Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 11:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
softinst.873360008.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
softinst.873360008.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target softinst.873360008.msi
- Size 8.1MB
- Sample260720-nf8xpags3r
- SHA256 f04551c246e3f33f03e7291c4fa957a88e0de8476797d8f3f8915d4b1aca3f5e
- MD5 faa6791976068cedad8f0a709a0942d2
- SHA1 e8fbfbdbf305f7cdbbac50201b47c90d03c82b5e
- SHA512 6349c2e316f9c5e725008b73e7d9c263a536be660a92fd5ccdd7ee63625983d9cafd99f0d4572d390c50cd064c69be9d56af67485dcac0fb4a54fdf66e9236aa
- SSDEEP 196608:arqFGqzHERRs3sGGz3LZiovAxm9Seh7Guz5:ae0qzHE0zGrdimSehX9
- TLSH T1148633D06CC22770C18BC7F1835265ADBD7D3FC9BA665D4A2AA9B5042EB371523B7308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3020 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 3020 MsiExec.exe 15 3020 MsiExec.exe 17 3020 MsiExec.exe 18 3020 MsiExec.exe 19 3020 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF629387C99141ADDB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6E03.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DD481E5F-35A7-771A-8B05-06755D11322E} msiexec.exe File created C:\Windows\SystemTemp\~DFC7910B397C405315.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6D47.tmp msiexec.exe File created C:\Windows\Installer\e59677a.msi msiexec.exe File opened for modification C:\Windows\Installer\e59677a.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2672 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5552 msiexec.exe 5552 msiexec.exe 3020 MsiExec.exe 3020 MsiExec.exe 3020 MsiExec.exe 3020 MsiExec.exe 3020 MsiExec.exe 3020 MsiExec.exe 3020 MsiExec.exe 3020 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 2672 msiexec.exe Token: SeIncreaseQuotaPrivilege 2672 msiexec.exe Token: SeSecurityPrivilege 5552 msiexec.exe Token: SeCreateTokenPrivilege 2672 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2672 msiexec.exe Token: SeLockMemoryPrivilege 2672 msiexec.exe Token: SeIncreaseQuotaPrivilege 2672 msiexec.exe Token: SeMachineAccountPrivilege 2672 msiexec.exe Token: SeTcbPrivilege 2672 msiexec.exe Token: SeSecurityPrivilege 2672 msiexec.exe Token: SeTakeOwnershipPrivilege 2672 msiexec.exe Token: SeLoadDriverPrivilege 2672 msiexec.exe Token: SeSystemProfilePrivilege 2672 msiexec.exe Token: SeSystemtimePrivilege 2672 msiexec.exe Token: SeProfSingleProcessPrivilege 2672 msiexec.exe Token: SeIncBasePriorityPrivilege 2672 msiexec.exe Token: SeCreatePagefilePrivilege 2672 msiexec.exe Token: SeCreatePermanentPrivilege 2672 msiexec.exe Token: SeBackupPrivilege 2672 msiexec.exe Token: SeRestorePrivilege 2672 msiexec.exe Token: SeShutdownPrivilege 2672 msiexec.exe Token: SeDebugPrivilege 2672 msiexec.exe Token: SeAuditPrivilege 2672 msiexec.exe Token: SeSystemEnvironmentPrivilege 2672 msiexec.exe Token: SeChangeNotifyPrivilege 2672 msiexec.exe Token: SeRemoteShutdownPrivilege 2672 msiexec.exe Token: SeUndockPrivilege 2672 msiexec.exe Token: SeSyncAgentPrivilege 2672 msiexec.exe Token: SeEnableDelegationPrivilege 2672 msiexec.exe Token: SeManageVolumePrivilege 2672 msiexec.exe Token: SeImpersonatePrivilege 2672 msiexec.exe Token: SeCreateGlobalPrivilege 2672 msiexec.exe Token: SeBackupPrivilege 5132 vssvc.exe Token: SeRestorePrivilege 5132 vssvc.exe Token: SeAuditPrivilege 5132 vssvc.exe Token: SeBackupPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeBackupPrivilege 2504 srtasks.exe Token: SeRestorePrivilege 2504 srtasks.exe Token: SeSecurityPrivilege 2504 srtasks.exe Token: SeTakeOwnershipPrivilege 2504 srtasks.exe Token: SeBackupPrivilege 2504 srtasks.exe Token: SeRestorePrivilege 2504 srtasks.exe Token: SeSecurityPrivilege 2504 srtasks.exe Token: SeTakeOwnershipPrivilege 2504 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2672 msiexec.exe 5552 msiexec.exe 3020 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5552 wrote to memory of 2504 5552 msiexec.exe 94 PID 5552 wrote to memory of 3020 5552 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\softinst.873360008.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2672
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E152878DB06849FB2638A1D77695B3BC E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI6E03.tmp
- Size 8.1MB
- SHA256 996be179d2c9cbd2b718d9540acc23ad9a2399dcaf9bace3a9dda2aa0fefce06
- MD5 9340465826641bca4d87e0c279c7e7eb
- SHA1 31893408074121d5180c40a8ffd1512d526d8573
- SHA512 6ed1bd479fb60df1c41e5adc93c2445c1190acefb79e894f0b34888a85433a1050b3d5874b79bd0acbb56a922911674e31ad7c5b72a94151dbd29b56087753da
- SSDEEP 196608:JrqFGqzHERRs3scGz3LZiovAxm9Seh7GuzT:Je0qzHE0ZGrdimSehXX
- TLSH T1828633D02C822770D18BC7F2835174BDBD7933C9FA7A5D5A2AA9B5041EA371923B7309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 213a276d395ec685b1ef45f44f45fe70cc0e358c5f92dc9110a9ab71af1469fe
- MD5 d3c6333b52f65f00964553a538b54be3
- SHA1 38bb9be48caf51fd405099e97693a36607981a91
- SHA512 8edbbee5237eff0e6c06ed6e6fb2da2dad10cf7e9098f2054d2976c464b1c24cb7e1d567bc9f1c19ac9d57f7ebb6babed425dc50866b4111417f048fce628478
- SSDEEP 24576:MFo3DMP/doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:uHI
- TLSH T19557B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{598d8185-1b23-4a67-b0e1-292acf4d7834}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e4ec22846f6259f0fcdf6500cdb2ae966e608bb5878827126b292e3d9fceabf9
- MD5 05552c514e3028bf92e8f878e50f298b
- SHA1 3a6fbbab827030b63e69c8682f8b56c558946e09
- SHA512 f501192747d2701a3883bb616f8cdcbdd797f60f0dd356b0afc0c78bc595a3c05e042222be3c98e61a95c3d101b55fd369db32e544558cc3cbf6e5bcb2eec021
- SSDEEP 96:FcwAIxubf7vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:GwAIxQ3b++uVm
- TLSH T18BD188084AF54711E2B3AB722CF14557A877B911EF33CB8E0198238E6671A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH