Overview
overview
7Static
static
3dvorak-key...64.msi
windows10-2004-x64
7dvorak-key...64.msi
windows11-ltsc_2024-x64
7dvorak-key...86.msi
windows10-2004-x64
6dvorak-key...86.msi
windows11-ltsc_2024-x64
6dvorak-key...64.msi
windows10-2004-x64
6dvorak-key...64.msi
windows11-ltsc_2024-x64
6dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...up.exe
windows10-2004-x64
7dvorak-key...up.exe
windows11-ltsc_2024-x64
7dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 22:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target dvorak-keyboard/dvorak/setup.exe
- Size 139KB
- Sample260718-11ekssd15l
- SHA256 1b3b4e920bebbf0b15bf7fbfc3f446e4322a6bd89d2dddaec64e1b1ebb675ca6
- MD5 c87b96c702b2ae528f71a6994e82ca62
- SHA1 226142ffb00f1986f16aedb0adc19df51766557e
- SHA512 caf13a6d6fad6935d3705371ff8d4167d6238785a07db38557e53ff1786e51492c1012624ef5445682ff206b67589db8a4e9f9c5a577a992a0246258604e2b84
- SSDEEP 3072:ezWP5D4zAed3ojyYKcJ3oUjoXper4GPT1Z/GdmkTdPiQV:vD4zAetUKdWoXeLrOdl5Pi
- TLSH T1A3D3AE01B3D4D139F4F72A72E57951B24B3A7C366F31D38FA304562E2AB5A81DA31362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 3148 MsiExec.exe 3148 MsiExec.exe 3148 MsiExec.exe 3148 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: setup.exe File opened (read-only) \??\B: setup.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: setup.exe File opened (read-only) \??\G: setup.exe File opened (read-only) \??\K: setup.exe File opened (read-only) \??\S: setup.exe File opened (read-only) \??\Y: setup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: setup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: setup.exe File opened (read-only) \??\M: setup.exe File opened (read-only) \??\N: setup.exe File opened (read-only) \??\O: setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: setup.exe File opened (read-only) \??\U: setup.exe File opened (read-only) \??\X: setup.exe File opened (read-only) \??\Z: setup.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: setup.exe File opened (read-only) \??\T: setup.exe File opened (read-only) \??\W: setup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: setup.exe File opened (read-only) \??\V: setup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\L: setup.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dvorak.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\Dvorak.dll setup.exe File created C:\Windows\system32\Dvorak.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{A56E1AA9-28B3-4108-9092-661113C6C712} msiexec.exe File created C:\Windows\SystemTemp\~DF6D8684D10118943D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB1D2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2CD.tmp msiexec.exe File created C:\Windows\Installer\e59acc1.msi msiexec.exe File created C:\Windows\SystemTemp\~DFF9708D6AA42B0282.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB3A8.tmp msiexec.exe File created C:\Windows\Installer\e59acc3.msi msiexec.exe File created C:\Windows\SystemTemp\~DF4D9C41B0668E4816.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBB4ED038174FCDB9.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59acc1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\International\AcceptLanguage = "en-US,en;q=0.8,de-DE;q=0.5,de;q=0.2" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 msiexec.exe 2972 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5676 setup.exe Token: SeIncreaseQuotaPrivilege 5676 setup.exe Token: SeSecurityPrivilege 2972 msiexec.exe Token: SeCreateTokenPrivilege 5676 setup.exe Token: SeAssignPrimaryTokenPrivilege 5676 setup.exe Token: SeLockMemoryPrivilege 5676 setup.exe Token: SeIncreaseQuotaPrivilege 5676 setup.exe Token: SeMachineAccountPrivilege 5676 setup.exe Token: SeTcbPrivilege 5676 setup.exe Token: SeSecurityPrivilege 5676 setup.exe Token: SeTakeOwnershipPrivilege 5676 setup.exe Token: SeLoadDriverPrivilege 5676 setup.exe Token: SeSystemProfilePrivilege 5676 setup.exe Token: SeSystemtimePrivilege 5676 setup.exe Token: SeProfSingleProcessPrivilege 5676 setup.exe Token: SeIncBasePriorityPrivilege 5676 setup.exe Token: SeCreatePagefilePrivilege 5676 setup.exe Token: SeCreatePermanentPrivilege 5676 setup.exe Token: SeBackupPrivilege 5676 setup.exe Token: SeRestorePrivilege 5676 setup.exe Token: SeShutdownPrivilege 5676 setup.exe Token: SeDebugPrivilege 5676 setup.exe Token: SeAuditPrivilege 5676 setup.exe Token: SeSystemEnvironmentPrivilege 5676 setup.exe Token: SeChangeNotifyPrivilege 5676 setup.exe Token: SeRemoteShutdownPrivilege 5676 setup.exe Token: SeUndockPrivilege 5676 setup.exe Token: SeSyncAgentPrivilege 5676 setup.exe Token: SeEnableDelegationPrivilege 5676 setup.exe Token: SeManageVolumePrivilege 5676 setup.exe Token: SeImpersonatePrivilege 5676 setup.exe Token: SeCreateGlobalPrivilege 5676 setup.exe Token: SeBackupPrivilege 1252 vssvc.exe Token: SeRestorePrivilege 1252 vssvc.exe Token: SeAuditPrivilege 1252 vssvc.exe Token: SeBackupPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe Token: SeTakeOwnershipPrivilege 2972 msiexec.exe Token: SeRestorePrivilege 2972 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5676 setup.exe 5676 setup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2972 msiexec.exe 3148 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2972 wrote to memory of 5376 2972 msiexec.exe 94 PID 2972 wrote to memory of 3148 2972 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\setup.exe"C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\setup.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5376
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 719DCE6E7FE18B7F859ECCE2B47BE9A62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3148
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59acc2.rbs
- Size 11KB
- SHA256 9268138908083956a282cf4c4b15ce2bba4b23d2f010932fea9af51111ca2188
- MD5 8d79233c7110597ea58d33e7cb6f8f67
- SHA1 8859fb08740a2ba5113fba601ae2fd79c5927ee4
- SHA512 2f0dd0c33fcf3c761be42b4be10dabecd354caf6214bfaca86c6454b5a3db3d238a0da4ba673f60dfbe4ef7edcf7b11467250b2196c395cef9943c489eb5bac0
- SSDEEP 192:4kvtCFa3PNmwdYQ1+FdYQ1k7dqbZthCIEpGqZH0wYA6i:4YsuV2Vix7
- TLSH T115321141F248D6C2E8B21732C527175C3B73F3CAD614678B448CC0645FA3BD9EA6A386
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB2CD.tmp
- Size 55KB
- SHA256 51ecd80a8d868820fec1e9a939be55723434c3b0f8d54e66bb78512a7298e4c0
- MD5 9bc979bcb75e3dd95644f8e075c9e5cd
- SHA1 a5f98b6d961924335342e81e1b104f2449cae25d
- SHA512 081c974c278807207ee469674d2325f58c11f754325f5a0654fe942ece4be31f6a1c600b964691201aa92f37eea36cbd4444dce1c57a1558cbc9a9b33088c172
- SSDEEP 768:h+VX3KRO3SgvI8uMW10++cPuGbBinCi6vy/jRae:h+VXJ3lIMW10i2AinCNvy/Fae
- TLSH T13E437D02B758D052F8E61C71817EDAE2797DFEB14B21C94BE255B5AE2C363C2EA30705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Dvorak.dll
- Size 6KB
- SHA256 98763086c0fd7e56624e16b372e55c7096e03deb88650bc586cfeefd062c1b6a
- MD5 39c7392f72703ec37d4d11b4d1a14571
- SHA1 6ddc447ff386652db0183532158ca109a89dd659
- SHA512 b9a47c4955d3b99c241003e7d1f8dd8c580afcf34b9e07b57b84d12a56ec26bd0a49927123b07e49c396023b18b05c51d5f42b2afcc2fca6df92eb632a9319dc
- SSDEEP 48:qwg9Iw+AAgynkYIoarJMVcEjFzuyLT7N8a+q7moWhJUn6Wcu1rDE082Actqsx7Si:Uu1aKcEuyHJ8xnoW86WjVEmrd1ee
- TLSH T179D11F80DFF5813DF2FFCB3814B6662678257D2294F3CA6D1191064B58AF6409F19B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 eb93fbd658d5f9d69e500b007ecd32aecb1eb84bf1f64a926a12c7bab055399c
- MD5 09ccd64fe7fb967b30aec7bdf03b48ee
- SHA1 08df08a526ae24f95bb8fcf8539f2c96a050dfcc
- SHA512 a7ec36a5c8d22e775aacc2753814f2b30eb709ccf7dbfc6a33400ce8585d487bcaa3eb4f47b5e7dfd857191ac0b8f71b2f4e173d64b0ffefd88a2ab912370aed
- SSDEEP 24576:RFo3DMPEdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+n:QHk
- TLSH T13E57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4f46d4c7-aa99-4ca6-8506-e05d578c8129}_OnDiskSnapshotProp
- Size 6KB
- SHA256 715e46ee26feabe0abc57174aa8933c76341e10510bcb1fbd9a790fc56cf511f
- MD5 f43d971ceb3e293cd0392f2948dcc920
- SHA1 af7776c2f39d276baf130368598f25824696f845
- SHA512 cafd186ab482d01bca6f2609ab1a07e3e9f124ffd25c36df0bd1a6e23f923da93c56db03afd6787ef6f8079618cdf11ac12ef020ff106a0fcecda43aa0db7d41
- SSDEEP 96:F/IPbkvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:FI8b++uVm
- TLSH T175D177085AE54711E2B3AB3128F18557A877B911EF33CB8E0198238E6631A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH