a3bae9537265a350771bb624ac2b3ba0910e2fc1666d1ef97d277a667aaca354

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appinstall.8835005.msi
Size 7.2MB
Sample260716-e2nzzacz5q
SHA256 a3bae9537265a350771bb624ac2b3ba0910e2fc1666d1ef97d277a667aaca354
MD5 14e64c8ae7ccd663a9b243c3a0fd92a5
SHA1 17a1b6edd181ff8da2fcec5088ee75c9777a42c5
SHA512 03e5051f615600895176e182554b44ba91dcc971586f3fed2839074fbd3dd0181efda94fca619d37eafbfe6499b781325639b30b9f6dcb42dae5ccdd5cf2e0b5
SSDEEP 196608:aNszuSrjTkP4gJJufIgnv1t9GRPHmimAiLOg:aNlIjTirJu5t9aHTiSg
TLSH
T19076339A2CC9B7B6D05BC3B08647703E782D3FC27E6A4D03B2D836111D7171629BAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence privilege_escalation ransomware

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	MsiExec.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	MsiExec.exe

Loads dropped DLL 1 IoCs

pid	Process
4724	MsiExec.exe

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4724	MsiExec.exe
9	4724	MsiExec.exe
10	4724	MsiExec.exe
11	4724	MsiExec.exe
13	4724	MsiExec.exe
14	4724	MsiExec.exe
15	4724	MsiExec.exe
16	4724	MsiExec.exe
17	4724	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59a0e9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7A822713B224C8B7.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA677.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA715.tmp	msiexec.exe
File created	C:\Windows\Installer\e59a0e9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5EACB53F426439CB.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a0eb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1920B9D3D9128CF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2F33C229EF06C44C.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4560	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "2C85FE63A7ACD6D44B87E043FBCE1954"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "appinstall.8835005.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5856	msiexec.exe
5856	msiexec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe
4724	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4560	msiexec.exe
Token: SeSecurityPrivilege	5856	msiexec.exe
Token: SeCreateTokenPrivilege	4560	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4560	msiexec.exe
Token: SeLockMemoryPrivilege	4560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4560	msiexec.exe
Token: SeMachineAccountPrivilege	4560	msiexec.exe
Token: SeTcbPrivilege	4560	msiexec.exe
Token: SeSecurityPrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeLoadDriverPrivilege	4560	msiexec.exe
Token: SeSystemProfilePrivilege	4560	msiexec.exe
Token: SeSystemtimePrivilege	4560	msiexec.exe
Token: SeProfSingleProcessPrivilege	4560	msiexec.exe
Token: SeIncBasePriorityPrivilege	4560	msiexec.exe
Token: SeCreatePagefilePrivilege	4560	msiexec.exe
Token: SeCreatePermanentPrivilege	4560	msiexec.exe
Token: SeBackupPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeShutdownPrivilege	4560	msiexec.exe
Token: SeDebugPrivilege	4560	msiexec.exe
Token: SeAuditPrivilege	4560	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4560	msiexec.exe
Token: SeChangeNotifyPrivilege	4560	msiexec.exe
Token: SeRemoteShutdownPrivilege	4560	msiexec.exe
Token: SeUndockPrivilege	4560	msiexec.exe
Token: SeSyncAgentPrivilege	4560	msiexec.exe
Token: SeEnableDelegationPrivilege	4560	msiexec.exe
Token: SeManageVolumePrivilege	4560	msiexec.exe
Token: SeImpersonatePrivilege	4560	msiexec.exe
Token: SeCreateGlobalPrivilege	4560	msiexec.exe
Token: SeBackupPrivilege	2804	vssvc.exe
Token: SeRestorePrivilege	2804	vssvc.exe
Token: SeAuditPrivilege	2804	vssvc.exe
Token: SeBackupPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeBackupPrivilege	3740	srtasks.exe
Token: SeRestorePrivilege	3740	srtasks.exe
Token: SeSecurityPrivilege	3740	srtasks.exe
Token: SeTakeOwnershipPrivilege	3740	srtasks.exe
Token: SeBackupPrivilege	3740	srtasks.exe
Token: SeRestorePrivilege	3740	srtasks.exe
Token: SeSecurityPrivilege	3740	srtasks.exe
Token: SeTakeOwnershipPrivilege	3740	srtasks.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4560	msiexec.exe
4560	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4560	msiexec.exe
5856	msiexec.exe
4724	MsiExec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3740	5856	msiexec.exe	92
PID 5856 wrote to memory of 4724	5856	msiexec.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\appinstall.8835005.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 03161C7BD48F870171DB29E39A6EEA74 E Global\MSI0000
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a0ea.rbs

Path C:\Config.Msi\e59a0ea.rbs
Size 7KB
SHA256 2f6b1e6f2c71268cba6a33ab751bf8bffa802452e21ceb7e8af4f5820926e20a
MD5 7dfb0bed79abda1f2944d2acc2272f37
SHA1 ff55c6ae5c072ced4618942e99732d00ec3266b4
SHA512 5fa36baa05b6dc07d81ae76db9b3b51a777b89093935a10a3a10e66251f6545b8f8524ca89eda27187ccba91770b8cc09ac045c8dd2ad49035b9c316423d68f0
SSDEEP 192:yBCXWv8WbI1WbMSwF83JHsS15ePCBvp5EA+rCRm8X:ymWOWr04
TLSH
T15FF13F42B6484AE2F8D31F3AC7035B6A37B6D7E94314A30F44CD48701F43789DEAA58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA715.tmp

Path C:\Windows\Installer\MSIA715.tmp
Size 7.2MB
SHA256 08d1da18eae6507f100884754220a8be14454b6dc7d53b41143cfeb736501ba7
MD5 2124b1ade058ec726be101ca6d0b46be
SHA1 0c572704e1acb6cd2069bcdf2c0b8a1180eb4355
SHA512 dcd154d6f1c6d60f886d417e57a012bfe5411861d2f110a950db1836b941be376dd7927954ab7e31226144317782d66e2ab2fa8829292d4522d1165b83ac950a
SSDEEP 196608:pNszuSrjTkP4BJJufIgnv1t9GRPHmimAiLOA:pNlIjTiOJu5t9aHTiSA
TLSH
T1DB7633DA1CC9B3BAD06BC3B4C646303E782D37C27D6A4E03B1D836111D7571A29BAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a0e9.msi

Path C:\Windows\Installer\e59a0e9.msi
Size 7.2MB
SHA256 a3bae9537265a350771bb624ac2b3ba0910e2fc1666d1ef97d277a667aaca354
MD5 14e64c8ae7ccd663a9b243c3a0fd92a5
SHA1 17a1b6edd181ff8da2fcec5088ee75c9777a42c5
SHA512 03e5051f615600895176e182554b44ba91dcc971586f3fed2839074fbd3dd0181efda94fca619d37eafbfe6499b781325639b30b9f6dcb42dae5ccdd5cf2e0b5
SSDEEP 196608:aNszuSrjTkP4gJJufIgnv1t9GRPHmimAiLOg:aNlIjTirJu5t9aHTiSg
TLSH
T19076339A2CC9B7B6D05BC3B08647703E782D3FC27E6A4D03B2D836111D7171629BAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 4975a8e938d390992282752db47eacca94e8c47ba4d9ba62bb22496f7b5510e1
MD5 8a9d00bb56b400aa7151b5f2d54d47c5
SHA1 8166bcd3a01403b2318e05fe64417b188b741549
SHA512 069ef96bcceb76e77ec58122f432d25694302a02cfdad790d2f0be792a0ba47732e5fedb01028b4f5be00d149c002346ee3f9b551a4dfdab81f2fe6b61be4428
SSDEEP 24576:rFo3DMPudoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuI:gHk
TLSH
T10A57B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5b3d580d-07f2-4b1a-a339-8dc928198e70}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5b3d580d-07f2-4b1a-a339-8dc928198e70}_OnDiskSnapshotProp
Size 6KB
SHA256 f39f6a0471fb95d200a95dd37f1a7fa51b4adfd42c08c3a7767e7b71294050bc
MD5 82450329ddb79d5fd3f8064c099f8521
SHA1 7ec449fe2fffa4a5ae1a8cf860e509460d31757a
SHA512 8ab69a288544bb630c42b220896eebc495d24445208becdc34df9c4681e552d448d5c5835b610180fb374ec1671b63d92e6c1e4c0988ef161438ac6205f5e1aa
SSDEEP 96:FW6lvvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:wwb++uVm
TLSH
T1F8D178185AF54711E2B3AB3169F18557A877B911FF33CB8E0198238E2631A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4724-14-0x00007FFBFE450000-0x00007FFBFE452000-memory.dmp

Download

memory/4724-15-0x00007FFBDAD50000-0x00007FFBDB390000-memory.dmp

Download

memory/4724-18-0x00007FFBF4480000-0x00007FFBF4492000-memory.dmp

Download

memory/4724-36-0x00007FFBF4480000-0x00007FFBF4492000-memory.dmp

Download

memory/4724-44-0x00007FFBF4480000-0x00007FFBF4492000-memory.dmp

Download