Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp0jph_fbs.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp0jph_fbs.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp0jph_fbs.msi
Resource
win11-20260513-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target tmp0jph_fbs.msi
- Size 1.7MB
- Sample260601-rr253ahs8q
- SHA256 4350994cb7d895bba32b6ec2c3163df6e6214ade3877d87c6f2dea3e00d48300
- MD5 7b833268dee98259f782a52292fb7e19
- SHA1 b9932f874985181ae9b91719e855fb7e34a41d4e
- SHA512 645d450ccfa6b7c0d38ca60507b0376baee02fc72d3afd670b937ab40692f8d238f6225c23438e7bb6a5e0b2430bf4fcdce740b0e867051930071eae03d7c52b
- SSDEEP 49152:zViAhnMAuCt4Af3tv38J0535m+TvC6D2Vnd:55MOp/f535bTvC6CVd
- TLSH T1628533003AF1D368D78016B47D5F03EB9A1A4D1E4B55D927F1C23B8AA07BEB2909E357
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\kkvscanv5
-
inject_dll
%windir%\SysWOW64\pla.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral3/files/0x001900000002b4d2-60.dat family_hijackloader - Executes dropped EXE 2 IoCs
pid Process 1404 ReSwitch32.exe 4128 ReSwitch32.exe - Loads dropped DLL 3 IoCs
pid Process 1404 ReSwitch32.exe 1404 ReSwitch32.exe 1404 ReSwitch32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7EFF.tmp msiexec.exe File created C:\Windows\Installer\e587e45.msi msiexec.exe File created C:\Windows\SystemTemp\~DF174B3497171CE721.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF731708B374FF72C7.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{A6C8EAE0-4130-4D64-A86A-CA5CAB2889FF} msiexec.exe File created C:\Windows\SystemTemp\~DF74566798D38CFA6E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFCF7AF12B1FF00EB9.TMP msiexec.exe File created C:\Windows\Installer\e587e43.msi msiexec.exe File opened for modification C:\Windows\Installer\e587e43.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4012 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReSwitch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReSwitch32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000643a9eb9192046c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000643a9eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900643a9eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a643a9eb9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d643a9eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3912 msiexec.exe 3912 msiexec.exe 1404 ReSwitch32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4012 msiexec.exe Token: SeIncreaseQuotaPrivilege 4012 msiexec.exe Token: SeSecurityPrivilege 3912 msiexec.exe Token: SeCreateTokenPrivilege 4012 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4012 msiexec.exe Token: SeLockMemoryPrivilege 4012 msiexec.exe Token: SeIncreaseQuotaPrivilege 4012 msiexec.exe Token: SeMachineAccountPrivilege 4012 msiexec.exe Token: SeTcbPrivilege 4012 msiexec.exe Token: SeSecurityPrivilege 4012 msiexec.exe Token: SeTakeOwnershipPrivilege 4012 msiexec.exe Token: SeLoadDriverPrivilege 4012 msiexec.exe Token: SeSystemProfilePrivilege 4012 msiexec.exe Token: SeSystemtimePrivilege 4012 msiexec.exe Token: SeProfSingleProcessPrivilege 4012 msiexec.exe Token: SeIncBasePriorityPrivilege 4012 msiexec.exe Token: SeCreatePagefilePrivilege 4012 msiexec.exe Token: SeCreatePermanentPrivilege 4012 msiexec.exe Token: SeBackupPrivilege 4012 msiexec.exe Token: SeRestorePrivilege 4012 msiexec.exe Token: SeShutdownPrivilege 4012 msiexec.exe Token: SeDebugPrivilege 4012 msiexec.exe Token: SeAuditPrivilege 4012 msiexec.exe Token: SeSystemEnvironmentPrivilege 4012 msiexec.exe Token: SeChangeNotifyPrivilege 4012 msiexec.exe Token: SeRemoteShutdownPrivilege 4012 msiexec.exe Token: SeUndockPrivilege 4012 msiexec.exe Token: SeSyncAgentPrivilege 4012 msiexec.exe Token: SeEnableDelegationPrivilege 4012 msiexec.exe Token: SeManageVolumePrivilege 4012 msiexec.exe Token: SeImpersonatePrivilege 4012 msiexec.exe Token: SeCreateGlobalPrivilege 4012 msiexec.exe Token: SeBackupPrivilege 4164 vssvc.exe Token: SeRestorePrivilege 4164 vssvc.exe Token: SeAuditPrivilege 4164 vssvc.exe Token: SeBackupPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe Token: SeTakeOwnershipPrivilege 3912 msiexec.exe Token: SeRestorePrivilege 3912 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4012 msiexec.exe 4012 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3912 wrote to memory of 1100 3912 msiexec.exe 86 PID 3912 wrote to memory of 1404 3912 msiexec.exe 88 PID 1404 wrote to memory of 4128 1404 ReSwitch32.exe 90 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0jph_fbs.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4012
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1100
-
-
C:\Users\Admin\AppData\Local\Odontophore\ReSwitch32.exe"C:\Users\Admin\AppData\Local\Odontophore\ReSwitch32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\ProgramData\kkvscanv5\ReSwitch32.exeC:\ProgramData\kkvscanv5\ReSwitch32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4128
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e587e44.rbs
- Size 8KB
- SHA256 1335fe8a31850837f5a70a7c224db0d0d75e317d2dd4a20eed62f5747aa876c2
- MD5 1dd0b83ad79bf6896cd494a8de822c4c
- SHA1 c6fe6a1cff83b1cf2b6b49bc4453b9d58176b8d4
- SHA512 737b207e8364ae605f10dcd2d474bd0b4253d0d478bc0a991377ae1b7f3a9fe85976570991bbb50f695a39b5204966be2467519cb1b1f31da910037e17b952e2
- SSDEEP 96:t+DcJw+Yivm3hCrtdts2WUsrzX4CsThqoWUsrzX4C6jRntxtfrThqaHAFVHt0QuX:t+xXCmQqXPITqXPynr8p4
- TLSH T1FC027441BA10CAC2FB1E2731D6932B24F772D2EEC691B34754DCA1388F12A9C8F595C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Odontophore\Nisbrock.oots
- Size 1.2MB
- SHA256 cfd43097cab091ffcbcf2cfff6210234263ac76428c808b71495498896e2e0e0
- MD5 a1c81c8a7f1659cb159c2288d5a7d935
- SHA1 8f48d0560a898e374a0421e7197d94ee1ad0b065
- SHA512 d7f9932b16be535484237c080aad042c4fc485d761604dcc3a8fe09df8eb6ed947c99feeaeaaeae131c147f02c1ec474be649e7ee26394298b96c19cc8cca305
- SSDEEP 24576:d6ntJ0q2QR0U6RWCAPBuLfTopIaFNzDfGzNYwwV1+:knLfR0U6RyBuL7SDN/uxYh1+
- TLSH T1084512C64AAB8973C4E2AB78258FD53309B6C8D4F6CD87C3FC14164741CEC6A768EA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Odontophore\Pungnis.ygg
- Size 81KB
- SHA256 638396b08e9637b564c4ac45650b9bb7d6f0f428214d1e3bc3c7354f8e34326a
- MD5 ed79ea450544fd53b26c39e1e119d9d1
- SHA1 207fbd6a710f894765a1c563d564e9b4f3c1fa6c
- SHA512 fba96670c318eed30ab71a78ce323644d24ccb37dd6248b5333416b1b455f5dccdd55ef3232b06f97432a73252c99d07f44e4e58392aaf66855b19ea9fc45f35
- SSDEEP 1536:LrhdAqHVoJ0g50CWd+uisjZCeL++nzkJLEJUmXjlRC3po2C:LFGQCqisjZCeL++nYJqUmXxRgU
- TLSH T11083CAB167BD2F5AF523BD3A85C0F5679949B9762626C0D5E9830B1F802DC90CE70B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Odontophore\ReSwitch32.exe
- Size 335KB
- SHA256 0f8fce66dfed696d8a39b985036b2932f1157400075293d60e9d1c9c408f3274
- MD5 5137d6601d2e51f3954b1161aa0b35bd
- SHA1 975c36ce8a5672f0f4400526d920b469fb4c37dc
- SHA512 7df638ef72da4947aa5db505b3d74b09856277354e9c18598c3d24ffc8d199ca81bfe871e159d80ad3dc2f5b2e1badc07c96f55b597095592b953820b0fc3f5d
- SSDEEP 6144:n+9mDgcrhARZ5e+HG+nIC53gZM3npTmu09jB79BwNq7O:n+mDKLrHpICuZim39jp9BMq7O
- TLSH T14D748D01BEB0847AE6A6863DD4BAA7630EF9BF510B3045D7A3803D69F83C2D15539727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Odontophore\ies_Core.dll
- Size 1.1MB
- SHA256 a1e25a2c47ec4bb00e6f65e98278bd34c1dacf495623a0141cb877ef6f937f45
- MD5 f5ffb214783fd403cc6bc2f771a73709
- SHA1 ffe90ec2857d3018dbce16926f96eeda4f5c6135
- SHA512 962bcd499f588d42d812475bb617fbaea91b754f398cb75f61808182cdcc085f07638d022dd37e5982d234a589cba7335f11d39bcf67d12da58d4d3c9f29b283
- SSDEEP 24576:AcFvpHsz+jFmXWrg5S3pB0Lo7ungBXQli/nP19BHM7N:zXHVjFmb5S3pB0U7unOXc+nPO
- TLSH T149456C81BA82A2B1EA6E1DB05125FF97813EBB90D1D4C2F779C40C7A5E03ED643B3651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Odontophore\ies_Netw.dll
- Size 150KB
- SHA256 19068d94c8314ddc21e15aa7983c3d4703df14c18eb150d4fff2dd3a70bbad89
- MD5 8cb02f24f5d21baaa13a1da980dcec68
- SHA1 9b5afc4267266533735b5e3356719a0b14759d1b
- SHA512 54f33c5a44a03dfa1cd808aedb499f8205b301afb1c5b9c5a82bd739388ae3a2f2556f05ae74fc9d8f6c869a60851559b0e2d4920b9d49929b254744549e32da
- SSDEEP 3072:Ol1ffgnLGR0CzPKf1Gxg47sSz4r/9jBciy27QglBJAglMW7K:OnfgyR0CA134r4BdY279BJND7K
- TLSH T1C3E38D207981D0B2E5BE2D3814A5C7A20F3EB960DF745CE763A4116D4E742E16F39B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e587e43.msi
- Size 1.7MB
- SHA256 4350994cb7d895bba32b6ec2c3163df6e6214ade3877d87c6f2dea3e00d48300
- MD5 7b833268dee98259f782a52292fb7e19
- SHA1 b9932f874985181ae9b91719e855fb7e34a41d4e
- SHA512 645d450ccfa6b7c0d38ca60507b0376baee02fc72d3afd670b937ab40692f8d238f6225c23438e7bb6a5e0b2430bf4fcdce740b0e867051930071eae03d7c52b
- SSDEEP 49152:zViAhnMAuCt4Af3tv38J0535m+TvC6D2Vnd:55MOp/f535bTvC6CVd
- TLSH T1628533003AF1D368D78016B47D5F03EB9A1A4D1E4B55D927F1C23B8AA07BEB2909E357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 b14f707a068383ac7f074bb8cce2f312dedf8b1b559215b5064e07bc13316de0
- MD5 6a47ffc3af32aa1bac7b5a7a5f8749cf
- SHA1 ce42d91cd528d46d5aee582e6e67699d51eed05d
- SHA512 b7776fca61944ad126618772f918dd4361def29ba13677340cb1f0a16ded66cc5edeaff055993288ea99c099f42e8b98df275b1c56eac68f8fc5931140b04137
- SSDEEP 24576:+2gmSp1fdoO/vvTLaWxOBk3afqpaA4Fr22CN3JEBYK6YktF046AWrMr2x:s
- TLSH T13F47C22436F92210E7F79E3CA8F06A234A3E7D5B9C15DE8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{b99e3a64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f9aeba14-54bf-4cf1-8aca-c56d5372295c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 acb1d9b7ec60dea73544860d4cab01d502aab5c883253ae09cb132649ce5cc69
- MD5 9a07123cadb935dbbbaf27f3150f6bd0
- SHA1 5db603a7aed81c78d1229042e0dc45ab7759370f
- SHA512 ca56d321ede5e613f492a9de21eac5ff54b314bb2ff41f27b87c2a6233ec62cc8cf3da90fe2c35f8cb63752cd0eb28456cc1cf0d17a51bbe49a5013a6907c86b
- SSDEEP 96:FOM8tpavc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:sjgb++ZVmN
- TLSH T1EED188085AF54311E2B3AB3129F58557A877B911EF33CB8E0298238E6670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH