Analysis
- max time kernel
29s - max time network
51s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WMDC-fixes-for-Win10.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
WMDC-fixes-for-Win10.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target WMDC-fixes-for-Win10.msi
- Size 44KB
- Sample260714-ppv8macx9q
- SHA256 38452d0180e8238cb9675db612c8149a42ea1c7eb0a35238e8632754cfd83d7c
- MD5 ae32f5dc0b8da5d9b81664466b6719ec
- SHA1 ed49e826c89cb618008d4d0fd7f2b907e4f9353b
- SHA512 6a0c24b88a9998288e091b6818f1766636e18dc1381646d4869e14a782f5c1c110cb95e5b3954a21faeb31197c90214fee6bdbace7391b6499cb3a3215552967
- SSDEEP 384:yHuJEVe21CMtDhU97my3M5ICBX3ZWFYN9opXey3M5IC0iQwaA9SZsHLPK6jbIh:On1C+V/WMmC5ZHseWMmCKMhPKg
- TLSH T1A1132812B6404A21CA93173115BAD7E49F36BC449F33C527315AB38C2FB2BD156BAAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4920 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{1C006B25-7582-4534-A588-866056B45D79} msiexec.exe File created C:\Windows\WindowsMobile\WmdcCloseOpen.bat msiexec.exe File created C:\Windows\WindowsMobile\WmdcCloseOpen - Shortcut.lnk msiexec.exe File created C:\Windows\Installer\e59fa18.msi msiexec.exe File created C:\Windows\SystemTemp\~DFDA6CB933A7F1F8CD.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59fa16.msi msiexec.exe File created C:\Windows\WindowsMobile\WmdcOpen - Shortcut.lnk msiexec.exe File created C:\Windows\Installer\e59fa16.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF76F67A700B87922C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF86EA683203A9E851.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI149.tmp msiexec.exe File created C:\Windows\WindowsMobile\WmdcOpen.bat msiexec.exe File created C:\Windows\SystemTemp\~DF75BCDD2843D9163A.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4920 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\ProductName = "WmdcFixesWin10" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\PackageCode = "CD7EE78B01DD7FF4AAD4969AEDA73F99" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList\PackageName = "WMDC-fixes-for-Win10.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\52B600C1285743545A886806654BD597\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9331DB879DFB19D4D9B454A2B34A424E\52B600C1285743545A886806654BD597 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\52B600C1285743545A886806654BD597 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\Version = "16777216" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9331DB879DFB19D4D9B454A2B34A424E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B600C1285743545A886806654BD597\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4884 msiexec.exe 4884 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4920 msiexec.exe Token: SeIncreaseQuotaPrivilege 4920 msiexec.exe Token: SeSecurityPrivilege 4884 msiexec.exe Token: SeCreateTokenPrivilege 4920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4920 msiexec.exe Token: SeLockMemoryPrivilege 4920 msiexec.exe Token: SeIncreaseQuotaPrivilege 4920 msiexec.exe Token: SeMachineAccountPrivilege 4920 msiexec.exe Token: SeTcbPrivilege 4920 msiexec.exe Token: SeSecurityPrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeLoadDriverPrivilege 4920 msiexec.exe Token: SeSystemProfilePrivilege 4920 msiexec.exe Token: SeSystemtimePrivilege 4920 msiexec.exe Token: SeProfSingleProcessPrivilege 4920 msiexec.exe Token: SeIncBasePriorityPrivilege 4920 msiexec.exe Token: SeCreatePagefilePrivilege 4920 msiexec.exe Token: SeCreatePermanentPrivilege 4920 msiexec.exe Token: SeBackupPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeShutdownPrivilege 4920 msiexec.exe Token: SeDebugPrivilege 4920 msiexec.exe Token: SeAuditPrivilege 4920 msiexec.exe Token: SeSystemEnvironmentPrivilege 4920 msiexec.exe Token: SeChangeNotifyPrivilege 4920 msiexec.exe Token: SeRemoteShutdownPrivilege 4920 msiexec.exe Token: SeUndockPrivilege 4920 msiexec.exe Token: SeSyncAgentPrivilege 4920 msiexec.exe Token: SeEnableDelegationPrivilege 4920 msiexec.exe Token: SeManageVolumePrivilege 4920 msiexec.exe Token: SeImpersonatePrivilege 4920 msiexec.exe Token: SeCreateGlobalPrivilege 4920 msiexec.exe Token: SeBackupPrivilege 1684 vssvc.exe Token: SeRestorePrivilege 1684 vssvc.exe Token: SeAuditPrivilege 1684 vssvc.exe Token: SeBackupPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4920 msiexec.exe 4920 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4920 msiexec.exe 4884 msiexec.exe 4240 LogonUI.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4884 wrote to memory of 3248 4884 msiexec.exe 92 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WMDC-fixes-for-Win10.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4920
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3248
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2732
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a26855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4240
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:3196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59fa17.rbs
- Size 8KB
- SHA256 ce5c0f2c78cd21346238a6c008623cda39231cf1a06161f9da8249ec715d8e20
- MD5 cd07beee41b6ed0a8ca71b32ff3bc461
- SHA1 f5f0aff720e3e0b98eae10aa8c9ebd3080d5392b
- SHA512 6120de1117a709a339408572a4a977be4be1058ed55b585121a86abc2046eecf27763b779031de8fb6056f82fe2e5e81ac93deaca89db40c5beb4412292f26d0
- SSDEEP 96:zr1ebK6hcbT6k6cQqCX6L1UrJTCsThqOKUrJTC6j5mC7ThqObHMu5zNzWoRewCMc:zcf2SqCEO9OIr9OQlz8MpO
- TLSH T1BE120D03A60086D3F5666732C20767573BE7C3A797012A8F14DF90249F9B38A6F4969B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59fa16.msi
- Size 44KB
- SHA256 38452d0180e8238cb9675db612c8149a42ea1c7eb0a35238e8632754cfd83d7c
- MD5 ae32f5dc0b8da5d9b81664466b6719ec
- SHA1 ed49e826c89cb618008d4d0fd7f2b907e4f9353b
- SHA512 6a0c24b88a9998288e091b6818f1766636e18dc1381646d4869e14a782f5c1c110cb95e5b3954a21faeb31197c90214fee6bdbace7391b6499cb3a3215552967
- SSDEEP 384:yHuJEVe21CMtDhU97my3M5ICBX3ZWFYN9opXey3M5IC0iQwaA9SZsHLPK6jbIh:On1C+V/WMmC5ZHseWMmCKMhPKg
- TLSH T1A1132812B6404A21CA93173115BAD7E49F36BC449F33C527315AB38C2FB2BD156BAAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 3eada0cdaace72bf71a6feb277b5809526bfd99c04f9ced6bd3ffdf749d1a781
- MD5 ece3f06be2566d79edd98f03a70b6e24
- SHA1 c073362154ee5c07310f2e871e43a8b146f3e6e8
- SHA512 278ddffee356b481d37d175ee7b0a8d20bf27b2ea509e08f927301da0893051a9401ef3e9a1a9b02d8794826c50816c8e5421b6c49d0d0eef9a2fe445cddcbd1
- SSDEEP 24576:RFo3DMPvdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuo:LHE
- TLSH T17657B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a53e4c52-1e49-4bc9-ba2c-719934775dce}_OnDiskSnapshotProp
- Size 6KB
- SHA256 99f430f9f743b14391d06d09a44eb8d58d5b8a47c73336bdf7476c9353450c4c
- MD5 8e91aa3fd4f2bd346d65f36c40278ee7
- SHA1 24b7f81577e97ccba94cdd1a199f455c503385d9
- SHA512 2d80e24c314aa0aa2dbcf6c80d55387efe2dc097c0e26e88bccfc3ae3d9d7b9de8f6c60ce51b1290de86eab4bf9055a414c752a70a105502f36cf59becc2924e
- SSDEEP 96:FD70lcvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:1xb++uVm
- TLSH T167D188185AF54311E2B3AB3128F14557A837B812EF33CB8E0198238E2631910F836F6F
- MD5 SHA1 SHA512 SSDEEP TLSH