Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 16:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appstup.38680017.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
appstup.38680017.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target appstup.38680017.msi
- Size 6.2MB
- Sample260721-tt5ebazflf
- SHA256 d9ada9621ce68a5a891fc268c1642af78cf30012f3b95d38fa4e2a103038668c
- MD5 249871f3bdb0e557825d7ce0054d9456
- SHA1 fe162abb2bdbb234acf81d47790a67e71e901b9b
- SHA512 ff0e4a8cc5661d433e54a2c776f755342096fbe62ddfeaf10098cc8577c5794f8bbcba4c3b68b35b95b4b54c767bca836823fb42b7235e891530d76d668cb34b
- SSDEEP 196608:xfxrwbhmR4simfBL4FtFXfh+rX0seQsmDvzJeElfdzPfw5Y:xfx0IR4PmZL4FP0rXVeOJeidziY
- TLSH T15E663350798B37B4C04BC3B15146A65D3239BFC9DF9A8D1AFBE8370C1E7260144B6B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4224 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 4224 MsiExec.exe 13 4224 MsiExec.exe 16 4224 MsiExec.exe 17 4224 MsiExec.exe 18 4224 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI215A.tmp msiexec.exe File opened for modification C:\Windows\Installer\e591d42.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF0A13B28CAB9AD30C.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DEB810EB-854C-4347-31EA-54CE741E7ECA} msiexec.exe File created C:\Windows\SystemTemp\~DFAFEABD6C07DA7537.TMP msiexec.exe File created C:\Windows\Installer\e591d42.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI20EC.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4232 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1572 msiexec.exe 1572 msiexec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 4232 msiexec.exe Token: SeIncreaseQuotaPrivilege 4232 msiexec.exe Token: SeSecurityPrivilege 1572 msiexec.exe Token: SeCreateTokenPrivilege 4232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4232 msiexec.exe Token: SeLockMemoryPrivilege 4232 msiexec.exe Token: SeIncreaseQuotaPrivilege 4232 msiexec.exe Token: SeMachineAccountPrivilege 4232 msiexec.exe Token: SeTcbPrivilege 4232 msiexec.exe Token: SeSecurityPrivilege 4232 msiexec.exe Token: SeTakeOwnershipPrivilege 4232 msiexec.exe Token: SeLoadDriverPrivilege 4232 msiexec.exe Token: SeSystemProfilePrivilege 4232 msiexec.exe Token: SeSystemtimePrivilege 4232 msiexec.exe Token: SeProfSingleProcessPrivilege 4232 msiexec.exe Token: SeIncBasePriorityPrivilege 4232 msiexec.exe Token: SeCreatePagefilePrivilege 4232 msiexec.exe Token: SeCreatePermanentPrivilege 4232 msiexec.exe Token: SeBackupPrivilege 4232 msiexec.exe Token: SeRestorePrivilege 4232 msiexec.exe Token: SeShutdownPrivilege 4232 msiexec.exe Token: SeDebugPrivilege 4232 msiexec.exe Token: SeAuditPrivilege 4232 msiexec.exe Token: SeSystemEnvironmentPrivilege 4232 msiexec.exe Token: SeChangeNotifyPrivilege 4232 msiexec.exe Token: SeRemoteShutdownPrivilege 4232 msiexec.exe Token: SeUndockPrivilege 4232 msiexec.exe Token: SeSyncAgentPrivilege 4232 msiexec.exe Token: SeEnableDelegationPrivilege 4232 msiexec.exe Token: SeManageVolumePrivilege 4232 msiexec.exe Token: SeImpersonatePrivilege 4232 msiexec.exe Token: SeCreateGlobalPrivilege 4232 msiexec.exe Token: SeBackupPrivilege 3704 vssvc.exe Token: SeRestorePrivilege 3704 vssvc.exe Token: SeAuditPrivilege 3704 vssvc.exe Token: SeBackupPrivilege 1572 msiexec.exe Token: SeRestorePrivilege 1572 msiexec.exe Token: SeRestorePrivilege 1572 msiexec.exe Token: SeTakeOwnershipPrivilege 1572 msiexec.exe Token: SeRestorePrivilege 1572 msiexec.exe Token: SeTakeOwnershipPrivilege 1572 msiexec.exe Token: SeRestorePrivilege 1572 msiexec.exe Token: SeTakeOwnershipPrivilege 1572 msiexec.exe Token: SeBackupPrivilege 3252 srtasks.exe Token: SeRestorePrivilege 3252 srtasks.exe Token: SeSecurityPrivilege 3252 srtasks.exe Token: SeTakeOwnershipPrivilege 3252 srtasks.exe Token: SeBackupPrivilege 3252 srtasks.exe Token: SeRestorePrivilege 3252 srtasks.exe Token: SeSecurityPrivilege 3252 srtasks.exe Token: SeTakeOwnershipPrivilege 3252 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4232 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4232 msiexec.exe 1572 msiexec.exe 4224 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1572 wrote to memory of 3252 1572 msiexec.exe 94 PID 1572 wrote to memory of 4224 1572 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\appstup.38680017.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4232
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DB2B68B984828134BEF2FC0F3FC8E6DD E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4224
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI215A.tmp
- Size 6.2MB
- SHA256 4934e11478874d4447168559d25715514c57b4b152d145ed5abaaaa35498dc7a
- MD5 b360cbe6c68381b4b36791666dab9a09
- SHA1 0010ea58c6544e65978ce28f363af0391df2789d
- SHA512 53a1e666cc482e28d0c5d1b8a2997bd41d7824ab2c3b76b617e4a3cca2d138977bc0ca612d0c27ca58c94c5530a1628ddaac45a42c3532790a73bc786e6df730
- SSDEEP 196608:bfxrwbhmR4simfBL4FtFXfh+rX0seusmDvzJeElfdzPfw56:bfx0IR4PmZL4FP0rXVeAJeidzi6
- TLSH T152663350788B33B4C04BC3B15546B65D3239BFC9DE9A4D1AFBE83B0C5E725018876B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e641aceeef6fd27f214be4fb0df45e96a8f96abd52196c6d802387687c2de2bf
- MD5 1bb68652dcee97443d45eb1375d4966a
- SHA1 284d77b525b5e6a6ec1fc2d41b8c9164418648ca
- SHA512 9ec759266964636a825a1350eb144aee7aa12d95315dc292ed71a91b3ded76462a48d3a84831879279c27112539ceb243bb435fbea299796d5974f7428af8225
- SSDEEP 24576:5Fo3DMPLdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4NuR:nHQ
- TLSH T18257F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7af9aa44-0df9-4b52-b4b4-44ba6bf717d9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0390c8b54ef30799b658197a9d0e29be8d9271620865ea65e759ae598191ade9
- MD5 f6cc9d2559612eb166298f04dd4a21d5
- SHA1 6e15290dff485679f0e03867a9437108e04e5893
- SHA512 3828816b9b79f169c59e9a9e428490e0cbf9639d27381fbfd4501da7b02ac8186087c06e01f30798ee1a1c6e58c40515da1d5fd37dba0e6ea977b69408ef446d
- SSDEEP 96:FERHub3vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:gKb++uVmN
- TLSH T13ED1780C5AF54711E2F3AB3128F18557A877B912EF33CB8E0198238E6661910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH