Analysis
- max time kernel
45s - max time network
50s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 04:20
Static task
static1
Behavioral task
behavioral1
Sample
putty-64bit-0.84-installer.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
60 seconds
Behavioral task
behavioral2
Sample
putty-64bit-0.84-installer.msi
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
60 seconds
General
- Target putty-64bit-0.84-installer.msi
- Size 3.7MB
- Sample260628-eyc4asfs3x
- SHA256 190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b
- MD5 20777e8868965ffcc9ce2ff4b12f6651
- SHA1 83acc3eee50675ef211969c14b8545652d05e8ed
- SHA512 edd36fab83d469765cc88546e0a91175fa80884ad79216d1673a907ee4438e5094ba6db828c01d413b6cf6c87f38aa5e65df54565f46de49d294e6cc6a5e85a6
- SSDEEP 98304:j8+rY0FMAm3b5OFQ05gd+qruxFdy9m8WQFKK9Ht4:jzFwb5BdNu37QcT
- TLSH T1CA061213B889C139EC361971CD8F9EEA1A387D603D514C07B7A97E0DECB1690A76335A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 6092 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4360 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files\PuTTY\putty.chm msiexec.exe File created C:\Program Files\PuTTY\LICENCE msiexec.exe File created C:\Program Files\PuTTY\pscp.exe msiexec.exe File created C:\Program Files\PuTTY\putty.exe msiexec.exe File created C:\Program Files\PuTTY\README.txt msiexec.exe File created C:\Program Files\PuTTY\pageant.exe msiexec.exe File created C:\Program Files\PuTTY\plink.exe msiexec.exe File created C:\Program Files\PuTTY\psftp.exe msiexec.exe File created C:\Program Files\PuTTY\puttygen.exe msiexec.exe File created C:\Program Files\PuTTY\website.url msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFBDB2E5DAB69F2B65.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF128965273A589A2D.TMP msiexec.exe File created C:\Windows\Installer\e59c886.msi msiexec.exe File opened for modification C:\Windows\Installer\e59c886.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{FEE89B49-1A47-476C-864C-1D5076FC2891} msiexec.exe File opened for modification C:\Windows\Installer\MSICD2A.tmp msiexec.exe File created C:\Windows\Installer\{FEE89B49-1A47-476C-864C-1D5076FC2891}\installericon.exe msiexec.exe File opened for modification C:\Windows\Installer\{FEE89B49-1A47-476C-864C-1D5076FC2891}\installericon.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4360 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c0864d100437b2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015c0864d10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015c0864d1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35c0864d100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65c0864d100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3704 msiexec.exe 3704 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4360 msiexec.exe Token: SeIncreaseQuotaPrivilege 4360 msiexec.exe Token: SeSecurityPrivilege 3704 msiexec.exe Token: SeCreateTokenPrivilege 4360 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4360 msiexec.exe Token: SeLockMemoryPrivilege 4360 msiexec.exe Token: SeIncreaseQuotaPrivilege 4360 msiexec.exe Token: SeMachineAccountPrivilege 4360 msiexec.exe Token: SeTcbPrivilege 4360 msiexec.exe Token: SeSecurityPrivilege 4360 msiexec.exe Token: SeTakeOwnershipPrivilege 4360 msiexec.exe Token: SeLoadDriverPrivilege 4360 msiexec.exe Token: SeSystemProfilePrivilege 4360 msiexec.exe Token: SeSystemtimePrivilege 4360 msiexec.exe Token: SeProfSingleProcessPrivilege 4360 msiexec.exe Token: SeIncBasePriorityPrivilege 4360 msiexec.exe Token: SeCreatePagefilePrivilege 4360 msiexec.exe Token: SeCreatePermanentPrivilege 4360 msiexec.exe Token: SeBackupPrivilege 4360 msiexec.exe Token: SeRestorePrivilege 4360 msiexec.exe Token: SeShutdownPrivilege 4360 msiexec.exe Token: SeDebugPrivilege 4360 msiexec.exe Token: SeAuditPrivilege 4360 msiexec.exe Token: SeSystemEnvironmentPrivilege 4360 msiexec.exe Token: SeChangeNotifyPrivilege 4360 msiexec.exe Token: SeRemoteShutdownPrivilege 4360 msiexec.exe Token: SeUndockPrivilege 4360 msiexec.exe Token: SeSyncAgentPrivilege 4360 msiexec.exe Token: SeEnableDelegationPrivilege 4360 msiexec.exe Token: SeManageVolumePrivilege 4360 msiexec.exe Token: SeImpersonatePrivilege 4360 msiexec.exe Token: SeCreateGlobalPrivilege 4360 msiexec.exe Token: SeCreateTokenPrivilege 4360 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4360 msiexec.exe Token: SeLockMemoryPrivilege 4360 msiexec.exe Token: SeIncreaseQuotaPrivilege 4360 msiexec.exe Token: SeMachineAccountPrivilege 4360 msiexec.exe Token: SeTcbPrivilege 4360 msiexec.exe Token: SeSecurityPrivilege 4360 msiexec.exe Token: SeTakeOwnershipPrivilege 4360 msiexec.exe Token: SeLoadDriverPrivilege 4360 msiexec.exe Token: SeSystemProfilePrivilege 4360 msiexec.exe Token: SeSystemtimePrivilege 4360 msiexec.exe Token: SeProfSingleProcessPrivilege 4360 msiexec.exe Token: SeIncBasePriorityPrivilege 4360 msiexec.exe Token: SeCreatePagefilePrivilege 4360 msiexec.exe Token: SeCreatePermanentPrivilege 4360 msiexec.exe Token: SeBackupPrivilege 4360 msiexec.exe Token: SeRestorePrivilege 4360 msiexec.exe Token: SeShutdownPrivilege 4360 msiexec.exe Token: SeDebugPrivilege 4360 msiexec.exe Token: SeAuditPrivilege 4360 msiexec.exe Token: SeSystemEnvironmentPrivilege 4360 msiexec.exe Token: SeChangeNotifyPrivilege 4360 msiexec.exe Token: SeRemoteShutdownPrivilege 4360 msiexec.exe Token: SeUndockPrivilege 4360 msiexec.exe Token: SeSyncAgentPrivilege 4360 msiexec.exe Token: SeEnableDelegationPrivilege 4360 msiexec.exe Token: SeManageVolumePrivilege 4360 msiexec.exe Token: SeImpersonatePrivilege 4360 msiexec.exe Token: SeCreateGlobalPrivilege 4360 msiexec.exe Token: SeCreateTokenPrivilege 4360 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4360 msiexec.exe Token: SeLockMemoryPrivilege 4360 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4360 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4360 msiexec.exe 3704 msiexec.exe 6092 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3704 wrote to memory of 6092 3704 msiexec.exe 90 PID 3704 wrote to memory of 988 3704 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\putty-64bit-0.84-installer.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4360
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8C6BD4FDFE14E5BBE60C35B2288D6928 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6092 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\PuTTY\README.txt3⤵PID:5268
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:988
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c887.rbs
- Size 12KB
- SHA256 1102358b8e91e0332327cbffc956be4caa141854235eb7b4f4b26a54305fe72a
- MD5 d8afcf6afd50e55aed7727f95fac600c
- SHA1 799f78bd8cef72a5a772a23fd9b49a1f5a91f5e9
- SHA512 cfd92587b3c74952ff9ef503eda28dd52884ad4824b063ed8dfa5eb2db014b620336ed50dc850fe28926a1a654978aa0a23e47059a56a89b12ffe024073f42ef
- SSDEEP 192:aQFOcmohQM5yrnsNdVfMxGKC7OT7IiT7m5HkkYLa7YsdpX:aMOcmohQM5yrnodZOTzTFC
- TLSH T1E6427342A745D7D2F9522B31C70B07627BB3E3EA9315239F10CE61289F537C80F6648A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PuTTY\README.txt
- Size 1KB
- SHA256 11bdf4f12d34f617cf81f0c30aef7b596dbd00d0d19cf9e3c2e4648d672b3809
- MD5 6cf727766580b6019becca7e62c49e70
- SHA1 6842fa969ca4a83a8780e59b75bd30d8859917c1
- SHA512 0710ad72f032f54946b089aed10dc3da00f54d9bf835e09cd6fcc90603afb2ca91a6efd0a496b71d51275828f545996885a8718468d69edb45bd4070234b9234
- TLSH T1C031E12F6FEE93F52C55D6D63389D637C201A11843321072785FC048B6AA366E3AE0BD
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)\PuTTY.lnk
- Size 1KB
- SHA256 bd1ecb07ea6b316a611f8f2112283cfd188b4ee5f3d0f73962dbe2031989ac7a
- MD5 4e1844aa6c881c558bd891f16d1a0106
- SHA1 1149f48c050a25f94ae98327108a88fb2ad60893
- SHA512 30d3f1e4f8f0fcacdd7b9bda3b6a3ca8ed38e10c22a284fadea29bf0b4ea052b0ea81a0e4f17912202b1a4d2a40cbb6da7b8dfce203abf7817c79edba5f13784
- TLSH T11211C2424B961FA4E367E171555647725B37FC47F758472A85C845CC1C78000995CFAB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)\PuTTY.lnk~RFe59ce72.TMP
- Size 945B
- SHA256 acc1d5827992aaa2a551652d343db0431e2f6b8cb5d4b17f480882b4a3ff0133
- MD5 99018b43ea00fa664afaf0596587c147
- SHA1 b322f013906ff50950f4bd78a10a6c37e10984ff
- SHA512 27a5bbf1d88ca28922c5337b78c111739cd25356c97a95b9dc296d131c59083acd9d3bc7166d2343d40219df5f8b6568d83816e74706aa0ca27992b28acf2e31
- TLSH T16611D0464F921F78E367D175955B47B29B37FC07E758072B85C845CC18B8000AA6CFAA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7526.tmp
- Size 102KB
- SHA256 097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef
- MD5 d9ac1b56edf330a6eb7894ab293f14f6
- SHA1 022d8944e3927fff2b330dab54716ddcbb366d16
- SHA512 e434410e2b2c2bb1fba4f3fc7c277b978c45b1df1d3c3994d6dc1530558393d7d42a713506bf95d013b2e40e9da36fd3e588fea8d8dc062a24ad931e4d76c328
- SSDEEP 3072:6SucbZHLGhmArwB2l9sv69okpLPpxVXpj:aoZ6Zrw0Lrv
- TLSH T1E6A38D21B0C0C172D9BF2D3D4574D6650BBFB830EEA59EAB635402691EB81C0BE35E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID633.tmp
- Size 199KB
- SHA256 fb7a6eb19d1d1042d3bd8b3add9271116b8b6db3714dfcc0b6fee8e088d4a2cc
- MD5 3a4e61909500d677745ef2ab508f3f3b
- SHA1 ee398e1a153ca96c2592816eb8e8b2b7bb845e1e
- SHA512 feba07bba5007a20e0a1e2ca8c9050ae8624e8fbb0f24aada5dc7c2bde3be561b844453a573cab2a24c3769a8dba401db4eeef0d22ef86e2109b67e54392ee45
- SSDEEP 3072:/gCUXX2mXSRH48su9/3wvGxtKyHcas3AOOjflQnERfjqmmQ+cx3XD:/gCgPwYo9/3RtKvasQr2L
- TLSH T11B148D3175D4803DE6FB1932A66EE270AE7DF1142764C59E83848C1FADA40D16BB3B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c886.msi
- Size 3.7MB
- SHA256 190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b
- MD5 20777e8868965ffcc9ce2ff4b12f6651
- SHA1 83acc3eee50675ef211969c14b8545652d05e8ed
- SHA512 edd36fab83d469765cc88546e0a91175fa80884ad79216d1673a907ee4438e5094ba6db828c01d413b6cf6c87f38aa5e65df54565f46de49d294e6cc6a5e85a6
- SSDEEP 98304:j8+rY0FMAm3b5OFQ05gd+qruxFdy9m8WQFKK9Ht4:jzFwb5BdNu37QcT
- TLSH T1CA061213B889C139EC361971CD8F9EEA1A387D603D514C07B7A97E0DECB1690A76335A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 2fbf9310f5d251e4842ac6185d94c7cecc2b57fba315d57791daf4594576d794
- MD5 9510f4a7b31254b9867d536a39a7dd5d
- SHA1 d6a3776f6ddb74c6f7fa8f5558ecb75ea4b18589
- SHA512 05935aae8368bd62117a0ebf351a4e0b7f19e4f23e30ab38253d3f260d7d3c2ce714a05c4c4c9d8998cae79326209c9a789caaf1a717a93750410d3e7f332a4e
- SSDEEP 24576:gFo3DMP2doO/vvTL/iA7bSlgvr+xwLcY0GdJNW1jtu1a5MKr84h2bCx6fuf:/HU
- TLSH T11157A12436F92600E7B79E7CACF06A234D3A7D5B9C15DE8D45411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2054f851-15e1-4c15-81e9-bac8d9798fbd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 75de466d6ca69b1b90ddd81e01e871e9c5f45a9e4aedc47741732b0d974dcafa
- MD5 3d347d7d88b2c5e980f2c8783557effd
- SHA1 ac228e9c42572ad2061318a5e98c72db47bd4919
- SHA512 fe5a69b7cd7a5db2bd424ebaa2bbba1062629a8a169904ec48246c3586b76f48ed82440c675426fe5c1d864e3503542e5f458aa1ac7e67b1245d2bec6694e675
- SSDEEP 96:FFLDupvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:D4b++uVm
- TLSH T113D187085AF54711E2B3AB712CF18557A877B911EF33CB8E0198238E6631A14F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH