Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appinstall.8835005.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
appinstall.8835005.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target appinstall.8835005.msi
- Size 7.2MB
- Sample260716-e2nzzacz5q
- SHA256 a3bae9537265a350771bb624ac2b3ba0910e2fc1666d1ef97d277a667aaca354
- MD5 14e64c8ae7ccd663a9b243c3a0fd92a5
- SHA1 17a1b6edd181ff8da2fcec5088ee75c9777a42c5
- SHA512 03e5051f615600895176e182554b44ba91dcc971586f3fed2839074fbd3dd0181efda94fca619d37eafbfe6499b781325639b30b9f6dcb42dae5ccdd5cf2e0b5
- SSDEEP 196608:aNszuSrjTkP4gJJufIgnv1t9GRPHmimAiLOg:aNlIjTirJu5t9aHTiSg
- TLSH T19076339A2CC9B7B6D05BC3B08647703E782D3FC27E6A4D03B2D836111D7171629BAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\aoEuaz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions MsiExec.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools MsiExec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation im3bF3.exe - Executes dropped EXE 1 IoCs
pid Process 3328 im3bF3.exe - Loads dropped DLL 2 IoCs
pid Process 4852 MsiExec.exe 3328 im3bF3.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\aoEuaz\\im3bF3.exe\"" im3bF3.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 46 4852 MsiExec.exe 50 4852 MsiExec.exe 73 4852 MsiExec.exe 79 4852 MsiExec.exe 87 4852 MsiExec.exe 89 4852 MsiExec.exe 96 4852 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4132 cmd.exe 3028 cmd.exe 1032 cmd.exe 2376 cmd.exe 1052 cmd.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b im3bF3.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e5875f6.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI76D1.tmp msiexec.exe File created C:\Windows\Installer\e5875f8.msi msiexec.exe File opened for modification C:\Windows\Installer\e5875f6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754} msiexec.exe File opened for modification C:\Windows\Installer\MSI776E.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4148 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "2C85FE63A7ACD6D44B87E043FBCE1954" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "appinstall.8835005.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4852 schtasks.exe 2128 schtasks.exe 2292 schtasks.exe 4468 schtasks.exe 736 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 msiexec.exe 2888 msiexec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe 3328 im3bF3.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4148 msiexec.exe Token: SeIncreaseQuotaPrivilege 4148 msiexec.exe Token: SeSecurityPrivilege 2888 msiexec.exe Token: SeCreateTokenPrivilege 4148 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4148 msiexec.exe Token: SeLockMemoryPrivilege 4148 msiexec.exe Token: SeIncreaseQuotaPrivilege 4148 msiexec.exe Token: SeMachineAccountPrivilege 4148 msiexec.exe Token: SeTcbPrivilege 4148 msiexec.exe Token: SeSecurityPrivilege 4148 msiexec.exe Token: SeTakeOwnershipPrivilege 4148 msiexec.exe Token: SeLoadDriverPrivilege 4148 msiexec.exe Token: SeSystemProfilePrivilege 4148 msiexec.exe Token: SeSystemtimePrivilege 4148 msiexec.exe Token: SeProfSingleProcessPrivilege 4148 msiexec.exe Token: SeIncBasePriorityPrivilege 4148 msiexec.exe Token: SeCreatePagefilePrivilege 4148 msiexec.exe Token: SeCreatePermanentPrivilege 4148 msiexec.exe Token: SeBackupPrivilege 4148 msiexec.exe Token: SeRestorePrivilege 4148 msiexec.exe Token: SeShutdownPrivilege 4148 msiexec.exe Token: SeDebugPrivilege 4148 msiexec.exe Token: SeAuditPrivilege 4148 msiexec.exe Token: SeSystemEnvironmentPrivilege 4148 msiexec.exe Token: SeChangeNotifyPrivilege 4148 msiexec.exe Token: SeRemoteShutdownPrivilege 4148 msiexec.exe Token: SeUndockPrivilege 4148 msiexec.exe Token: SeSyncAgentPrivilege 4148 msiexec.exe Token: SeEnableDelegationPrivilege 4148 msiexec.exe Token: SeManageVolumePrivilege 4148 msiexec.exe Token: SeImpersonatePrivilege 4148 msiexec.exe Token: SeCreateGlobalPrivilege 4148 msiexec.exe Token: SeBackupPrivilege 1128 vssvc.exe Token: SeRestorePrivilege 1128 vssvc.exe Token: SeAuditPrivilege 1128 vssvc.exe Token: SeBackupPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeBackupPrivilege 5052 srtasks.exe Token: SeRestorePrivilege 5052 srtasks.exe Token: SeSecurityPrivilege 5052 srtasks.exe Token: SeTakeOwnershipPrivilege 5052 srtasks.exe Token: SeBackupPrivilege 5052 srtasks.exe Token: SeRestorePrivilege 5052 srtasks.exe Token: SeSecurityPrivilege 5052 srtasks.exe Token: SeTakeOwnershipPrivilege 5052 srtasks.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4148 msiexec.exe 4148 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2888 wrote to memory of 5052 2888 msiexec.exe 93 PID 2888 wrote to memory of 4852 2888 msiexec.exe 96 PID 3328 wrote to memory of 4132 3328 im3bF3.exe 112 PID 4132 wrote to memory of 2128 4132 cmd.exe 114 PID 4132 wrote to memory of 5044 4132 cmd.exe 115 PID 4132 wrote to memory of 2540 4132 cmd.exe 119 PID 2136 wrote to memory of 4628 2136 cmd.exe 122 PID 3328 wrote to memory of 3028 3328 im3bF3.exe 123 PID 3028 wrote to memory of 2292 3028 cmd.exe 126 PID 3028 wrote to memory of 4780 3028 cmd.exe 127 PID 3028 wrote to memory of 4616 3028 cmd.exe 129 PID 3184 wrote to memory of 3520 3184 cmd.exe 131 PID 3328 wrote to memory of 1032 3328 im3bF3.exe 133 PID 1032 wrote to memory of 4468 1032 cmd.exe 135 PID 1032 wrote to memory of 4140 1032 cmd.exe 136 PID 1032 wrote to memory of 744 1032 cmd.exe 138 PID 4076 wrote to memory of 4572 4076 cmd.exe 140 PID 3328 wrote to memory of 2376 3328 im3bF3.exe 142 PID 2376 wrote to memory of 736 2376 cmd.exe 144 PID 2376 wrote to memory of 2348 2376 cmd.exe 145 PID 2376 wrote to memory of 5100 2376 cmd.exe 148 PID 5044 wrote to memory of 1428 5044 cmd.exe 149 PID 3328 wrote to memory of 1052 3328 im3bF3.exe 150 PID 1052 wrote to memory of 4852 1052 cmd.exe 152 PID 1052 wrote to memory of 1852 1052 cmd.exe 153 PID 4904 wrote to memory of 2156 4904 cmd.exe 156 PID 1052 wrote to memory of 4780 1052 cmd.exe 157 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\appinstall.8835005.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4148
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2D02365179553C191109D3D3452A125D E Global\MSI00002⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
C:\Users\Public\aoEuaz\im3bF3.exeC:\Users\Public\aoEuaz\im3bF3.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\aoEuaz\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\aoEuaz\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2128
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5044
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2292
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4780
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4468
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4140
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:736
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2348
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4852
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1852
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4780
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\aoEuaz" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\aoEuaz" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4628
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:2700
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3520
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4572
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1428
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2156
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5875f7.rbs
- Size 7KB
- SHA256 e68feb7f1a76e4ce9d8c589d8b91916b40f430aa116af2098f1ee99b35f20d5f
- MD5 a6fd52f14fe7f050c9d899a0d78deffb
- SHA1 dc0fc8ca6e97f4d1ec12929594fff79b00244ec0
- SHA512 a2898e2d668cd595519bb7fbfe9ff832a133b45a50e34c90c522069d4341ccf894899e183e734b0cff979f01abf2734b4b4c5a6841862bd3ec5c159fd5136c8e
- SSDEEP 192:n3eQrv8WbI1WbMSwFc3JHsS15ePCBvp5EA+rCRm8X:nmWOW104
- TLSH T17AF13F42B6444AE2F8D31F7AC7435B6A37B2D7E94314A31F44CD44701F427C9DEAA58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\aoEuaz\UxEnhance64.dll
- Size 3.1MB
- SHA256 960e3d50edc71db232547a9c1ac245c3177b8d9d0d75d1cd1e2f7b0b24941506
- MD5 ec9700afdbebc889dabf415421132459
- SHA1 9632a08df96ac8f1ced8139a5894c599829dd779
- SHA512 a7a0a47fe6a4e6b30b82d7862a90814a49020eb50ef82da355efdfa74c06ec8f0a478a14ddbc23f5988f3da13a4473f3b4002763f47be92a2a1b4feea93b17c9
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+2:P9m29xx3Tiqt06ox6+z2rNNrKo2
- TLSH T105E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\aoEuaz\adoresd.dat
- Size 4.8MB
- SHA256 56a7588d02cc496df1786dfae49923c156ec4ad50951dd7d7e24eac6072211c0
- MD5 9a9822213b087c1a89576b092157a688
- SHA1 19bc5409eb13df4cb2226972aa00eea6ddf68d94
- SHA512 d645e452bbe61076fe5fb715cf8631031df56c5aa4d48a0348d079a08cfc6e7459467de0b163918a59fd4a4f79b1e37720e9b4d85ff4cf4c8c43cba5d0c74b73
- SSDEEP 98304:fuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:oQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1FB363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\aoEuaz\im3bF3.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\aoEuaz\msadox.tb
- Size 8KB
- SHA256 9837f2ca73f3ef987161a1f2cda5b02f55e828088778402cac602aa425f325f7
- MD5 8d9a158329de0de75f06c6a3086e77ae
- SHA1 2e3194139d95906c1b6c731fa9827bc1cb8157b3
- SHA512 0445f80ebe54da5cb025249a970cdc1eb0bea9bb43eca6efe50d79361b66cbc2cc3cd34ff53234b0e900719f628aa1bfa32ecd32e434fde2781796c7dd6ed7d1
- SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
- TLSH T13B029E06D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI776E.tmp
- Size 7.2MB
- SHA256 08d1da18eae6507f100884754220a8be14454b6dc7d53b41143cfeb736501ba7
- MD5 2124b1ade058ec726be101ca6d0b46be
- SHA1 0c572704e1acb6cd2069bcdf2c0b8a1180eb4355
- SHA512 dcd154d6f1c6d60f886d417e57a012bfe5411861d2f110a950db1836b941be376dd7927954ab7e31226144317782d66e2ab2fa8829292d4522d1165b83ac950a
- SSDEEP 196608:pNszuSrjTkP4BJJufIgnv1t9GRPHmimAiLOA:pNlIjTiOJu5t9aHTiSA
- TLSH T1DB7633DA1CC9B3BAD06BC3B4C646303E782D37C27D6A4E03B1D836111D7571A29BAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5875f6.msi
- Size 7.2MB
- SHA256 a3bae9537265a350771bb624ac2b3ba0910e2fc1666d1ef97d277a667aaca354
- MD5 14e64c8ae7ccd663a9b243c3a0fd92a5
- SHA1 17a1b6edd181ff8da2fcec5088ee75c9777a42c5
- SHA512 03e5051f615600895176e182554b44ba91dcc971586f3fed2839074fbd3dd0181efda94fca619d37eafbfe6499b781325639b30b9f6dcb42dae5ccdd5cf2e0b5
- SSDEEP 196608:aNszuSrjTkP4gJJufIgnv1t9GRPHmimAiLOg:aNlIjTirJu5t9aHTiSg
- TLSH T19076339A2CC9B7B6D05BC3B08647703E782D3FC27E6A4D03B2D836111D7171629BAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 982cdc3953961e37fe8c6a3b3b97eff1cd60c03a7825cd344a9bb34764ccfbf6
- MD5 1d338b1275acd3d4ee34068f25cb7555
- SHA1 d3ac12757262cc9d71c47c4ab4e93fc9d9049021
- SHA512 52fbffd20393d9dc5f36763035be00a9103592504a3725fb7975c0da5131318ce2c1cc84ce693f6e6c731bca3c46d153067fbeab0478a2dbace5b10353b1b9b6
- SSDEEP 24576:cu8m+1zrdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:E
- TLSH T1FD47D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c59c4bc9-9882-4721-b03b-30a2f86398da}_OnDiskSnapshotProp
- Size 6KB
- SHA256 7bab0582b929b43271ca818c83e36a324220dca9352be764996dc5c3b276c3db
- MD5 709e2bc24d4a11a4c25115397108bb95
- SHA1 443f32e3a323ca0505373f9bcb65ca915589d8c9
- SHA512 f5e43a50eada9f5270058275a7dc187cf89b167e03c5394810a3cdd4caeba9a2bb993a2990a4df667b80896e57d5371371e25baf4afb7b35ef1db8549a6121eb
- SSDEEP 96:FtMBhdVyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:MX7Ib++ZVm
- TLSH T175D178185AF54711E2B3AB3129F18557A837B911EF33CB8E0198238E6670A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH