Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/06/2026, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
clickhouse-odbc-1.5.3.20260311-powerbi-win64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
clickhouse-odbc-1.5.3.20260311-powerbi-win64.msi
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target clickhouse-odbc-1.5.3.20260311-powerbi-win64.msi
- Size 2.3MB
- Sample260625-phyeeabx31
- SHA256 62dcb8b8dd144f2860397b2447f1e5a199b4a97ad9b55becd1b9420af53222ee
- MD5 7bd80aa15c500bed640b0d8212c86023
- SHA1 6415ea8fd7f4e3413962f293737e2353c7104747
- SHA512 bb277cc51f4085e5962a542b6121a7f633cf9c7f8d33bee4aa81b909083172762bc427f229ddb2c1c8eceb6d49b792c4986a9b2bc8b86d685656d99bfcc97176
- SSDEEP 49152:hV1gmHu9Ks/sDPNG/FJ5CUwGCdPZQOY63lNmWy:b1gmO97/sDPNG/FnIl3QvolNm
- TLSH T19EB523077FC164A2D8560EB7187B8764073DFC288A915A871299729CCFF12D0AF738E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3980 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files\clickhouse-odbc\share\doc\clickhouse-odbc\config\clickhouse-odbc.tdc.sample msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\clickhouseodbc.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\msvcp140_1.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\msvcp140_2.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\msvcp140_atomic_wait.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\vcruntime140_1.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\concrt140.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\msvcp140.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\vcruntime140.dll msiexec.exe File created C:\Program Files\clickhouse-odbc\bin\clickhouseodbcw.dll msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e595ae8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5FE9.tmp msiexec.exe File created C:\Windows\Installer\e595aea.msi msiexec.exe File created C:\Windows\SystemTemp\~DF6135FB3978CC7AE1.TMP msiexec.exe File created C:\Windows\Installer\e595ae8.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF06D5BC399F7E1DC.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D77FCBEA-C3A9-442C-8055-83CBDB57009B} msiexec.exe File created C:\Windows\SystemTemp\~DF69999DE5AA52703A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7684FB924B3D55E7.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3980 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ed6836836fe2a8780000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ed6836830000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ed683683000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ed68368300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ed68368300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1652 msiexec.exe 1652 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3980 msiexec.exe Token: SeIncreaseQuotaPrivilege 3980 msiexec.exe Token: SeSecurityPrivilege 1652 msiexec.exe Token: SeCreateTokenPrivilege 3980 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3980 msiexec.exe Token: SeLockMemoryPrivilege 3980 msiexec.exe Token: SeIncreaseQuotaPrivilege 3980 msiexec.exe Token: SeMachineAccountPrivilege 3980 msiexec.exe Token: SeTcbPrivilege 3980 msiexec.exe Token: SeSecurityPrivilege 3980 msiexec.exe Token: SeTakeOwnershipPrivilege 3980 msiexec.exe Token: SeLoadDriverPrivilege 3980 msiexec.exe Token: SeSystemProfilePrivilege 3980 msiexec.exe Token: SeSystemtimePrivilege 3980 msiexec.exe Token: SeProfSingleProcessPrivilege 3980 msiexec.exe Token: SeIncBasePriorityPrivilege 3980 msiexec.exe Token: SeCreatePagefilePrivilege 3980 msiexec.exe Token: SeCreatePermanentPrivilege 3980 msiexec.exe Token: SeBackupPrivilege 3980 msiexec.exe Token: SeRestorePrivilege 3980 msiexec.exe Token: SeShutdownPrivilege 3980 msiexec.exe Token: SeDebugPrivilege 3980 msiexec.exe Token: SeAuditPrivilege 3980 msiexec.exe Token: SeSystemEnvironmentPrivilege 3980 msiexec.exe Token: SeChangeNotifyPrivilege 3980 msiexec.exe Token: SeRemoteShutdownPrivilege 3980 msiexec.exe Token: SeUndockPrivilege 3980 msiexec.exe Token: SeSyncAgentPrivilege 3980 msiexec.exe Token: SeEnableDelegationPrivilege 3980 msiexec.exe Token: SeManageVolumePrivilege 3980 msiexec.exe Token: SeImpersonatePrivilege 3980 msiexec.exe Token: SeCreateGlobalPrivilege 3980 msiexec.exe Token: SeBackupPrivilege 5460 vssvc.exe Token: SeRestorePrivilege 5460 vssvc.exe Token: SeAuditPrivilege 5460 vssvc.exe Token: SeBackupPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe Token: SeTakeOwnershipPrivilege 1652 msiexec.exe Token: SeRestorePrivilege 1652 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3980 msiexec.exe 3980 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3980 msiexec.exe 1652 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1652 wrote to memory of 5732 1652 msiexec.exe 94 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\clickhouse-odbc-1.5.3.20260311-powerbi-win64.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3980
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5732
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e595ae9.rbs
- Size 16KB
- SHA256 d2dc5ed14f815e26b1b727b0730f9f26d77dba3aea4855759a18019ebb145267
- MD5 b8ad5eef1f422505e23531a732bc9842
- SHA1 e469a97cdf69be4debb29bd0768d19c2b11aa1a3
- SHA512 ac90fc6faed888af647faa588d94d87bf3d076482f1868749ff96efbf2ac7a25620ce883d56c9affb36f6e2496cc3ba96edf215e1ce3be6b03a52e05acb6917f
- SSDEEP 384:NTXDjV63ywnfyMBI7SLU+dtCCESOp9rNr+O6:NTXDjV63ywnfyMBI7SLU+dtCCESOp9xA
- TLSH T18C720341A780C1D2EC266731E7273B143BA7D9EBC71573AF245C93144F4EB8ACBA8586
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e595ae8.msi
- Size 2.3MB
- SHA256 62dcb8b8dd144f2860397b2447f1e5a199b4a97ad9b55becd1b9420af53222ee
- MD5 7bd80aa15c500bed640b0d8212c86023
- SHA1 6415ea8fd7f4e3413962f293737e2353c7104747
- SHA512 bb277cc51f4085e5962a542b6121a7f633cf9c7f8d33bee4aa81b909083172762bc427f229ddb2c1c8eceb6d49b792c4986a9b2bc8b86d685656d99bfcc97176
- SSDEEP 49152:hV1gmHu9Ks/sDPNG/FJ5CUwGCdPZQOY63lNmWy:b1gmO97/sDPNG/FnIl3QvolNm
- TLSH T19EB523077FC164A2D8560EB7187B8764073DFC288A915A871299729CCFF12D0AF738E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 05070c05034e88c45d9583a91aee90774464b6173e6ecc3b497f55c646181201
- MD5 9ba06626a72f4ba5ee325bb7d3c8d227
- SHA1 c196bc864bb6f8625da7f6a5ba6133ed75ce4486
- SHA512 db71a6e88672d41945498b5679fdb8da90276220be68571cf738aef7e307f514c945308f26e51cdefe2df00c22af862c3fcbd9d2f63ca0b8ae174e5b7fb0400f
- SSDEEP 24576:KFo3DMPOdoO/vvTL/iQrLyVwvbOxwLsoUmdJN2Vj9OFKZsaL84xG7CRa/ef:hHk
- TLSH T1A757942436F92100E7F79E3CA8F46A23493ABD5BAC15DE8D45411B4E0922F71E872F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{833668ed-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{19a5507c-159e-44d8-a546-50a6897fba73}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8af435bc9c565210e724a2c9606a48336c3c33ccf3aa9b5108a3799deae2616f
- MD5 c4c409c8bce181155eeda29bda3ed91c
- SHA1 3fa0a6f5e5007bc9b2ba03ed270a869d65a7f167
- SHA512 029c1838b35627d65280284d9269a5344f4250247c4f23814dcdb001c654dfeeb5100355fae4cb1a73038b1f051dc45011da660847d10f0b503408f2c0935d71
- SSDEEP 96:FkuArWvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Wutb++uVm
- TLSH T1BBD177085AF54711E2B3AB7128F14557A877B912EF33CB8E0198238E2631A10F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH