Analysis
- max time kernel
147s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
intsoft.1036tt011.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
intsoft.1036tt011.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target intsoft.1036tt011.msi
- Size 6.0MB
- Sample260711-lmgexafv4j
- SHA256 2546a2040e77a9efa23e21cd6b4d82a966495a15d43c97dc8eba5843fbb01408
- MD5 6c464e7244ad9440f1eb76863026a653
- SHA1 c5aaa402c56f28d48fd65ac8c5331f8982da4c36
- SHA512 056b72f3ca723db6cf8c935279775f4bedff3436f9a1a1bfc801b06d899c1191b9eb3370819fce86912c5b6ead0643008268cd63a299f83da38efa4788d02b63
- SSDEEP 196608:cpfS8rcRq2pRp/lXZoHmgWD/mXXyr0Dnka:cpS8rcRqurHoHiEiAj
- TLSH T1F7563383BAC649B4C00BCFB1986A619E706D7FD78E718C2239D97A1D5E73C205EB5780
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 6140 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5848 m6XxO8.exe - Loads dropped DLL 2 IoCs
pid Process 3564 MsiExec.exe 5848 m6XxO8.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\OSnuaw\\m6XxO8.exe\"" m6XxO8.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 3564 MsiExec.exe 8 3564 MsiExec.exe 9 3564 MsiExec.exe 10 3564 MsiExec.exe 11 3564 MsiExec.exe 12 3564 MsiExec.exe 13 3564 MsiExec.exe 14 3564 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 3 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4576 cmd.exe 5840 cmd.exe 1280 cmd.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b m6XxO8.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754} msiexec.exe File created C:\Windows\SystemTemp\~DFE5730F1BA9789935.TMP msiexec.exe File created C:\Windows\Installer\e595e91.msi msiexec.exe File created C:\Windows\SystemTemp\~DF4825483D2DB12342.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF72653C705D9122AD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI62C7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6355.tmp msiexec.exe File created C:\Windows\Installer\e595e93.msi msiexec.exe File created C:\Windows\SystemTemp\~DF457C699E308AB1B5.TMP msiexec.exe File opened for modification C:\Windows\Installer\e595e91.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2212 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000508ea0cb0cbd3e300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801508ea0cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101508ea0cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3508ea0cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6508ea0cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "A7DFBCC181AC3354D97D7EC49AE6430F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "intsoft.1036tt011.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1484 schtasks.exe 4664 schtasks.exe 3264 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 msiexec.exe 1244 msiexec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 3564 MsiExec.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe 5848 m6XxO8.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2212 msiexec.exe Token: SeIncreaseQuotaPrivilege 2212 msiexec.exe Token: SeSecurityPrivilege 1244 msiexec.exe Token: SeCreateTokenPrivilege 2212 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2212 msiexec.exe Token: SeLockMemoryPrivilege 2212 msiexec.exe Token: SeIncreaseQuotaPrivilege 2212 msiexec.exe Token: SeMachineAccountPrivilege 2212 msiexec.exe Token: SeTcbPrivilege 2212 msiexec.exe Token: SeSecurityPrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeLoadDriverPrivilege 2212 msiexec.exe Token: SeSystemProfilePrivilege 2212 msiexec.exe Token: SeSystemtimePrivilege 2212 msiexec.exe Token: SeProfSingleProcessPrivilege 2212 msiexec.exe Token: SeIncBasePriorityPrivilege 2212 msiexec.exe Token: SeCreatePagefilePrivilege 2212 msiexec.exe Token: SeCreatePermanentPrivilege 2212 msiexec.exe Token: SeBackupPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeShutdownPrivilege 2212 msiexec.exe Token: SeDebugPrivilege 2212 msiexec.exe Token: SeAuditPrivilege 2212 msiexec.exe Token: SeSystemEnvironmentPrivilege 2212 msiexec.exe Token: SeChangeNotifyPrivilege 2212 msiexec.exe Token: SeRemoteShutdownPrivilege 2212 msiexec.exe Token: SeUndockPrivilege 2212 msiexec.exe Token: SeSyncAgentPrivilege 2212 msiexec.exe Token: SeEnableDelegationPrivilege 2212 msiexec.exe Token: SeManageVolumePrivilege 2212 msiexec.exe Token: SeImpersonatePrivilege 2212 msiexec.exe Token: SeCreateGlobalPrivilege 2212 msiexec.exe Token: SeBackupPrivilege 3480 vssvc.exe Token: SeRestorePrivilege 3480 vssvc.exe Token: SeAuditPrivilege 3480 vssvc.exe Token: SeBackupPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeBackupPrivilege 5336 srtasks.exe Token: SeRestorePrivilege 5336 srtasks.exe Token: SeSecurityPrivilege 5336 srtasks.exe Token: SeTakeOwnershipPrivilege 5336 srtasks.exe Token: SeBackupPrivilege 5336 srtasks.exe Token: SeRestorePrivilege 5336 srtasks.exe Token: SeSecurityPrivilege 5336 srtasks.exe Token: SeTakeOwnershipPrivilege 5336 srtasks.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2212 msiexec.exe 2212 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2212 msiexec.exe 1244 msiexec.exe 3564 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1244 wrote to memory of 5336 1244 msiexec.exe 92 PID 1244 wrote to memory of 3564 1244 msiexec.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\intsoft.1036tt011.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2212
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5336
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 61F215E5D802A9FB598EC9B62DE66DC6 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3564
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
C:\Users\Public\OSnuaw\m6XxO8.exe"C:\Users\Public\OSnuaw\m6XxO8.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:6140
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\OSnuaw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:4576 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\OSnuaw\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4664
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5708
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:5840 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3264
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3220
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4112
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:1280 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1484
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4492
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5172
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\OSnuaw" /t REG_DWORD /d 0 /f1⤵PID:1992
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\OSnuaw" /t REG_DWORD /d 0 /f2⤵PID:1100
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:3416
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵PID:2804
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵PID:5924
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵PID:1724
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Persistence
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e595e92.rbs
- Size 7KB
- SHA256 241c97fab4f59aacad6cc27874e91881c6ec3262be23cfa69032cf030df3dc66
- MD5 48edaede0499dc548b0018de49f7f545
- SHA1 25cf232e634d56ae383219f166683446cad118b7
- SHA512 f3a22f4be56b2afd5f4e6193e06ebc2647f91d2b45c5c4cc7b68f1aecd5631d3abf0eddadff726c4cbbb8c85d3295c4ac960f66ce01c0febe4ec81c1dc6b33b5
- SSDEEP 192:6IC/2v8/bI1/bMSwF83JHsS15ePWvp5EAlrCRm8X:6L/O/r0R
- TLSH T16AF1204276488AE2F9D31F39C7435B6A37B2D7E95314A31F48CD48701F433C99EAA58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\OSnuaw\UxEnhance64.dll
- Size 3.1MB
- SHA256 5b16b48d58b85673f35aa7b0c8b48a2d53bf1b98971ba1018d50f9adb8bec3e1
- MD5 4e34ed8e60f35315a8f52fcd122d0a03
- SHA1 99141a1a20f4888ef3eb5e9c7dad3dbb20ed7532
- SHA512 1f27c2499b7296cd11d3f18bbe5d920fae1491c0efc6373ce14d434d8603c6ed86012bfcf874efe9c2df6707f152848c016008bcb0f86b070a88cca6bd7a20ed
- SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vdE:KmVLh6Kl975jywfnI8vdE
- TLSH T10BE523A1B6D739F6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\OSnuaw\adoresd.dat
- Size 4.8MB
- SHA256 923403a67bdf60d7403ac5ec1e9f32ff26a642af8b1a6396e089fee3e33ff62d
- MD5 62ce7adf7532af2b187f21a62acd32fe
- SHA1 e3cdaede34421dcf73ccb3ae6a3ae2327e413891
- SHA512 82ec262c28cd2ef463e548fd69239326c63e622dca8a278e41902588759ae9f4e6504407bd37ae638d20c4a3a08dff0d4f8a3be88df6cd92c2a3b90564b7c412
- SSDEEP 98304:ruZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:sQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1FE363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\OSnuaw\m6XxO8.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\OSnuaw\msadox.tb
- Size 8KB
- SHA256 3b489e028b81319b1ed76c7224473d8f9a934076b2a6ef077b4e204b46ac57d2
- MD5 10d3f36183c1f8ed008d1c29705dc210
- SHA1 af9d4832331c01706f97a2fafe9a39b7462152b9
- SHA512 79b95e60ac6d7acfda38cdbf5bf79f2e903867fdfc2e1be4902f0f3e94557f13e6b1fbf66e1eb5ce57ecb80d3dc811c53425fc813491885cd7cfa575d63b1997
- SSDEEP 192:IXqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IXsZqZOXQ3uqvR2Kfzp
- TLSH T1D9029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6355.tmp
- Size 6.0MB
- SHA256 a1259915ab07e798e0a0d2deb0b806d79bda6270b2aea64b67c5c8c535a808d8
- MD5 2d7d8a9a4475824e774eef1a0633ef0b
- SHA1 b755ac5ed1cee01c0f07b696a263aed8248be627
- SHA512 e34f7ab59937ad2e62c03cf2fe013ef77506ed77446669d40ce1320a101f1d75348efeb6706df3524def6daa4476df658828f7583440fd41e1180fdee9b72e2b
- SSDEEP 196608:mpfS8rcRq2pRp/lXZoHmgWD/m5Xyr0Dnkn:mpS8rcRqurHoHiiiAE
- TLSH T18F5633837AC649B8C00BCFB1D8AA619F706D3BD78E708C2179DD5A1D5E63C20AE75784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e595e91.msi
- Size 6.0MB
- SHA256 2546a2040e77a9efa23e21cd6b4d82a966495a15d43c97dc8eba5843fbb01408
- MD5 6c464e7244ad9440f1eb76863026a653
- SHA1 c5aaa402c56f28d48fd65ac8c5331f8982da4c36
- SHA512 056b72f3ca723db6cf8c935279775f4bedff3436f9a1a1bfc801b06d899c1191b9eb3370819fce86912c5b6ead0643008268cd63a299f83da38efa4788d02b63
- SSDEEP 196608:cpfS8rcRq2pRp/lXZoHmgWD/mXXyr0Dnka:cpS8rcRqurHoHiEiAj
- TLSH T1F7563383BAC649B4C00BCFB1986A619E706D7FD78E718C2239D97A1D5E73C205EB5780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 4340c53d6ac886174a6c603816286fc7bb37ce9f872c8cacbb336bf3f93bc796
- MD5 7c18a80bdab0da50651f5e3443756bf0
- SHA1 83bfd41d8388c0c047883c3d3227fe6be09573f6
- SHA512 13d9b94a78376d933355f06c903164f7f9622a0ffb512f2227589f0ee67daa32b3cafd8a928130683370d8329e1aa71393bf4fc6f0573f9648aec26ea681cb3c
- SSDEEP 24576:6Fo3DMPEdoO/vvTL/yQqKC1gP7egB7tZUHMo93Uy8PE6JdrasIBm6jgb+OQ:fHk
- TLSH T17157A31437F92140E7B79E3CA8F06A234D397D5BAC19DE8D45411B4E0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cba08e50-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2ef8b791-f1e6-45e2-bfc2-0f28a888eac5}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f682af90c71c040f6c68ee70f307e8d91a71d4839d30b95eb22bf8a910e1202d
- MD5 e46b39bb15f1a2ead3d33b0a678d0d6a
- SHA1 5df799a1094a919ef27e61e570a126cf0ffcb339
- SHA512 138547eef61eadd5587be9d9952e511eabc2005abcab7bb03867353060ec8c0885ace4b6fef2294dab4b399767d56ff4e67887a2c83d1a8b2cda3249fc641319
- SSDEEP 96:FQ6SLnavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Kcb++uVm
- TLSH T12CD188181AE54711E2B3AB312DF18557A877B911EF33CB8E0198238E2631A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH