaTech\Netlink 3\ftnlping.exe msiexec.exe File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlsv.exe msiexec.exe File created C:\Program Files\Common Files\FabulaTech\Netlink 3\ftvchan.dll msiexec.exe File created C:\Program Files (x86)\Common Files\FabulaTech\Netlink 3\ftnlctx3.dll msiexec.exe File created C:\Program Files (x86)\Common Files\FabulaTech\Netlink 3\ftnlapi.dll msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF847F2B815EE74789.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B2420649-6EF7-4C09-9D92-0A0A6758D7A9} msiexec.exe File created C:\Windows\SystemTemp\~DFA6E73A36FEE8165C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIDF02.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE240.tmp msiexec.exe File created C:\Windows\Installer\wix{B2420649-6EF7-4C09-9D92-0A0A6758D7A9}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\SystemTemp\~DFD701409C49609868.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIDE74.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE0E7.tmp msiexec.exe File created C:\Windows\Installer\e58a0b4.msi msiexec.exe File opened for modification C:\Windows\Installer\{B2420649-6EF7-4C09-9D92-0A0A6758D7A9}\MyProduct.ico msiexec.exe File created C:\Windows\Installer\e58a0b0.msi msiexec.exe File opened for modification C:\Windows\Installer\e58a0b0.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{B2420649-6EF7-4C09-9D92-0A0A6758D7A9}\MyProduct.ico msiexec.exe File created C:\Windows\SystemTemp\~DF930B8783B784FC69.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _unins.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup-VirtualPrinter-Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup-VirtualPrinter-Client.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unins000.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2156-0-0x0000000000F60000-0x0000000001031000-memory.dmp innosetup behavioral2/memory/2156-14-0x0000000000F60000-0x0000000001031000-memory.dmp innosetup behavioral2/memory/2156-114-0x0000000000F60000-0x0000000001031000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ae741e68cfe5c5110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ae741e680000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ae741e68000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aae741e68000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dae741e68000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED33E315-7AE6-4EBC-95C6-2CBF6250CDE2}\InprocServer32\ = "C:\\Program Files\\Common Files\\FabulaTech\\Netlink 3\\ftnldynrdp.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\Shell_Files_f = "ROOT_RDPprn" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\is-DTIPG.tmp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED33E315-7AE6-4EBC-95C6-2CBF6250CDE2}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\MenuShortCuts_f = "ROOT_RDPprn" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\ROOT_RDPprn msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\Drivers_f = "ROOT_RDPprn" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4A4CE93E4B0C94E4AB0B64973D7B4DA5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\Media\DiskPrompt = "[Manufacturer] [ProductName] Installation [1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\Media\1 = ";Disk 1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\NetLink_CtxRelay = "ROOT_RDPprn" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\ProductIcon = "C:\\Windows\\Installer\\{B2420649-6EF7-4C09-9D92-0A0A6758D7A9}\\MyProduct.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED33E315-7AE6-4EBC-95C6-2CBF6250CDE2}\InprocServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\NetLink_DcvProxy = "ROOT_RDPprn" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED33E315-7AE6-4EBC-95C6-2CBF6250CDE2} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\NetLink_VcRelay = "ROOT_RDPprn" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\NetLink_LoglevelRegKey = "ROOT_RDPprn" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\PackageCode = "6FF93C051B39F704588CE4E571404F72" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\NetLink_ProxyApi_32and64 = "ROOT_RDPprn" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9460242B7FE690C4D929A0A076857D9A\NetLink_Supervisor = "ROOT_RDPprn" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\Version = "17235970" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\PackageName = "Setup-VP-Client.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{ED33E315-7AE6-4EBC-95C6-2CBF6250CDE2}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\ProductName = "Virtual Printer (Workstation) 1.7.2" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4A4CE93E4B0C94E4AB0B64973D7B4DA5\9460242B7FE690C4D929A0A076857D9A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9460242B7FE690C4D929A0A076857D9A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\is-DTIPG.tmp\\" msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4992 msiexec.exe Token: SeIncreaseQuotaPrivilege 4992 msiexec.exe Token: SeSecurityPrivilege 984 msiexec.exe Token: SeCreateTokenPrivilege 4992 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4992 msiexec.exe Token: SeLockMemoryPrivilege 4992 msiexec.exe Token: SeIncreaseQuotaPrivilege 4992 msiexec.exe Token: SeMachineAccountPrivilege 4992 msiexec.exe Token: SeTcbPrivilege 4992 msiexec.exe Token: SeSecurityPrivilege 4992 msiexec.exe Token: SeTakeOwnershipPrivilege 4992 msiexec.exe Token: SeLoadDriverPrivilege 4992 msiexec.exe Token: SeSystemProfilePrivilege 4992 msiexec.exe Token: SeSystemtimePrivilege 4992 msiexec.exe Token: SeProfSingleProcessPrivilege 4992 msiexec.exe Token: SeIncBasePriorityPrivilege 4992 msiexec.exe Token: SeCreatePagefilePrivilege 4992 msiexec.exe Token: SeCreatePermanentPrivilege 4992 msiexec.exe Token: SeBackupPrivilege 4992 msiexec.exe Token: SeRestorePrivilege 4992 msiexec.exe Token: SeShutdownPrivilege 4992 msiexec.exe Token: SeDebugPrivilege 4992 msiexec.exe Token: SeAuditPrivilege 4992 msiexec.exe Token: SeSystemEnvironmentPrivilege 4992 msiexec.exe Token: SeChangeNotifyPrivilege 4992 msiexec.exe Token: SeRemoteShutdownPrivilege 4992 msiexec.exe Token: SeUndockPrivilege 4992 msiexec.exe Token: SeSyncAgentPrivilege 4992 msiexec.exe Token: SeEnableDelegationPrivilege 4992 msiexec.exe Token: SeManageVolumePrivilege 4992 msiexec.exe Token: SeImpersonatePrivilege 4992 msiexec.exe Token: SeCreateGlobalPrivilege 4992 msiexec.exe Token: SeBackupPrivilege 3392 vssvc.exe Token: SeRestorePrivilege 3392 vssvc.exe Token: SeAuditPrivilege 3392 vssvc.exe Token: SeBackupPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeBackupPrivilege 4424 srtasks.exe Token: SeRestorePrivilege 4424 srtasks.exe Token: SeSecurityPrivilege 4424 srtasks.exe Token: SeTakeOwnershipPrivilege 4424 srtasks.exe Token: SeBackupPrivilege 4424 srtasks.exe Token: SeRestorePrivilege 4424 srtasks.exe Token: SeSecurityPrivilege 4424 srtasks.exe Token: SeTakeOwnershipPrivilege 4424 srtasks.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeShutdownPrivilege 3748 MsiExec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe Token: SeRestorePrivilege 984 msiexec.exe Token: SeTakeOwnershipPrivilege 984 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4420 Setup-VirtualPrinter-Client.tmp 4992 msiexec.exe 4992 msiexec.exe 2748 _unins.tmp - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4792 vpprint.exe 4792 vpprint.exe 2312 vpprint.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2156 wrote to memory of 4420 2156 Setup-VirtualPrinter-Client.exe 81 PID 4420 wrote to memory of 4992 4420 Setup-VirtualPrinter-Client.tmp 82 PID 984 wrote to memory of 4424 984 msiexec.exe 87 PID 984 wrote to memory of 3332 984 msiexec.exe 89 PID 984 wrote to memory of 4728 984 msiexec.exe 90 PID 984 wrote to memory of 3748 984 msiexec.exe 91 PID 984 wrote to memory of 4792 984 msiexec.exe 93 PID 4420 wrote to memory of 1684 4420 Setup-VirtualPrinter-Client.tmp 99 PID 1684 wrote to memory of 2748 1684 unins000.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup-VirtualPrinter-Client.exe"C:\Users\Admin\AppData\Local\Temp\Setup-VirtualPrinter-Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\is-PQT75.tmp\Setup-VirtualPrinter-Client.tmp"C:\Users\Admin\AppData\Local\Temp\is-PQT75.tmp\Setup-VirtualPrinter-Client.tmp" /SL5="$60096,10982159,798720,C:\Users\Admin\AppData\Local\Temp\Setup-VirtualPrinter-Client.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\msiexec.exe"msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-DTIPG.tmp\Setup-VP-Client.msi" ALLUSERS=1 /qb+3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4992
-
-
C:\Program Files (x86)\Setup Virtual Printer Client\unins000.exe"C:\Program Files (x86)\Setup Virtual Printer Client\unins000.exe" /VERYSILENT /noinstancecheck3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp"C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp" /SECONDPHASE="C:\Program Files (x86)\Setup Virtual Printer Client\unins000.exe" /FIRSTPHASEWND=$5011A /VERYSILENT /noinstancecheck4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2748
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8179AF64D9CDB13BA76021C8A0D1CD992⤵PID:3332
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8A2076187A20609D2B11B1BB23BB7D782⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4728
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 397B7DA4FA4DA55F7E8C07A70E5F5B42 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
C:\Windows\system32\vpprint.exe"C:\Windows\system32\vpprint.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4792
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlsv.exe"C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlsv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1116
-
C:\Windows\system32\vpprint.exevpprint.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312
-
C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnliu.exe"C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnliu.exe"1⤵
- Executes dropped EXE
PID:4944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2352
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a0b3.rbs
- Size 2.0MB
- SHA256 2b8cb1ed8bc2ebdcea2cc617ffd50e78eafa87d898faa5229f6e8e3543a4214d
- MD5 2793cdd863793ee7a9e3d2cdffbce82f
- SHA1 7a9259b5b03119e5622b0d69dcd4d6b0a3a115a7
- SHA512 26139714b0913e240addd722177417565bbec6905d3856992bae86982577dfe956cab3bb7ff40f6ff9c1c8554060af105132c474250b8f312595e1d91304b7de
- SSDEEP 49152:5MWq6ncRCsLFDqbzrsohN88asxg9VXk9s3BCH1fpbUbDaQEwzb44VHvmnUIm:TncBDMPsohu8pxg9VXasRO3KDaQ3zb46
- TLSH T13BA5AF213A90C07AD67F3630551AB7BEA7BDE5700E38C58752D0CE7D3E315829A2876B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Setup Virtual Printer Client\unins000.dat
- Size 8KB
- SHA256 fc70f806dcff71e24336fffb6b9324c6e2ce36e7d5abb73e8e15a9780678c9fc
- MD5 327a0ec86d4ef8560f805f0056922659
- SHA1 8bdbd456ed0e231e13d4c44d8b3839d6cd9cb44b
- SHA512 c9ba45ddf9f8ef60e07d94c92e9b43305a9a8c5080e654a85de97cac89de6249102e21953ff9d4c911fe6105b5dc2793c1e27372f9bcd6fdc96cf257bf4a783a
- SSDEEP 96:9zNU01K5keScW264lho5fpvOj2Ojb6yB8xBs3ujLKAXme9CjW9bcuJlEDA4MZAeB:9z/1KsElONMjmxJ/ewbP4DSmdHpe
- TLSH T173028C4CAFEC9A19F1FAC735ED7702143732BD81EA35E60D235D821E2427B14989633A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Setup Virtual Printer Client\unins000.exe
- Size 3.3MB
- SHA256 07f0f76b3faf9a3a72e5022e682e6686f964cdf5822f0018ab276aff52dbc5ef
- MD5 9dce3ad3348144ff74053201e6a51a5e
- SHA1 e654d952d8ceb5e80e53ec9f9cd2cebbd03e2c10
- SHA512 d27de894d15ee0fd1a1253fc55f8400192d09a1dec89a8cd5d439b98f81b3b19c4a74f90177e95c0a45315838efb6e4c61b1fa23bbdbe78cdab864dc310503e0
- SSDEEP 49152:hiE8NvQCX7lF4RQSxPodbxsl7IwDksRinJwj9LaDjppz0oohs333s+:hiE8OQMlIwDkZqBLo333R
- TLSH T187F55C23F34D603EF06A1A399D379658583B7A606926CC5797FC3A4C8F361402E3A75B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\FabulaTech\Netlink 3\ftdcvproxy.json
- Size 279B
- SHA256 4ed8ca0d545a22db4c67ef2fbcae0ff691315ed15b2277d067fac810aec28786
- MD5 895d556f286e2ec37d87fe0739d22282
- SHA1 c5f45e0db7a0ae5bb7243436e4ded156baa06d1e
- SHA512 97f418fcf288ce4c15a6a977360f6fb92aafe850e50b0c028203f094bbd487101a44cf6d8baf2c1decccec291a3d0f7bb5a8e22441be035d5aafb7bf236cb709
- TLSH T15ED02B6EE824D83CDC7911C6899C270224D64F4B6F103001774D058E9F1C70FD26A094
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlapi.dll
- Size 2.0MB
- SHA256 6c25d0a6595c69426bb131a2633b9f7724e9f77ccfa71bea0cb2910f250af2b1
- MD5 7c325019e7db1fe511e341ab25bdac1c
- SHA1 6cb6084400932b243f1fa85604886750c2adaf1a
- SHA512 a3273f3a3b49ae3efefdf9f8d7ed3fa146fba553bf64b2129e8533de532775fcb89936cafbd5ca3753c8f16ffefdda41a390f481d061623411d2c76764d0aa4b
- SSDEEP 49152:+54dz0IxRYLXjQnXBz8zsZrEaoRoA2tPXkU019+RBZ:+UeL5zurdoRUJkU01iBZ
- TLSH T14AA57B56A7A805F4D9BAC37CC953951BE3F2B81513709BDF06A046BA0F23BE1163E718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnliu.exe
- Size 99KB
- SHA256 0c6d5b6f206d299245eedb3f5489b8fa7d4bbf0bb79b6c20f36d6c7533c9bfd7
- MD5 9998f0fea068bc866b493c7c72492535
- SHA1 5e10c33d2b28e9c1bceaeb885489f8df3843e3eb
- SHA512 186a4bbf211cc4bad6180a0e2f9ee4f38785fe03decc0ae312994a5e7cef74ea3a862813c3c5b7ad72045f128c9920ac70e846c5fe7134ef9d3a087014c1cef7
- SSDEEP 1536:yHHMfIK/K4JxGYWu3ssu5rHtEqXxCMhsWOdc9dlJbdjOm+SCYjoUFxx:IMfIUKwxouPCNEavQUVjOm+SCYjoU1
- TLSH T113A36B47B3E018E5E1738A38C9A15509E776F8260B218FEF036442961FA7BC19D3AF31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\FabulaTech\Netlink 3\ftnlsv.exe
- Size 708KB
- SHA256 13fe320cb1e5169596c4de2bc014a146ed9831930808c41573381e7db4429e04
- MD5 8e2651a38e5e192e69e6a2f20028fbcc
- SHA1 a15f7f4e56cddf8cffd9c48ab1c06b2b84119a1a
- SHA512 4fe927f4d3d6cb94ab2bed21a8cd769136d78091b4f855f5d3b8ba693fad6a0f93464308b42d8a885086091eeb59d76a5ea1da0ee3d6801a56e9fcb4edcd90bf
- SSDEEP 12288:T+Oto8Zr1WLIeIjD8plkkj9yVwmloDZ3qEdooxxVO0orGx89tugJ:T5R1Wc0lkkjYamlShdooLVO0mGxitugJ
- TLSH T1CDF4F7256BF805A4E0B7D67AD9778542EA72BC560B31CADF0250822F1F23BD58D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-DTIPG.tmp\Setup-VP-Client.msi
- Size 8.0MB
- SHA256 d3375a5baae4fc7686793c928de1df1feaff8af7cbb097a50be4036629c57497
- MD5 9ee4910c344b064c0dae692bd159d30a
- SHA1 c24b3a6499427a4c22e8637be32ed76d6309be5d
- SHA512 2130a3818b658c386e65b42df8ed3aa75bef643f47731bef774094dc397ae7aba071be36a89f2ffb7f9372d5383bf919249b419f8b60048a786df72fc0fd1a43
- SSDEEP 196608:igfzVn1QHLYJ6TOg+q2MUiCwrqbTKhFN9d/9FROKj3zb44x:fzVRgFhvrJjN/13LjT
- TLSH T1E68602113680C47AD57A2230D12BF7BD67BEEDB20A35C14712D0FE3EFA71681992865B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-PQT75.tmp\Setup-VirtualPrinter-Client.tmp
- Size 3.3MB
- SHA256 e8819b199fa7adb306b939f325e363abe01194cd0d5fcb24e8478bc71313334a
- MD5 d835459beb76d83b427037bee648b7c7
- SHA1 16ec8d77cf017cb0a1e8b8a140e251c92123e0c9
- SHA512 1cbfe887f482ab05b66e80eaaf6db2d47ea4e16d19ec35691730d10b4cd3b1e17be349feac49029bcd2dd0eeed24296420e98b1eef3e8c165d26eba2ae95ffe5
- SSDEEP 49152:5iE8NvQCX7lF4RQSxPodbxsl7IwDksRinJwj9LaDjppz0oohs333so:5iE8OQMlIwDkZqBLo333p
- TLSH T1CDF55C23F34D603EF06A1A399D379658983B7A606916CC5797FC3A4C8F361402E3A75B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIDF02.tmp
- Size 211KB
- SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
- MD5 a3ae5d86ecf38db9427359ea37a5f646
- SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
- SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
- SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
- TLSH T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE0E7.tmp
- Size 1.8MB
- SHA256 5beeb6322255bc037c1fac921f77fea44e44905739e08d7fad2f7f41bdf4ebb6
- MD5 391004980865d070aca5c540d4565a0d
- SHA1 69b70da5d1d75197c54ef5340fd814cb1be96a02
- SHA512 72832e0c470ce428bbf58bbe891b027ea9d2885b5445de3df028b65d959ad3b69ee4746f8342a9ea390d345b115540b3d23af2975f88cb838ebaec6ce96678dc
- SSDEEP 49152:wMWq6ncRCsLFDqbzrsohN88asxg9VXk9s3BCH1fpbUbDaQEwzb44VHv:IncBDMPsohu8pxg9VXasRO3KDaQ3zb48
- TLSH T1E4859D213A90C07AD67F3630551AB7BEA3BDE5700E39C58762D0CE7D3E31582992876B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\vpprint.exe
- Size 3.9MB
- SHA256 c10089c17b54cb18aa6c7fea5a293897f94518bf9e43fa31645bd1f2ad23c437
- MD5 a8ef7824b09212e3f44c060f591ccc18
- SHA1 5ce6500838c8714a9651ca1c2131bb5682f1b2e3
- SHA512 e3b0819b46e526899c1334bb31201ce221e48dc67c87b187e07b7d16d8e35f1d215d8e09058cfaba86b7ae5e4b990e004ce2835928b6f33ea17e6dd8644b1241
- SSDEEP 49152:D7dXEEfqatR46dWCrHzo+U69qF3i2QyOH30s/ndK:9HiG6wqFSyOX0s/
- TLSH T1D6164B8567EC84D4E0A6C178C637951BEBF2BC930A31D24F00A5BA5F2F776A14D29732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 8bad29eb2764e01ac127aa240d6f1b5dc362c261416891a0cc07748a87c8a815
- MD5 d44eef9fae8a923a79a8d2f6471132fa
- SHA1 ab9a479fcdc47eb1da3f6358d72c218b2e3b434c
- SHA512 ac741b70056f59fa55c98448129a59e3ebb9a2e118d883ab3622d570af82e048b6e1aab84c0e5e7a538fc5ed0c52e99b5556170d149c0899770ef5a77a05bd20
- SSDEEP 24576:V2gmSp1gdoO/vvTL4WzOR0X6PqZoQ4nZGWANHJkzq4KYkv3244i0LeZEh:k
- TLSH T1EB47F32437F92200E7F39E7CA8F46A23493A7D5B9C15DE8D45411B8E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{681e74ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4aff4ace-0cf3-44d6-b100-c87c5338d2e9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d2bbab3de8913633411661621938f37052cd0b91c18b9ed7a236eeee78556378
- MD5 53207945e3ebda19d5c6cfd513456634
- SHA1 1debe8aae3189a2d6a8557560eb8dd3628344a6f
- SHA512 0fed1188ece3aa5912f6c803e68ee8bf6a6db93670910eb5da2492ffa7bba0cbaa81ca50625770bc48e4133c6bf61630d39efce89dcf1bbb70c3f9f2953d3a3b
- SSDEEP 96:FZlGIFvc8DD84LTHzbOHXOHBlBRQI+8Sc9XE56tOSVQpu:zFb++aVm
- TLSH T1A4D179185AE54711E2F3AB7128F54547A877B911EF33CB8E0198238E2630910F975F9B
- MD5 SHA1 SHA512 SSDEEP TLSH