Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 11:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appstup.32.0.6860010.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
appstup.32.0.6860010.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target appstup.32.0.6860010.msi
- Size 7.1MB
- Sample260721-nrt8nset3q
- SHA256 d670cc83ebde592b8ffbcbaf4dfcee93ffbb74ecdaeec2c59a0c7c2271ffb347
- MD5 a909d3ff70047e75d484a7b2bc231a59
- SHA1 c84753ee56835f676e5187da8e5ecfdd48444f97
- SHA512 a7a23d1d2537795d620b190c4d0582c6c5df2609b1066a92cd63a5967b4e79f2a8f1fdbc6f64871cb7d1a79d67aa981689616dd28bbb6f7b21d791741c6f2996
- SSDEEP 196608:DlZWpm3UJYajnGob9PXM1SqdKje4fOYkWqjGFo:ZZ+jJYvo5PXyvds99aGa
- TLSH T15376338A6C896378D09BC3748063B36EB2727FD5FE328D1B3AD87B185DB211411B7685
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4476 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 4476 MsiExec.exe 13 4476 MsiExec.exe 15 4476 MsiExec.exe 17 4476 MsiExec.exe 18 4476 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSID384.tmp msiexec.exe File created C:\Windows\Installer\e59ccdb.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ccdb.msi msiexec.exe File created C:\Windows\SystemTemp\~DF62ED468289CC4818.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF1AB79FCA2CC30166.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DD481E5F-35A7-771A-8B05-06755D11322E} msiexec.exe File opened for modification C:\Windows\Installer\MSID2D7.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 764 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4876 msiexec.exe 4876 msiexec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 4876 msiexec.exe Token: SeCreateTokenPrivilege 764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 764 msiexec.exe Token: SeLockMemoryPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeMachineAccountPrivilege 764 msiexec.exe Token: SeTcbPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 764 msiexec.exe Token: SeTakeOwnershipPrivilege 764 msiexec.exe Token: SeLoadDriverPrivilege 764 msiexec.exe Token: SeSystemProfilePrivilege 764 msiexec.exe Token: SeSystemtimePrivilege 764 msiexec.exe Token: SeProfSingleProcessPrivilege 764 msiexec.exe Token: SeIncBasePriorityPrivilege 764 msiexec.exe Token: SeCreatePagefilePrivilege 764 msiexec.exe Token: SeCreatePermanentPrivilege 764 msiexec.exe Token: SeBackupPrivilege 764 msiexec.exe Token: SeRestorePrivilege 764 msiexec.exe Token: SeShutdownPrivilege 764 msiexec.exe Token: SeDebugPrivilege 764 msiexec.exe Token: SeAuditPrivilege 764 msiexec.exe Token: SeSystemEnvironmentPrivilege 764 msiexec.exe Token: SeChangeNotifyPrivilege 764 msiexec.exe Token: SeRemoteShutdownPrivilege 764 msiexec.exe Token: SeUndockPrivilege 764 msiexec.exe Token: SeSyncAgentPrivilege 764 msiexec.exe Token: SeEnableDelegationPrivilege 764 msiexec.exe Token: SeManageVolumePrivilege 764 msiexec.exe Token: SeImpersonatePrivilege 764 msiexec.exe Token: SeCreateGlobalPrivilege 764 msiexec.exe Token: SeBackupPrivilege 1800 vssvc.exe Token: SeRestorePrivilege 1800 vssvc.exe Token: SeAuditPrivilege 1800 vssvc.exe Token: SeBackupPrivilege 4876 msiexec.exe Token: SeRestorePrivilege 4876 msiexec.exe Token: SeRestorePrivilege 4876 msiexec.exe Token: SeTakeOwnershipPrivilege 4876 msiexec.exe Token: SeRestorePrivilege 4876 msiexec.exe Token: SeTakeOwnershipPrivilege 4876 msiexec.exe Token: SeRestorePrivilege 4876 msiexec.exe Token: SeTakeOwnershipPrivilege 4876 msiexec.exe Token: SeBackupPrivilege 1520 srtasks.exe Token: SeRestorePrivilege 1520 srtasks.exe Token: SeSecurityPrivilege 1520 srtasks.exe Token: SeTakeOwnershipPrivilege 1520 srtasks.exe Token: SeBackupPrivilege 1520 srtasks.exe Token: SeRestorePrivilege 1520 srtasks.exe Token: SeSecurityPrivilege 1520 srtasks.exe Token: SeTakeOwnershipPrivilege 1520 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 764 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 764 msiexec.exe 4876 msiexec.exe 4476 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1520 4876 msiexec.exe 95 PID 4876 wrote to memory of 4476 4876 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\appstup.32.0.6860010.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:764
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FBB140AD2E088C5AD696A662D50718D9 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4476
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSID384.tmp
- Size 7.0MB
- SHA256 8e1c5cd1ae9e01543204659ede66bd75520c3c04ab1f12e05c20861577e6d489
- MD5 9a9743aa1b66051cbdc9c8c94246b6cb
- SHA1 f08fbc90c5e1167622b301ded94e8c0eae87bc2e
- SHA512 35e6aa355887ff224a70585a47c162d775d3f63b2c3c71063992369f40f6e43a5cab26337e0ad0c22659f5768bdece1a4f6b3af6237fbeb5356e743a6b368394
- SSDEEP 196608:7lZWpm3UJYajnGob9PXM2SqdKje4fOYkWqjGFZ:hZ+jJYvo5PXJvds99aGD
- TLSH T1977633CA6C897378D09BC375C0A3B26EB26277D5FD328D1E3AD85B188DB210415BB785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 bdbfc316d239dc539dfa0c5bacfca068b09e3edd066e252a7416965e39548bf3
- MD5 b001278961a431d308561515c146ef9c
- SHA1 067ecb37eeea8e0f4998483ef3ac625e086a151f
- SHA512 c92c94000a5b4b9d20c2704933679206e3eeb12c92e39720f28565390bf067f70a17acff3a80066f9f95758837a418739304269982460e69075678ddd0b53b55
- SSDEEP 24576:sFo3DMPidoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+X:bHM
- TLSH T12B57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{237e7cd0-0223-4a75-a8c7-807e44e26bbd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a3bd841f6db1edbae4dea2a60a408398a6b1468ca4daed7f7822a2d777ca46fc
- MD5 8436b9c9cac9241664697529457b4dba
- SHA1 e69878689965fc670fc20fe0f672f9c9d3874261
- SHA512 43bfa910196cfba37f9c82eb798f5bb84ecb56c8e4cbcb73fea7160f1f728f002a6565a978434315baa2ed2363e8fe58c360fd0849ec8f85970f222932ecb028
- SSDEEP 96:FeIxub3vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:0Ixmb++uVm
- TLSH T1EED187085AF54711E2B3AB712CF14557A837B951EF33CB8E0198238E2671A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH