Overview
overview
7Static
static
3dvorak-key...64.msi
windows10-2004-x64
7dvorak-key...64.msi
windows11-ltsc_2024-x64
7dvorak-key...86.msi
windows10-2004-x64
6dvorak-key...86.msi
windows11-ltsc_2024-x64
6dvorak-key...64.msi
windows10-2004-x64
6dvorak-key...64.msi
windows11-ltsc_2024-x64
6dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...up.exe
windows10-2004-x64
7dvorak-key...up.exe
windows11-ltsc_2024-x64
7dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 22:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target dvorak-keyboard/dvorak/setup.exe
- Size 139KB
- Sample260718-11ekssd15l
- SHA256 1b3b4e920bebbf0b15bf7fbfc3f446e4322a6bd89d2dddaec64e1b1ebb675ca6
- MD5 c87b96c702b2ae528f71a6994e82ca62
- SHA1 226142ffb00f1986f16aedb0adc19df51766557e
- SHA512 caf13a6d6fad6935d3705371ff8d4167d6238785a07db38557e53ff1786e51492c1012624ef5445682ff206b67589db8a4e9f9c5a577a992a0246258604e2b84
- SSDEEP 3072:ezWP5D4zAed3ojyYKcJ3oUjoXper4GPT1Z/GdmkTdPiQV:vD4zAetUKdWoXeLrOdl5Pi
- TLSH T1A3D3AE01B3D4D139F4F72A72E57951B24B3A7C366F31D38FA304562E2AB5A81DA31362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1328 MsiExec.exe 1328 MsiExec.exe 1328 MsiExec.exe 1328 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: setup.exe File opened (read-only) \??\J: setup.exe File opened (read-only) \??\N: setup.exe File opened (read-only) \??\P: setup.exe File opened (read-only) \??\U: setup.exe File opened (read-only) \??\Y: setup.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: setup.exe File opened (read-only) \??\R: setup.exe File opened (read-only) \??\T: setup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: setup.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: setup.exe File opened (read-only) \??\O: setup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: setup.exe File opened (read-only) \??\V: setup.exe File opened (read-only) \??\X: setup.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: setup.exe File opened (read-only) \??\S: setup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: setup.exe File opened (read-only) \??\L: setup.exe File opened (read-only) \??\W: setup.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: setup.exe File opened (read-only) \??\H: setup.exe File opened (read-only) \??\Z: setup.exe File opened (read-only) \??\L: msiexec.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\Dvorak.dll msiexec.exe File created C:\Windows\SysWOW64\Dvorak.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\Dvorak.dll setup.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e589a86.msi msiexec.exe File opened for modification C:\Windows\Installer\e589a86.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A56E1AA9-28B3-4108-9092-661113C6C712} msiexec.exe File opened for modification C:\Windows\Installer\MSI9B8F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C6B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9CD9.tmp msiexec.exe File created C:\Windows\Installer\e589a88.msi msiexec.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4896 4344 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\International\AcceptLanguage = "en-US,en;q=0.8,de-DE;q=0.5,de;q=0.2" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4532 msiexec.exe 4532 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4344 setup.exe Token: SeIncreaseQuotaPrivilege 4344 setup.exe Token: SeSecurityPrivilege 4532 msiexec.exe Token: SeCreateTokenPrivilege 4344 setup.exe Token: SeAssignPrimaryTokenPrivilege 4344 setup.exe Token: SeLockMemoryPrivilege 4344 setup.exe Token: SeIncreaseQuotaPrivilege 4344 setup.exe Token: SeMachineAccountPrivilege 4344 setup.exe Token: SeTcbPrivilege 4344 setup.exe Token: SeSecurityPrivilege 4344 setup.exe Token: SeTakeOwnershipPrivilege 4344 setup.exe Token: SeLoadDriverPrivilege 4344 setup.exe Token: SeSystemProfilePrivilege 4344 setup.exe Token: SeSystemtimePrivilege 4344 setup.exe Token: SeProfSingleProcessPrivilege 4344 setup.exe Token: SeIncBasePriorityPrivilege 4344 setup.exe Token: SeCreatePagefilePrivilege 4344 setup.exe Token: SeCreatePermanentPrivilege 4344 setup.exe Token: SeBackupPrivilege 4344 setup.exe Token: SeRestorePrivilege 4344 setup.exe Token: SeShutdownPrivilege 4344 setup.exe Token: SeDebugPrivilege 4344 setup.exe Token: SeAuditPrivilege 4344 setup.exe Token: SeSystemEnvironmentPrivilege 4344 setup.exe Token: SeChangeNotifyPrivilege 4344 setup.exe Token: SeRemoteShutdownPrivilege 4344 setup.exe Token: SeUndockPrivilege 4344 setup.exe Token: SeSyncAgentPrivilege 4344 setup.exe Token: SeEnableDelegationPrivilege 4344 setup.exe Token: SeManageVolumePrivilege 4344 setup.exe Token: SeImpersonatePrivilege 4344 setup.exe Token: SeCreateGlobalPrivilege 4344 setup.exe Token: SeBackupPrivilege 3964 vssvc.exe Token: SeRestorePrivilege 3964 vssvc.exe Token: SeAuditPrivilege 3964 vssvc.exe Token: SeBackupPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4344 setup.exe 4344 setup.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4532 wrote to memory of 212 4532 msiexec.exe 92 PID 4532 wrote to memory of 1328 4532 msiexec.exe 94 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\setup.exe"C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\setup.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 8762⤵
- Program crash
PID:4896
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:212
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24A81C838A04B606BD68267702E2114C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1328
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4344 -ip 43441⤵PID:1556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589a87.rbs
- Size 11KB
- SHA256 18470363e205c530b31a3340e93314617a77b527a368fa4c499bda5629d35211
- MD5 443c34f3f0bc7a4ed24ff2ccd6987d07
- SHA1 7388847b0c4eb0356f9d61cbc02337fb63342faf
- SHA512 c0e47db618334268e17d991ca16be3306bc116d56195ba5f0f4d0ebe7c27b7a6551b6c2de9163b03676f78a38b20d3abeef94aa850d0338da420527a4aaa06d8
- SSDEEP 192:R5vtPKaOPvmwdYQ1+FdYQ1rIdoZnOqdCEpMH8HdZAA/i:RZZQV2VXha
- TLSH T122321000FA68D586E8B21B35D62B27683B72F3CBDA1427CF408DC4644F53789CA6974E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9C6B.tmp
- Size 55KB
- SHA256 51ecd80a8d868820fec1e9a939be55723434c3b0f8d54e66bb78512a7298e4c0
- MD5 9bc979bcb75e3dd95644f8e075c9e5cd
- SHA1 a5f98b6d961924335342e81e1b104f2449cae25d
- SHA512 081c974c278807207ee469674d2325f58c11f754325f5a0654fe942ece4be31f6a1c600b964691201aa92f37eea36cbd4444dce1c57a1558cbc9a9b33088c172
- SSDEEP 768:h+VX3KRO3SgvI8uMW10++cPuGbBinCi6vy/jRae:h+VXJ3lIMW10i2AinCNvy/Fae
- TLSH T13E437D02B758D052F8E61C71817EDAE2797DFEB14B21C94BE255B5AE2C363C2EA30705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Dvorak.dll
- Size 6KB
- SHA256 98763086c0fd7e56624e16b372e55c7096e03deb88650bc586cfeefd062c1b6a
- MD5 39c7392f72703ec37d4d11b4d1a14571
- SHA1 6ddc447ff386652db0183532158ca109a89dd659
- SHA512 b9a47c4955d3b99c241003e7d1f8dd8c580afcf34b9e07b57b84d12a56ec26bd0a49927123b07e49c396023b18b05c51d5f42b2afcc2fca6df92eb632a9319dc
- SSDEEP 48:qwg9Iw+AAgynkYIoarJMVcEjFzuyLT7N8a+q7moWhJUn6Wcu1rDE082Actqsx7Si:Uu1aKcEuyHJ8xnoW86WjVEmrd1ee
- TLSH T179D11F80DFF5813DF2FFCB3814B6662678257D2294F3CA6D1191064B58AF6409F19B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 92e9557b9850b1b4d2d50f1262ff734a54680d0dcfed9ecce5849041210d0892
- MD5 66fc0e939284ab6254b361b1f7b4dfa7
- SHA1 88549c9d271927753c62a80f06ee360c130c89fb
- SHA512 ebb2d7ebca7c1537b54df61b0c67db8901871864cf207ebbade918e03464665cdb1af7a089120a61bfa96b82a97f7798790e4ceb156772a00ee2dcf50422abda
- SSDEEP 24576:Lu8m+1z3doO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:X
- TLSH T1DA47F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6f2b344e-fbc1-4e39-9f1c-805f67a59195}_OnDiskSnapshotProp
- Size 6KB
- SHA256 67e5e0a43beaa67d644eb7dc7109ecbee48aa0767698c59182a0415ca95af924
- MD5 2778cd5e3341271753c6b41385c8c4b0
- SHA1 28cb45d3bb427207c7ae9df842350a69513a44f4
- SHA512 8c38122fceaca9ee4f0ea1694382cf713e0b3e5ff054eaa6ac0e62e6506f3af32a84e2e4989125513ee4aa75ccb646741d06fd30f27477bb9dd077c7dd380e75
- SSDEEP 96:FyeUfFDvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ninb++ZVm
- TLSH T129D188085AF54711E2B3AB3229F14557A837B951EF33CB8E0298278E6670A10F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH