Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 12:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Movie Maker 6.0 (64-bit).msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Movie Maker 6.0 (64-bit).msi
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Movie Maker 6.0 (64-bit).msi
- Size 11.0MB
- Sample260620-p37htagt7w
- SHA256 3240f2d30e0057215f26b2ab66e14c5f77769295c98eea62f077444bc0b2fa4b
- MD5 f87fd01d1dcf6249362eddcfdd706acc
- SHA1 d50a6d7834bc16eafaa2457d0a147d4e612b820c
- SHA512 25b773174ea1d955642ac699365de8c5e5b172df6f311f758a6c3aa5f910bdc92e4eb2163ee5e4793be9916327086d6ff453edce9f2fc00d5d923a9d433e00e6
- SSDEEP 196608:3U0Gv1NeUA1kxGCExa/nzc1Z7t1iMsDOP7UqXrUc/im3Pi6gAcYOc4PJzyklL45L:3U0INAkxQOzc19Ui7UqXrfwNYONH09eE
- TLSH T125C63323F2A7953AD62D3135160F83B04B333D288925A547596B7A4C3CF7A807AF36E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\e582769.msi msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3592 msiexec.exe 3592 msiexec.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeShutdownPrivilege 3796 msiexec.exe Token: SeIncreaseQuotaPrivilege 3796 msiexec.exe Token: SeSecurityPrivilege 3592 msiexec.exe Token: SeCreateTokenPrivilege 3796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3796 msiexec.exe Token: SeLockMemoryPrivilege 3796 msiexec.exe Token: SeIncreaseQuotaPrivilege 3796 msiexec.exe Token: SeMachineAccountPrivilege 3796 msiexec.exe Token: SeTcbPrivilege 3796 msiexec.exe Token: SeSecurityPrivilege 3796 msiexec.exe Token: SeTakeOwnershipPrivilege 3796 msiexec.exe Token: SeLoadDriverPrivilege 3796 msiexec.exe Token: SeSystemProfilePrivilege 3796 msiexec.exe Token: SeSystemtimePrivilege 3796 msiexec.exe Token: SeProfSingleProcessPrivilege 3796 msiexec.exe Token: SeIncBasePriorityPrivilege 3796 msiexec.exe Token: SeCreatePagefilePrivilege 3796 msiexec.exe Token: SeCreatePermanentPrivilege 3796 msiexec.exe Token: SeBackupPrivilege 3796 msiexec.exe Token: SeRestorePrivilege 3796 msiexec.exe Token: SeShutdownPrivilege 3796 msiexec.exe Token: SeDebugPrivilege 3796 msiexec.exe Token: SeAuditPrivilege 3796 msiexec.exe Token: SeSystemEnvironmentPrivilege 3796 msiexec.exe Token: SeChangeNotifyPrivilege 3796 msiexec.exe Token: SeRemoteShutdownPrivilege 3796 msiexec.exe Token: SeUndockPrivilege 3796 msiexec.exe Token: SeSyncAgentPrivilege 3796 msiexec.exe Token: SeEnableDelegationPrivilege 3796 msiexec.exe Token: SeManageVolumePrivilege 3796 msiexec.exe Token: SeImpersonatePrivilege 3796 msiexec.exe Token: SeCreateGlobalPrivilege 3796 msiexec.exe Token: SeBackupPrivilege 4328 vssvc.exe Token: SeRestorePrivilege 4328 vssvc.exe Token: SeAuditPrivilege 4328 vssvc.exe Token: SeBackupPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeBackupPrivilege 116 srtasks.exe Token: SeRestorePrivilege 116 srtasks.exe Token: SeSecurityPrivilege 116 srtasks.exe Token: SeTakeOwnershipPrivilege 116 srtasks.exe Token: SeBackupPrivilege 116 srtasks.exe Token: SeRestorePrivilege 116 srtasks.exe Token: SeSecurityPrivilege 116 srtasks.exe Token: SeTakeOwnershipPrivilege 116 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3796 msiexec.exe 3796 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3592 wrote to memory of 116 3592 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Movie Maker 6.0 (64-bit).msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3796
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:116
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 910c2486f8c7994a6d45caa7d277be9d4b1d332e42b05c0a5d4cdb4d2737ab3a
- MD5 358dda341e2d3d835fda66f54a0f8b99
- SHA1 9c227c85b4ed7e523d9d5582047fb26350170558
- SHA512 1136ae79263e3d14a308f304ef120d79cf969277d260503653aacda28c93c41658dc35f703d0365898b5b93eeeea9431b6188e2c0c6c631dc9fce69282aeca93
- SSDEEP 24576:Ou8m+1z+doO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:L
- TLSH T12747C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f252b85f-b57a-47b4-9c8b-ee84ffbc9d9d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 3cf936faf3ba96f71393d3ec9fdfca29aa7423621fd893184d92564a2e01a318
- MD5 c749c7c68dd077e152b6673c48b26120
- SHA1 39bf134373157b4aad37486b7350c1f18c4cc61d
- SHA512 e15f081d8d4c4274ef7f070026f983320948d1c6579d04dcc5f7ba80c7ff5c43a3c4b15e75f21e6d32787daa1586270665399f776c700846b561e4d6827e86e7
- SSDEEP 96:FIDUc4snvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:2Dbb++ZVm
- TLSH T191D199085AF54311E2B3AB3229F54557A877B911EF33CB8E0298638E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH