Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/07/2026, 15:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zinst.6638258013.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
zinst.6638258013.msi
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
38 signatures
150 seconds
General
- Target zinst.6638258013.msi
- Size 7.9MB
- Sample260706-tc67kshv41
- SHA256 6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002
- MD5 7c78cd36b7dbcb2d7aec1afb683e5ce7
- SHA1 81d801ae7cce4e54fb070258e5878227fb87c8c0
- SHA512 ea8639c4e8e82ddfaeb338abc5c10fda56789d904e682e722f10584f55c48c258278851b2520f63c47cbe51db48ff80ba4d53640a669786344690c8eef135c1f
- SSDEEP 196608:dVDuo39jPbm/hnkr+1n++NFUjbPKRbH9aU:dVDuoNTbm/6k/acbdD
- TLSH T1D08633867CCB29B2F403C7B09893622E33667FC58DB84D0976DE775C2C721259DBA246
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\V3Bc3s = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation RUkakP.exe - Executes dropped EXE 1 IoCs
pid Process 2556 RUkakP.exe - Loads dropped DLL 2 IoCs
pid Process 2236 MsiExec.exe 2556 RUkakP.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\V3Bc3s\\RUkakP.exe\"" RUkakP.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 41 2236 MsiExec.exe 43 2236 MsiExec.exe 56 2236 MsiExec.exe 58 2236 MsiExec.exe 60 2236 MsiExec.exe 71 2236 MsiExec.exe 81 2236 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4292 cmd.exe 2484 cmd.exe 3360 cmd.exe 4804 cmd.exe 3344 cmd.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b RUkakP.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\qVvIqa\qVvIqa.exe RUkakP.exe File opened for modification C:\Program Files (x86)\qVvIqa RUkakP.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI9267.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92E5.tmp msiexec.exe File created C:\Windows\Installer\e58916d.msi msiexec.exe File opened for modification C:\Windows\Installer\e58916d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754} msiexec.exe File created C:\Windows\Installer\e58916f.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3588 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "B50AEA4D15B89FE4CB09FF3F37D561EA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "zinst.6638258013.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000 msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3088 schtasks.exe 4444 schtasks.exe 2540 schtasks.exe 4204 schtasks.exe 2808 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 60 msiexec.exe 60 msiexec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe 2556 RUkakP.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3588 msiexec.exe Token: SeIncreaseQuotaPrivilege 3588 msiexec.exe Token: SeSecurityPrivilege 60 msiexec.exe Token: SeCreateTokenPrivilege 3588 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3588 msiexec.exe Token: SeLockMemoryPrivilege 3588 msiexec.exe Token: SeIncreaseQuotaPrivilege 3588 msiexec.exe Token: SeMachineAccountPrivilege 3588 msiexec.exe Token: SeTcbPrivilege 3588 msiexec.exe Token: SeSecurityPrivilege 3588 msiexec.exe Token: SeTakeOwnershipPrivilege 3588 msiexec.exe Token: SeLoadDriverPrivilege 3588 msiexec.exe Token: SeSystemProfilePrivilege 3588 msiexec.exe Token: SeSystemtimePrivilege 3588 msiexec.exe Token: SeProfSingleProcessPrivilege 3588 msiexec.exe Token: SeIncBasePriorityPrivilege 3588 msiexec.exe Token: SeCreatePagefilePrivilege 3588 msiexec.exe Token: SeCreatePermanentPrivilege 3588 msiexec.exe Token: SeBackupPrivilege 3588 msiexec.exe Token: SeRestorePrivilege 3588 msiexec.exe Token: SeShutdownPrivilege 3588 msiexec.exe Token: SeDebugPrivilege 3588 msiexec.exe Token: SeAuditPrivilege 3588 msiexec.exe Token: SeSystemEnvironmentPrivilege 3588 msiexec.exe Token: SeChangeNotifyPrivilege 3588 msiexec.exe Token: SeRemoteShutdownPrivilege 3588 msiexec.exe Token: SeUndockPrivilege 3588 msiexec.exe Token: SeSyncAgentPrivilege 3588 msiexec.exe Token: SeEnableDelegationPrivilege 3588 msiexec.exe Token: SeManageVolumePrivilege 3588 msiexec.exe Token: SeImpersonatePrivilege 3588 msiexec.exe Token: SeCreateGlobalPrivilege 3588 msiexec.exe Token: SeBackupPrivilege 4500 vssvc.exe Token: SeRestorePrivilege 4500 vssvc.exe Token: SeAuditPrivilege 4500 vssvc.exe Token: SeBackupPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeBackupPrivilege 896 srtasks.exe Token: SeRestorePrivilege 896 srtasks.exe Token: SeSecurityPrivilege 896 srtasks.exe Token: SeTakeOwnershipPrivilege 896 srtasks.exe Token: SeBackupPrivilege 896 srtasks.exe Token: SeRestorePrivilege 896 srtasks.exe Token: SeSecurityPrivilege 896 srtasks.exe Token: SeTakeOwnershipPrivilege 896 srtasks.exe Token: SeDebugPrivilege 2236 MsiExec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3588 msiexec.exe 3588 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 60 wrote to memory of 896 60 msiexec.exe 103 PID 60 wrote to memory of 2236 60 msiexec.exe 105 PID 2556 wrote to memory of 4292 2556 RUkakP.exe 117 PID 4292 wrote to memory of 2808 4292 cmd.exe 119 PID 4292 wrote to memory of 1604 4292 cmd.exe 120 PID 4292 wrote to memory of 2552 4292 cmd.exe 122 PID 1012 wrote to memory of 3420 1012 cmd.exe 124 PID 2556 wrote to memory of 2484 2556 RUkakP.exe 126 PID 2484 wrote to memory of 3088 2484 cmd.exe 129 PID 2484 wrote to memory of 4924 2484 cmd.exe 130 PID 2484 wrote to memory of 2728 2484 cmd.exe 132 PID 584 wrote to memory of 3860 584 cmd.exe 134 PID 2556 wrote to memory of 3360 2556 RUkakP.exe 135 PID 3360 wrote to memory of 4444 3360 cmd.exe 137 PID 3360 wrote to memory of 3412 3360 cmd.exe 138 PID 3360 wrote to memory of 3868 3360 cmd.exe 141 PID 2744 wrote to memory of 3632 2744 cmd.exe 142 PID 2556 wrote to memory of 4804 2556 RUkakP.exe 143 PID 4804 wrote to memory of 2540 4804 cmd.exe 145 PID 4804 wrote to memory of 2192 4804 cmd.exe 146 PID 1400 wrote to memory of 1180 1400 cmd.exe 149 PID 4804 wrote to memory of 2360 4804 cmd.exe 150 PID 2556 wrote to memory of 3344 2556 RUkakP.exe 151 PID 3344 wrote to memory of 4204 3344 cmd.exe 153 PID 3344 wrote to memory of 3540 3344 cmd.exe 154 PID 3344 wrote to memory of 1572 3344 cmd.exe 157 PID 4656 wrote to memory of 3332 4656 cmd.exe 158 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\zinst.6638258013.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3588
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:896
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CAF280AF9E1743A169C7217368538D02 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
C:\Users\Public\V3Bc3s\RUkakP.exeC:\Users\Public\V3Bc3s\RUkakP.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\V3Bc3s\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\V3Bc3s\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1604
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3088
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4924
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4444
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3412
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2540
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2192
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4204
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3540
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1572
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\V3Bc3s" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\V3Bc3s" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3420
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:3524
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3860
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3632
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1180
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3332
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58916e.rbs
- Size 7KB
- SHA256 3e8cb97315d0f16c9fa7f5ac038561a3507db57f8b3d0e36d5b5cc0c834b0483
- MD5 da4365f2ca79db3c9738e25088ecb1a9
- SHA1 3a2fd5e78c4e23996d67292645e9018bd35346ff
- SHA512 d22aa78e45993baffec77d24893ca3a0566db928d8956005bab7ae273564d5826938991b3f5e83946cb1760de6f06a4d09a66631f08d5f2bddce509c59075bb2
- SSDEEP 192:g9eE/v81bI11bMSwFc3JHsS15eP3vp5EARrCRm8X:gU1O110i
- TLSH T145F12042B6448AE2F8D31F79C7035BAA37B2D7E95314A31F48CD44701F427C99EA958A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\V3Bc3s\RUkakP.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\V3Bc3s\UxEnhance64.dll
- Size 3.1MB
- SHA256 1b3b606361814910f54db88bf3f50df5ca125d98c7fb9a1b95750cbb9f2b6578
- MD5 d6190c753d93c1e7dd2831025e8a30a1
- SHA1 e941b98286855bff559e1b10ec7fa05bec0e9f0e
- SHA512 c2c8948cee14dfd87768d0ccc9e4c7343b6c6a71d44087d3a8141238a6ccea5062c7a37dd45b8b9c29f33f721f193e8e27224d18bbcfc1fae24a8bcd3bac14ee
- SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vd9:KmVLh6Kl975jywfnI8vd9
- TLSH T13CE523A1B6D739F6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\V3Bc3s\adoresd.dat
- Size 4.8MB
- SHA256 c2d6b0ad9f890da04776ded848a31de642913fb43ac39872955ac7ccef3d9835
- MD5 329569d2fae25f30eb0e4f9833fb84f0
- SHA1 f082848a87eb0f020a9c80c21d16748f7e4f6ea2
- SHA512 0a7a0ee0d0c1a4064aac43e569d3330ec03892f0ed1f30e957262bfe405af0cea9f6bdf1852588b989ed18aba1fcf906da29e8851eddf7032039cf9c2afab2ac
- SSDEEP 98304:euZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:jQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1AA363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\V3Bc3s\msadox.tb
- Size 8KB
- SHA256 6610bc647120bfd0dc6b6a47dd78f98a873533c2bc85d21c3321a385d2411744
- MD5 e221c22c8c00d4799aef9417c95be824
- SHA1 3ae8b567447e753deb2598eec13bf107085fd87e
- SHA512 01051cccb9157256240bc06c681b5cfb399ebbb8486ae6576e7f693e8f91437010d36deaa50e2c93c7c510163439958964822df2a255058d1ac28c16ad811c7f
- SSDEEP 192:HqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:HsZqZOXQ3uqvR2Kfzp
- TLSH T109029E05D7A20CC3E2016C71CD9EB2F5AB13A1EADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI92E5.tmp
- Size 7.8MB
- SHA256 2cfde63d119af801451e0ab878bd49a0e8b408354cd8b2af661ba4fc9ffd4223
- MD5 1c511f54c78162e96f8e3f92324fe12f
- SHA1 f4790e82893c3b86b9998bdeb69bea466ff94c31
- SHA512 ef634ef5ddc3c3a84142dd02be13c31c013e5ea88d4e814cc0c8bc5e9ec78d3463037e465e81b14350dd0a2ec93c4a06d2f25443ce926f0751029fc5cfa8ffb9
- SSDEEP 196608:JVDuo39jPbm/hnkx+1n++NFUjbPKRbH9a1:JVDuoNTbm/Ik/acbdI
- TLSH T13F8633966CCF28B1F403C7B09893322E326677D58DBC4D4876EE7B5C2C621199DBA346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58916d.msi
- Size 7.9MB
- SHA256 6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002
- MD5 7c78cd36b7dbcb2d7aec1afb683e5ce7
- SHA1 81d801ae7cce4e54fb070258e5878227fb87c8c0
- SHA512 ea8639c4e8e82ddfaeb338abc5c10fda56789d904e682e722f10584f55c48c258278851b2520f63c47cbe51db48ff80ba4d53640a669786344690c8eef135c1f
- SSDEEP 196608:dVDuo39jPbm/hnkr+1n++NFUjbPKRbH9aU:dVDuoNTbm/6k/acbdD
- TLSH T1D08633867CCB29B2F403C7B09893622E33667FC58DB84D0976DE775C2C721259DBA246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 23eb060ec5e59880437f2219fcca9b37e20d0b1117b31e3ed1c4c6424a301dd6
- MD5 e396fb3ea9c7deceae550912a794468d
- SHA1 1e57da681c7f427ada62e496325f26d1e46ee7e4
- SHA512 2990ee67716b41801766c9017e8eadaf2f5d59d4c30277363cc39be45eb47e8e7beefeaeae67c69fa3da0cb5db6da69025df215c9c749ae01a284a53e9122233
- SSDEEP 24576:Ku8m+1zidoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:n
- TLSH T18E47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6f179ac4-50c0-46e6-9e25-9a0a06fab8ab}_OnDiskSnapshotProp
- Size 6KB
- SHA256 61e062dfc346dfaa9207a43ee2f06cf83227e207b5234f070cdcc5fa2c34ba56
- MD5 c0edca3dcde326e45cb0345459564c96
- SHA1 659ad0ac9093b648d4a0659be700b325ca9a5a41
- SHA512 dfe4279551ca00c7aadc5ce67b50be389917453c8f8d20b20f56429f486a0dde50f6338b8420e3b3c297861cc34f9fe99327cc3d72c22da1354dcde6b2242396
- SSDEEP 96:FGBJnGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:o/GPGnb++ZVm
- TLSH T1F5D188185AE54711E2B3AB712DF18557A877B911EF33CB8E0198238E6670A10F835F6F
- MD5 SHA1 SHA512 SSDEEP TLSH