Analysis
- user interaction
yes - max time kernel
22s - max time network
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target setup.exe
- Size 10.6MB
- Sample260716-btf3lsas7r
- SHA256 e1b0c8cc42e878157d284e0f47b1bf4ff7cc984717d09eb048780d00e00fa5c6
- MD5 b4fbf1bb3c3fc4f9f963c70f8822f80e
- SHA1 dd7f372d87f6d9fa16cb1f0b3c5b17f7009832b0
- SHA512 f8978076bf19df0e688eaff6134ee9ea7374e48a69126658f83eeb23b7babdfd0e731c81207824ca119c2c0a2c9755936fd8fd336822c111e96a3afafd88b31f
- SSDEEP 196608:8lCHeCWmqsPMnGnf0vk7F3i0aD7HgirsYlAAE9zwPfu8n:8lC+CWMQGfr8XHJ2AE9zgu8n
- TLSH T112B6F131B38AC037D56A05B02A2DDBAF51287E720F7550D763E86E6E09B58C24732F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: setup.exe File opened (read-only) \??\M: setup.exe File opened (read-only) \??\O: setup.exe File opened (read-only) \??\Y: setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: setup.exe File opened (read-only) \??\H: setup.exe File opened (read-only) \??\W: setup.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: setup.exe File opened (read-only) \??\X: setup.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: setup.exe File opened (read-only) \??\N: setup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: setup.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: setup.exe File opened (read-only) \??\P: setup.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: setup.exe File opened (read-only) \??\V: setup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: setup.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: setup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: setup.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: setup.exe File opened (read-only) \??\S: setup.exe File opened (read-only) \??\T: setup.exe File opened (read-only) \??\U: setup.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Loads dropped DLL 6 IoCs
pid Process 3444 MsiExec.exe 5368 MsiExec.exe 5368 MsiExec.exe 5368 MsiExec.exe 5368 MsiExec.exe 5368 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5900000001000000120000005200530041002f00530048004100310000001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3496b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef45c000000010000000400000000080000200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e setup.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3212 msiexec.exe Token: SeCreateTokenPrivilege 4976 setup.exe Token: SeAssignPrimaryTokenPrivilege 4976 setup.exe Token: SeLockMemoryPrivilege 4976 setup.exe Token: SeIncreaseQuotaPrivilege 4976 setup.exe Token: SeMachineAccountPrivilege 4976 setup.exe Token: SeTcbPrivilege 4976 setup.exe Token: SeSecurityPrivilege 4976 setup.exe Token: SeTakeOwnershipPrivilege 4976 setup.exe Token: SeLoadDriverPrivilege 4976 setup.exe Token: SeSystemProfilePrivilege 4976 setup.exe Token: SeSystemtimePrivilege 4976 setup.exe Token: SeProfSingleProcessPrivilege 4976 setup.exe Token: SeIncBasePriorityPrivilege 4976 setup.exe Token: SeCreatePagefilePrivilege 4976 setup.exe Token: SeCreatePermanentPrivilege 4976 setup.exe Token: SeBackupPrivilege 4976 setup.exe Token: SeRestorePrivilege 4976 setup.exe Token: SeShutdownPrivilege 4976 setup.exe Token: SeDebugPrivilege 4976 setup.exe Token: SeAuditPrivilege 4976 setup.exe Token: SeSystemEnvironmentPrivilege 4976 setup.exe Token: SeChangeNotifyPrivilege 4976 setup.exe Token: SeRemoteShutdownPrivilege 4976 setup.exe Token: SeUndockPrivilege 4976 setup.exe Token: SeSyncAgentPrivilege 4976 setup.exe Token: SeEnableDelegationPrivilege 4976 setup.exe Token: SeManageVolumePrivilege 4976 setup.exe Token: SeImpersonatePrivilege 4976 setup.exe Token: SeCreateGlobalPrivilege 4976 setup.exe Token: SeCreateTokenPrivilege 4976 setup.exe Token: SeAssignPrimaryTokenPrivilege 4976 setup.exe Token: SeLockMemoryPrivilege 4976 setup.exe Token: SeIncreaseQuotaPrivilege 4976 setup.exe Token: SeMachineAccountPrivilege 4976 setup.exe Token: SeTcbPrivilege 4976 setup.exe Token: SeSecurityPrivilege 4976 setup.exe Token: SeTakeOwnershipPrivilege 4976 setup.exe Token: SeLoadDriverPrivilege 4976 setup.exe Token: SeSystemProfilePrivilege 4976 setup.exe Token: SeSystemtimePrivilege 4976 setup.exe Token: SeProfSingleProcessPrivilege 4976 setup.exe Token: SeIncBasePriorityPrivilege 4976 setup.exe Token: SeCreatePagefilePrivilege 4976 setup.exe Token: SeCreatePermanentPrivilege 4976 setup.exe Token: SeBackupPrivilege 4976 setup.exe Token: SeRestorePrivilege 4976 setup.exe Token: SeShutdownPrivilege 4976 setup.exe Token: SeDebugPrivilege 4976 setup.exe Token: SeAuditPrivilege 4976 setup.exe Token: SeSystemEnvironmentPrivilege 4976 setup.exe Token: SeChangeNotifyPrivilege 4976 setup.exe Token: SeRemoteShutdownPrivilege 4976 setup.exe Token: SeUndockPrivilege 4976 setup.exe Token: SeSyncAgentPrivilege 4976 setup.exe Token: SeEnableDelegationPrivilege 4976 setup.exe Token: SeManageVolumePrivilege 4976 setup.exe Token: SeImpersonatePrivilege 4976 setup.exe Token: SeCreateGlobalPrivilege 4976 setup.exe Token: SeCreateTokenPrivilege 4976 setup.exe Token: SeAssignPrimaryTokenPrivilege 4976 setup.exe Token: SeLockMemoryPrivilege 4976 setup.exe Token: SeIncreaseQuotaPrivilege 4976 setup.exe Token: SeMachineAccountPrivilege 4976 setup.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4976 setup.exe 4524 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3212 msiexec.exe 3444 MsiExec.exe 4524 msiexec.exe 5368 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3212 wrote to memory of 3444 3212 msiexec.exe 88 PID 4976 wrote to memory of 4524 4976 setup.exe 89 PID 3212 wrote to memory of 5368 3212 msiexec.exe 90 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\RPA Technology, Inc\Mobile Mouse 3.6.4\install\Mobile Mouse Server.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1783924437 "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4524
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 967C8D4C5AA5BB0ED187C6E55427B325 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E6FEAAEF103FD0AAB22D0F0D3DC6425 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5368
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI527C.tmp
- Size 384KB
- SHA256 284e1b5af1e6a57f776cd82093be19820ab3c90ca1c4639c4b11f7a00a3e6877
- MD5 d23c9b725dc88a729250a65229e35b39
- SHA1 112a859b1c905e6514e0f18a8a41ec6455ca617f
- SHA512 e049af99a7d4a265eb8cd9a2e31c4d387b8a42683d4a80fe935ead8a95b1f456407129dad241aa956fc6ebc2b3b52886a5668499d7f256232c3c372c70a8f465
- SSDEEP 6144:tMgfLPNVkjzwiGsDqC6+iv/uIe7frm0eWVvAOj1ptVKc0MbJS:dfLKwiGsuFuIe7fazWZ7TV+MbJ
- TLSH T1D6846C2072EBC43AD5BE09B03A79C9AB44297E655BF2C4EF13C81D1E09729C25635F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RPA Technology, Inc\Mobile Mouse 3.6.4\install\Mobile Mouse Server.msi
- Size 7.0MB
- SHA256 a3bf8c76508cce15d814fbdfc1a0d81f94fcd735a9d125810b8fe7bb007917dd
- MD5 2c998f7c1f58df295cda2485b8b691a3
- SHA1 37fbb577e691aefc8c0cd8e8718b103f82dae4ed
- SHA512 4db88d519a85756c20baa291b04a3d81a90cd89ce8c64b2d1cb7bfe05291bdfa623687168773a45ac37c2cf451d7e0801105fc4e9b93c974419be1885065ba3a
- SSDEEP 98304:7Y5A8FlpKPvmBEssijawGznM1hnTjv0vkxGUkk3Hm0Y0pVKD7HEZF4YBgAA34zOE:QWmqsPMnGnf0vk7F3i0aD7HgirsYlAA
- TLSH T107761221B285C032D46D05B0267EC76A42297E714FBA54EB63C47E2F0EF25C25636F6B
- MD5 SHA1 SHA512 SSDEEP TLSH