a943c34695bb9326b96a93bbbbf5c1bd038c4ec08bce85998781f2fb20bb3753

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lsa_v1.2.2_20251208_windows_x86-installer.msi
Size 12.9MB
Sample260629-e18yracz9t
SHA256 a943c34695bb9326b96a93bbbbf5c1bd038c4ec08bce85998781f2fb20bb3753
MD5 ecc7a662f55f72aaca05df3f5415ac3a
SHA1 d44d7f167ffeb53dc172d368e627195e2c8caa38
SHA512 233b1f3ef01fc990e33c0621b58657f85c9d87bf3db8024f0e668c207148a9291fecb4dc2d9307ff8af5e0602a1eb863b75d44d8fc314f336c0c7b9e273c84f0
SSDEEP 393216:oblY31leYuq/yk054mm19XPCXfZsQnuJ:obqllefTADP/CPZf
TLSH
T158D633852627178EF02F44B24CBB026897AAED391722805D77597DC2FFF37A2B1A7111
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3544	lsa.exe

Loads dropped DLL 2 IoCs

pid	Process
3544	lsa.exe
3544	lsa.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2628	msiexec.exe
7	2628	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LSA\bin\wintun.dll	msiexec.exe
File created	C:\Program Files (x86)\LSA\bin\wpcap.dll	msiexec.exe
File created	C:\Program Files (x86)\LSA\bin\lsa.exe	msiexec.exe
File created	C:\Program Files (x86)\LSA\bin\Packet.dll	msiexec.exe
File created	C:\Program Files (x86)\LSA\bin\sscronet.dll	msiexec.exe
File created	C:\Program Files (x86)\LSA\bin\WinDivert.dll	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587a0d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{98D5BF44-8456-49F3-8150-40C8B415C286}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B65.tmp	msiexec.exe
File created	C:\Windows\Installer\e587a0f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e587a0d.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2628	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsa.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4356	taskkill.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	lsa.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	lsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	lsa.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\ProductName = "LSA"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\PackageCode = "65EAF94DB0ADDD240A3E33441B324456"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44FB5D8965483F941805048C4B512C68\Environment = "Binaries"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Version = "16908290"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Media\DiskPrompt = "LSA Installation"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Media\1 = ";CD-ROM #1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44FB5D8965483F941805048C4B512C68	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE6AE30145179C54C8AF5BBC9C92C44F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\PackageName = "lsa_v1.2.2_20251208_windows_x86-installer.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE6AE30145179C54C8AF5BBC9C92C44F\44FB5D8965483F941805048C4B512C68	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44FB5D8965483F941805048C4B512C68\Binaries	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2628	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2628	msiexec.exe
Token: SeSecurityPrivilege	3232	msiexec.exe
Token: SeCreateTokenPrivilege	2628	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2628	msiexec.exe
Token: SeLockMemoryPrivilege	2628	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2628	msiexec.exe
Token: SeMachineAccountPrivilege	2628	msiexec.exe
Token: SeTcbPrivilege	2628	msiexec.exe
Token: SeSecurityPrivilege	2628	msiexec.exe
Token: SeTakeOwnershipPrivilege	2628	msiexec.exe
Token: SeLoadDriverPrivilege	2628	msiexec.exe
Token: SeSystemProfilePrivilege	2628	msiexec.exe
Token: SeSystemtimePrivilege	2628	msiexec.exe
Token: SeProfSingleProcessPrivilege	2628	msiexec.exe
Token: SeIncBasePriorityPrivilege	2628	msiexec.exe
Token: SeCreatePagefilePrivilege	2628	msiexec.exe
Token: SeCreatePermanentPrivilege	2628	msiexec.exe
Token: SeBackupPrivilege	2628	msiexec.exe
Token: SeRestorePrivilege	2628	msiexec.exe
Token: SeShutdownPrivilege	2628	msiexec.exe
Token: SeDebugPrivilege	2628	msiexec.exe
Token: SeAuditPrivilege	2628	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2628	msiexec.exe
Token: SeChangeNotifyPrivilege	2628	msiexec.exe
Token: SeRemoteShutdownPrivilege	2628	msiexec.exe
Token: SeUndockPrivilege	2628	msiexec.exe
Token: SeSyncAgentPrivilege	2628	msiexec.exe
Token: SeEnableDelegationPrivilege	2628	msiexec.exe
Token: SeManageVolumePrivilege	2628	msiexec.exe
Token: SeImpersonatePrivilege	2628	msiexec.exe
Token: SeCreateGlobalPrivilege	2628	msiexec.exe
Token: SeBackupPrivilege	4800	vssvc.exe
Token: SeRestorePrivilege	4800	vssvc.exe
Token: SeAuditPrivilege	4800	vssvc.exe
Token: SeBackupPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2628	msiexec.exe
2628	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 972	3232	msiexec.exe	99
PID 3232 wrote to memory of 3544	3232	msiexec.exe	104
PID 3232 wrote to memory of 4356	3232	msiexec.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\lsa_v1.2.2_20251208_windows_x86-installer.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:972
- C:\Program Files (x86)\LSA\bin\lsa.exe
  "C:\Program Files (x86)\LSA\bin\lsa.exe" activate --silent --installer C:\Users\Admin\AppData\Local\Temp\lsa_v1.2.2_20251208_windows_x86-installer.msi --cwd C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\system32\taskkill.exe
  taskkill.exe /IM lsa.exe /F
  2⤵
  - Kills process with taskkill
  PID:4356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e587a0e.rbs

Path C:\Config.Msi\e587a0e.rbs
Size 9KB
SHA256 2408ec1c177d35d881c515eee4b34ed74c82cb72005d7df782456a0b5cd928ea
MD5 31c33574ca3ec900cf279b1e196a4404
SHA1 8208ba3ea6d33b30999633da7a4d8606c2d3b118
SHA512 adccb594cfc3b5cf7481737cf4aef01f7b0fdb4671564acdd33fd886af4ce5cdd9584d88b7043ec99fe22dac2b91bf8daaf9f1ef969ce7afd6ced17577cf11cb
SSDEEP 96:uXjTvf9Om5pbPGi5TvG2UQe+dJpUOQBCsThqAoUOQBC6jAIIkrThqANHIM5JF+5a:uTjVai9OxQe6iB0I7B0jglsOw1+pyT29
TLSH
T1C1124342A300C1D2F9975731C70737A63373C3E99F006BAB0ADC81611E977D90F99A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\Program Files (x86)\LSA\bin\WinDivert.dll
Size 212KB
SHA256 f21221989f1e55981b9606ec9ca83efd1365998d8a02ed4fee9ff84620fedb5b
MD5 e7d415ff7ca1c673c16a8854a0d4a94f
SHA1 b745f70ababfa186ce34d297e6e3c775c818d979
SHA512 6e93196da70d4f18964fd8700dfa08230c612ba01a860aea83ce6efda077307478e540899aa9eebc7564de37992b4b9af44b730d72c78101ac1da54c16ba1087
SSDEEP 3072:WvZ0eEzl2ToT7nIk0eTH/FjzpgvIeLC0fHzkkqMQWV9Ty3zZygDgmq1O19AIk:WvkUOnIk0y8W0MM3i3bW
TLSH
T118247D0272D24589F9E285746AF4A3676A3ABFA157B3D6CF1EC0581E0E317D1BD34322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsa.exe

Path C:\Program Files (x86)\LSA\bin\lsa.exe
Size 21.0MB
SHA256 7305ba18b573d5691648477fa7f269ca62645af1b788ea59edc55a813653aafe
MD5 150d5bcf197468e37c4a68b72a14c4a4
SHA1 fa96f1dcb72900ffd28fe2801bca6f9299225fe2
SHA512 deb2a4546e922638f3b05b815765251d32e22e97e96c24cdf143e64a38a6b0d4a2e9b650b8757afc8e6ab09998482aec3aca67c3f2c008f902fe61c654478e43
SSDEEP 393216:9xfr0D9hOwMsCskJWnrfrkgvetTcdbZrhFRQs5r6:9xyOwet4FhF6
TLSH
T1BD275B127B42A0FBC18B42B0F11EA33C9F73551997158EE3C6949EB85CB93D12D36A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscronet.dll

Path C:\Program Files (x86)\LSA\bin\sscronet.dll
Size 7.5MB
SHA256 5dc5390e03c42808b59186aa41375364e39bdeae3b31569710d4fcaf7634953e
MD5 a0cfb62adf914d63f43187af67d33c82
SHA1 cc8da96e8ca84e7ed99b381bb7e969fee75ed65d
SHA512 6b5aa8d0f16e5e29da686afb5f1cd228125e57eea53e4e7cdb69e5bc6dab685ee7b77eefeab99dad67c24c75b6b0536d0cde6f2c26f8ed03fff35d291d57bfb1
SSDEEP 196608:xCMsE71PAFB0t8c7jPV65H8wxeYZ+AZ0kgtaO33:xHsI1m0f/PV65H8wx5bKkgtJ
TLSH
T168769D42F4925078CC4721B2342EB73D9A3407458F388DEBC795ADA57FB02D32A7769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preference.db

Path C:\ProgramData\LSA\cache\preference.db
Size 4KB
SHA256 14948fa5e2d8f2d2f9d9f9349a2626f275b36c870d724b183d7c9216d676f20e
MD5 9732e4a0ce6fc561f0243041ffd78e3b
SHA1 33a7125e1431398266491d3c2e4ed3ed8eb454f9
SHA512 862636d8240b45c4d36a7af6670b62cc811d09b942ca7a9a6a0c596681a2ac091814a8ada2e2f026193f8bce293eda118e485566a75de221678378939d569ad9
TLSH
T16B810240634000E1D09406B3549213081A06D59495510B231515005288815445860A84
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 6c1318c7b905767ea106718f8583a5eb592e7614e114b6df1c4ba52ff3c15af2
MD5 b04cf67b6e06d96d5bd55bcb8d25c2ad
SHA1 31468319cfe89a2a33ba162837a72bb1f64a7ddb
SHA512 fe76625c6d5f68a4fb024e413f6fdae45c415ffb1c1d0506923eb810f277bb73b4dcf0bcffcc1458606bfa6a939ff1f9988ef79a4b0adec905a804df5dd34b84
TLSH
T1FAF0DC7F38FB25B929928A7C3FF849BA60F5128E16D2815362700AC6526E8D17B4A425
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_22ADCFA11103A7C4A7B83478078F3A67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_22ADCFA11103A7C4A7B83478078F3A67
Size 727B
SHA256 06b84418ccb3afdfb6efd0ab88b7fdb98d4573bd400b9b230857552a6796c00a
MD5 2d7b75d6c3982fbe3d21a0eb58e1dc9b
SHA1 9da848ca5df10f6e3c0cdc8b5d464801a4e9fa92
SHA512 5137b7f8542820658c6b37e1da29442530a7678f55fbf5bd8d0a71b9198c4337d48219ad7e06829b3fb63f4298423bd99dbbfd91f43ed01d3872d4d363519612
TLSH
T1EC01940B2AFCFB1019029CE84BDDE27EBE32E9622A4D584B305E4109A2807807DF5B65
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 ad4a20aeff6d5ec18cb275d87ee12f7e42574b315365ce84496a0d4973d69c8a
MD5 00e7255ae3f1ea924beb09a9ab0596f4
SHA1 b0858fc1ea402631bc03d403cff6a17175491100
SHA512 ab72dbc14b6861ef42341546cd4eb3b96aae9f32c6a1c8041634451dff16a8725e810a76794179d47784d34c6c606fae5bdcbab6bd32df829b9724ffc4940853
TLSH
T14501650269F857823D259889DBFCD1D0349D89970484061219A141AF466CD432E3F76D
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 152c92d1deea81d3a0621ff19c003a41097a29f0bd17941d4bbe33765cf6b6f9
MD5 5c1bda9bb3dc1e5eec3a4cce32cdc43b
SHA1 57c37fa4dc97a183b69f04ef891ae728a0456f50
SHA512 bc56c6395fceea8cfbf1db355b9684637dac45f2d5cc583564b0d1584170040f6c77b28dbccd799658c7ad8250bcbc42875b8888169d2c963cf43ddb0b09991d
TLSH
T113E0202027FF102EF1B45B7403E991D5EF25F1163C9456BF1ED1281D9919A004C52C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_22ADCFA11103A7C4A7B83478078F3A67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_22ADCFA11103A7C4A7B83478078F3A67
Size 404B
SHA256 06ae5d4667d31d52ec71eb804f5fae1496c6f1577f41ddb8fd50f0957e80230a
MD5 404dc6a3f1a446c4796aabac01fe4f8c
SHA1 aebcfef42865a48ed487bddc7134ed79b4a16840
SHA512 533428ea6f6e91c0063232a7b47b3e2405a31b0ba80cb2dcadc998dffcb379081c09e35dd401288d40139856b84235fc81696a8082aa407eb31ca6fea9d5df7e
TLSH
T10CE0C03421F9069DF1F4E53842EA9D610895F10B5441C3BA03404356EE08B404C92634
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 713468bb32f3950cdb78445858eefb029a0abe3e4d4c668c893c8efed6f1e7c5
MD5 d544ea45e4e386728530c176b55ff0d8
SHA1 bf82e487fe7d23c87143d2f127491fcd77adc894
SHA512 cd5d590a6a07666c1c8b61bae6c99dc503b135096f134632dc5861d0ad7d278842272d83c6140d6c273bf57183cf86db2ff66e6b3239d24d638c253a0d862520
TLSH
T12BE0C03C25EFB49EF1509C3142FAA2720D48F315240093B806D0431CFB0AF405C10EF4
MD5 SHA1 SHA512 TLSH

Submit Download

e587a0d.msi

Path C:\Windows\Installer\e587a0d.msi
Size 12.9MB
SHA256 a943c34695bb9326b96a93bbbbf5c1bd038c4ec08bce85998781f2fb20bb3753
MD5 ecc7a662f55f72aaca05df3f5415ac3a
SHA1 d44d7f167ffeb53dc172d368e627195e2c8caa38
SHA512 233b1f3ef01fc990e33c0621b58657f85c9d87bf3db8024f0e668c207148a9291fecb4dc2d9307ff8af5e0602a1eb863b75d44d8fc314f336c0c7b9e273c84f0
SSDEEP 393216:oblY31leYuq/yk054mm19XPCXfZsQnuJ:obqllefTADP/CPZf
TLSH
T158D633852627178EF02F44B24CBB026897AAED391722805D77597DC2FFF37A2B1A7111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 b0cf8263ec2f29cdccb6dbe9db30130c284323396fa45cc007b94494eed0d559
MD5 744778d6339481a55d67d6ef54d8a064
SHA1 870e9eede5204589c38def1ad0671b67ff73a413
SHA512 5f8f2374a842fbe4d35a1ad1425dd910b100949314524e1a69a20d6b6c2a9d68924d58623e071faacd8aaddb8c7e4253c0e21912883e098b3b54a67f1252b553
SSDEEP 24576:iu8m+1zEdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:d
TLSH
T1D547D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9330374d-3fb4-43c3-9206-36b5f7d8a4fd}_OnDiskSnapshotProp

Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9330374d-3fb4-43c3-9206-36b5f7d8a4fd}_OnDiskSnapshotProp
Size 6KB
SHA256 963eb6ca51642839cf07a7063a3f48221b9cff473633cccc491f85560332c155
MD5 fcd463a687e8f2c5303351235e49f714
SHA1 6e06e37e6449b2000fcc9b471e3fa884da7e530a
SHA512 9aa4e5888eb8df50ea1c8c465b00363537782c9f4318bfded77577b60e8debc6b2283440db75179578950f5407eb863fe12099e2fe1ed07a888120a1e18e4a46
SSDEEP 96:F7wAhdDyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:qslIb++ZVm
TLSH
T183D188185AF54311E2B3AB7228F18557A877B911EF33CB8E0198638E2670910F975F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads