Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/07/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
app_setup.66tt009.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
app_setup.66tt009.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target app_setup.66tt009.msi
- Size 9.9MB
- Sample260714-repdfaes7n
- SHA256 d132d88d85641503b7557994a96528792302b94762785d64673a401bd0d4fbd3
- MD5 aa5902ca04ccc3f9a39d7e740d9b2b31
- SHA1 cc0f0e1e9ce076b521d8231927f7f9c253682216
- SHA512 1bddf18ccf348d8dc13e490fddc937fed04b89d54846d7129f742ac6b49507548e6a1e08e3e36536970c905b6b791c5aba59c68865a0649dd2f363e23ca2b062
- SSDEEP 196608:cCQerS5FxyOHjMtKYK/F440vcgm1MnkdoZA2vsPZ+MADSGRYQEy:LX2ByOodKe0gBnkdwLvBezQEy
- TLSH T156A633AA79C423B1D09BC373D466356E3C3A7F45BBA39C217ACB36580CB1A272275345
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions MsiExec.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 1720 hQc9Oq.exe - Loads dropped DLL 2 IoCs
pid Process 1028 MsiExec.exe 1720 hQc9Oq.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 31 1028 MsiExec.exe 35 1028 MsiExec.exe 55 1028 MsiExec.exe 57 1028 MsiExec.exe 59 1028 MsiExec.exe 68 1028 MsiExec.exe 69 1028 MsiExec.exe 73 1028 MsiExec.exe 74 1028 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e58876b.msi msiexec.exe File opened for modification C:\Windows\Installer\e58876b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754} msiexec.exe File opened for modification C:\Windows\Installer\MSI8865.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8912.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e58876d.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4860 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "app_setup.66tt009.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "E26FA59D71B648242850D84E93162A91" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1" msiexec.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1812 msiexec.exe 1812 msiexec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1028 MsiExec.exe 1720 hQc9Oq.exe 1720 hQc9Oq.exe 1720 hQc9Oq.exe 1720 hQc9Oq.exe 1720 hQc9Oq.exe 1720 hQc9Oq.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4860 msiexec.exe Token: SeIncreaseQuotaPrivilege 4860 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeCreateTokenPrivilege 4860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4860 msiexec.exe Token: SeLockMemoryPrivilege 4860 msiexec.exe Token: SeIncreaseQuotaPrivilege 4860 msiexec.exe Token: SeMachineAccountPrivilege 4860 msiexec.exe Token: SeTcbPrivilege 4860 msiexec.exe Token: SeSecurityPrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeLoadDriverPrivilege 4860 msiexec.exe Token: SeSystemProfilePrivilege 4860 msiexec.exe Token: SeSystemtimePrivilege 4860 msiexec.exe Token: SeProfSingleProcessPrivilege 4860 msiexec.exe Token: SeIncBasePriorityPrivilege 4860 msiexec.exe Token: SeCreatePagefilePrivilege 4860 msiexec.exe Token: SeCreatePermanentPrivilege 4860 msiexec.exe Token: SeBackupPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeShutdownPrivilege 4860 msiexec.exe Token: SeDebugPrivilege 4860 msiexec.exe Token: SeAuditPrivilege 4860 msiexec.exe Token: SeSystemEnvironmentPrivilege 4860 msiexec.exe Token: SeChangeNotifyPrivilege 4860 msiexec.exe Token: SeRemoteShutdownPrivilege 4860 msiexec.exe Token: SeUndockPrivilege 4860 msiexec.exe Token: SeSyncAgentPrivilege 4860 msiexec.exe Token: SeEnableDelegationPrivilege 4860 msiexec.exe Token: SeManageVolumePrivilege 4860 msiexec.exe Token: SeImpersonatePrivilege 4860 msiexec.exe Token: SeCreateGlobalPrivilege 4860 msiexec.exe Token: SeBackupPrivilege 4908 vssvc.exe Token: SeRestorePrivilege 4908 vssvc.exe Token: SeAuditPrivilege 4908 vssvc.exe Token: SeBackupPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 4448 srtasks.exe Token: SeRestorePrivilege 4448 srtasks.exe Token: SeSecurityPrivilege 4448 srtasks.exe Token: SeTakeOwnershipPrivilege 4448 srtasks.exe Token: SeBackupPrivilege 4448 srtasks.exe Token: SeRestorePrivilege 4448 srtasks.exe Token: SeSecurityPrivilege 4448 srtasks.exe Token: SeTakeOwnershipPrivilege 4448 srtasks.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4860 msiexec.exe 4860 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1812 wrote to memory of 4448 1812 msiexec.exe 96 PID 1812 wrote to memory of 1028 1812 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\app_setup.66tt009.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4860
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7AF8C2BEEAF6104723076B82FE117690 E Global\MSI00002⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1028
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Users\Public\bTPqkZ\hQc9Oq.exeC:\Users\Public\bTPqkZ\hQc9Oq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58876c.rbs
- Size 7KB
- SHA256 dfbee80015216b658e7d585d5745714cd0e048aaeffd4b72d070f1c6d78688a1
- MD5 e985fafadb9d9bf912b0227cc0b55b0f
- SHA1 460b42deeac491b49659dd205ed24e13d14f1f5a
- SHA512 fa130c36890af6af6a0d6b13e61725dee84080c98686f7210d999a7f733de1fbeaba8b12aa6e688750e512c3a88eca08c58cf508c535af824843cce95565280a
- SSDEEP 192:/f1e8Mv8bbI1bbMSwFc3JHsS15ePMvp5EAQrCRm8X:/ZbOb10G
- TLSH T1CAF12142B6444AE2F9D31F3AC7035B6A37B2D7E95314A31F44CD48701F427C99FA958A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bTPqkZ\UxEnhance64.dll
- Size 3.1MB
- SHA256 2251637b4b76b60d6b3ae347f34be53bf98eb802c4f39304bdd63f0b4a77be90
- MD5 7455b307e46e7d05f7f069ced20745cc
- SHA1 822b60100469c48c7ddeb4cc32b0cafd3179b263
- SHA512 1a5ef59a996063909114179ec068ba0df55d0e61392504a3770738f3e94ec5b3e5c0c3452c4af93c1a82319978e4b8cfc69dba2f1f82034684be5555e7d794a3
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+E:P9m29xx3Tiqt06ox6+z2rNNrKoE
- TLSH T117E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bTPqkZ\adoresd.dat
- Size 4.8MB
- SHA256 a1ff1baa190e7165c831d8f7528ee76bcf6657bd8cb581ae6ec03f2ce3cd8b47
- MD5 f64510d6bbb8db0d5f9a0865e46bca6a
- SHA1 55619a9dbfcc4cdeb01b34a38e1b2139b5ceed6d
- SHA512 82a9fcff8d6156e0eca72b55b63bf7767cf516d4e05ddf47764343572214b8e095b4cc77a05aa0b38199881636ff0a4279dd4ac1c1a4444b70ac2770cb7eebbb
- SSDEEP 98304:+uZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:DQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1D3363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bTPqkZ\hQc9Oq.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bTPqkZ\msadox.tb
- Size 8KB
- SHA256 ca86e0bf8667567e67367da9b7a11db464481850f2dfec288c72cfc571b3b335
- MD5 8b947eb19e40003589fc448f3bee1837
- SHA1 7a5e9c1c28c5f7029cae2a0903f9c74e7ea5f458
- SHA512 9b2b02b481cca4b51e0dc3167ad8beafd61caa09a812cd52da0cd37c02743105ff42c7b2c53096d2ea2f0542b046896327c01e1ae39cf8b7526c0f10262c4c8d
- SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
- TLSH T17A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8912.tmp
- Size 9.9MB
- SHA256 fbe390c30fcfe077621fc5e2f1e6fc26d1fd0f95a0f1d2670b19c12547f3bdfa
- MD5 e9d56ce74808be5ee5eb6ed16000cfe3
- SHA1 b76355553f31d0e7a467819e3885278cc988c815
- SHA512 8457b9bbc98360a23383a31661364a0a593b20de5c99a4e5378a2fbdb7a0a1a576f89d834376c9264721bf6333d0d00532c22e7992c955b1cd7544eef433a57c
- SSDEEP 196608:nCQerS5FxyOHjMtKqK/F440vcgm1MnkdoZA2vsAZ+MADSGRYQEM:CX2ByOojKe0gBnkdwLv+ezQEM
- TLSH T171A633AA35C522F4D09BC773D4A6356E3C3A7755BBA39C317ECB3A540C81A1B2239346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58876b.msi
- Size 9.9MB
- SHA256 d132d88d85641503b7557994a96528792302b94762785d64673a401bd0d4fbd3
- MD5 aa5902ca04ccc3f9a39d7e740d9b2b31
- SHA1 cc0f0e1e9ce076b521d8231927f7f9c253682216
- SHA512 1bddf18ccf348d8dc13e490fddc937fed04b89d54846d7129f742ac6b49507548e6a1e08e3e36536970c905b6b791c5aba59c68865a0649dd2f363e23ca2b062
- SSDEEP 196608:cCQerS5FxyOHjMtKYK/F440vcgm1MnkdoZA2vsPZ+MADSGRYQEy:LX2ByOodKe0gBnkdwLvBezQEy
- TLSH T156A633AA79C423B1D09BC373D466356E3C3A7F45BBA39C217ACB36580CB1A272275345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 71392b2e7dc03cea0b644a67353adb850304c4cf32b2a54bb5ba653d2670cce0
- MD5 516e903983523899e638db3f533a1015
- SHA1 d044e4222036c4e556094c84d5dd3addc8767277
- SHA512 d0654a6aa9472b6fdd0082d5428a1c0fbdbf795fb79e240ebdac7d0da41a5429aefe1f51d2717bb6b87a1840dd2d34237ff7c2fc9731504dd4eb7a42e1d6d5d2
- SSDEEP 24576:Fu8m+1zkdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:e
- TLSH T16547D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8032e0e3-9058-4d88-bf3e-58b53338d421}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ef4496e64ccfeaa8d8332804017e7886da7762162d2d02cecc5df5fe0e595fb6
- MD5 78c4d639ca0b381d598baa1742289260
- SHA1 50d46bd5233074963edc891a00bc582c0631cc38
- SHA512 5c7357bdaec83124c7e310e28226d9ff021ebd72b43aba91a46aefab93e13e3080e28dd8209f108c92f9f6b7f64cc7fba708cf580db0f4b323a8333fa6a9cfdb
- SSDEEP 96:FQBV8vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:aib++ZVm
- TLSH T1F8D179185AE54311E2B3AB722DF14557A877B911EF33CB8E0198238E6670A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH