Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appstup.38680016.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
appstup.38680016.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target appstup.38680016.msi
- Size 8.8MB
- Sample260721-vkp4psfk21
- SHA256 126070b35db492df13f436665e6ebe403686d467217b77e4a11d24ab4ded9131
- MD5 f1f9e978a07c36cb5de718733747057e
- SHA1 41da2f110a0453c80c33cea4a8a36e104b24be26
- SHA512 8ceb77698bccda1aa2d0197c0f8b1a9774a681a8470a0e6889587ca11f4f47aa754553e923933ebf6cd5d1372461c9994257c28371224848642a427c9aa0abbd
- SSDEEP 98304:ipCl/GPLlZbbcLmSwBtznHa7Q/oQx2rLEEJ/U5aJOBrwgl6DUr3q/YCDCvALLfwU:hYrbcLm/BvnsEERmYiMqkTD8A/v5
- TLSH T1DB9633C978C99770D18BC7B48283E15E7D1A3FC675229C0F3A943B846E716212B7A36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1792 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 11 1792 MsiExec.exe 12 1792 MsiExec.exe 14 1792 MsiExec.exe 16 1792 MsiExec.exe 17 1792 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59ca3c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFE65DC1A9A91DEF14.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID0B5.tmp msiexec.exe File created C:\Windows\Installer\e59ca3c.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DEB810EB-854C-4347-31EA-54CE741E7ECA} msiexec.exe File created C:\Windows\SystemTemp\~DF2E9B59238B08D5C7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICF7B.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2480 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4340 msiexec.exe 4340 msiexec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 2480 msiexec.exe Token: SeIncreaseQuotaPrivilege 2480 msiexec.exe Token: SeSecurityPrivilege 4340 msiexec.exe Token: SeCreateTokenPrivilege 2480 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2480 msiexec.exe Token: SeLockMemoryPrivilege 2480 msiexec.exe Token: SeIncreaseQuotaPrivilege 2480 msiexec.exe Token: SeMachineAccountPrivilege 2480 msiexec.exe Token: SeTcbPrivilege 2480 msiexec.exe Token: SeSecurityPrivilege 2480 msiexec.exe Token: SeTakeOwnershipPrivilege 2480 msiexec.exe Token: SeLoadDriverPrivilege 2480 msiexec.exe Token: SeSystemProfilePrivilege 2480 msiexec.exe Token: SeSystemtimePrivilege 2480 msiexec.exe Token: SeProfSingleProcessPrivilege 2480 msiexec.exe Token: SeIncBasePriorityPrivilege 2480 msiexec.exe Token: SeCreatePagefilePrivilege 2480 msiexec.exe Token: SeCreatePermanentPrivilege 2480 msiexec.exe Token: SeBackupPrivilege 2480 msiexec.exe Token: SeRestorePrivilege 2480 msiexec.exe Token: SeShutdownPrivilege 2480 msiexec.exe Token: SeDebugPrivilege 2480 msiexec.exe Token: SeAuditPrivilege 2480 msiexec.exe Token: SeSystemEnvironmentPrivilege 2480 msiexec.exe Token: SeChangeNotifyPrivilege 2480 msiexec.exe Token: SeRemoteShutdownPrivilege 2480 msiexec.exe Token: SeUndockPrivilege 2480 msiexec.exe Token: SeSyncAgentPrivilege 2480 msiexec.exe Token: SeEnableDelegationPrivilege 2480 msiexec.exe Token: SeManageVolumePrivilege 2480 msiexec.exe Token: SeImpersonatePrivilege 2480 msiexec.exe Token: SeCreateGlobalPrivilege 2480 msiexec.exe Token: SeBackupPrivilege 3508 vssvc.exe Token: SeRestorePrivilege 3508 vssvc.exe Token: SeAuditPrivilege 3508 vssvc.exe Token: SeBackupPrivilege 4340 msiexec.exe Token: SeRestorePrivilege 4340 msiexec.exe Token: SeRestorePrivilege 4340 msiexec.exe Token: SeTakeOwnershipPrivilege 4340 msiexec.exe Token: SeRestorePrivilege 4340 msiexec.exe Token: SeTakeOwnershipPrivilege 4340 msiexec.exe Token: SeRestorePrivilege 4340 msiexec.exe Token: SeTakeOwnershipPrivilege 4340 msiexec.exe Token: SeBackupPrivilege 2092 srtasks.exe Token: SeRestorePrivilege 2092 srtasks.exe Token: SeSecurityPrivilege 2092 srtasks.exe Token: SeTakeOwnershipPrivilege 2092 srtasks.exe Token: SeBackupPrivilege 2092 srtasks.exe Token: SeRestorePrivilege 2092 srtasks.exe Token: SeSecurityPrivilege 2092 srtasks.exe Token: SeTakeOwnershipPrivilege 2092 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2480 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2480 msiexec.exe 4340 msiexec.exe 1792 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4340 wrote to memory of 2092 4340 msiexec.exe 94 PID 4340 wrote to memory of 1792 4340 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\appstup.38680016.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2480
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding ECFD4639F3B8434E1E5A0DA238901E13 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1792
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSID0B5.tmp
- Size 8.8MB
- SHA256 5e89749762bcca138395783e5dab5cf326bd198ec62be9b16ab2f38c9cba056c
- MD5 1059126cd6386700f06925f4ed6de083
- SHA1 d271fdf41e03c0d26276d9bb2b6db7e71e76fe42
- SHA512 8370912bede7cf11b6629805a549adb4ad96135619a6b917a46f561b7d8247e3848b594199a97da61ca17ef005ec92c8449cb61f01b143552dff24b728ea6005
- SSDEEP 98304:VpCl/GPLlZbbcLmSwBtznHa7Q/oQx2rLEEJ/U5EJOBrwgl6DUr3q/YCDCvAL/fw8:4YrbcLm/BvnsEERmWiMqkTD8AbvV
- TLSH T1C99633C969CA9774D18FC7B48283A06E7C5B33CA74366C0E7AD40F849E726112B7936D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 4937ac6e189b2d78873d2e7df35de9ea8c5587ec8c3e605f87f3557772f37284
- MD5 1b70d3c5348b5124f7af6be989e82794
- SHA1 7d3c3f3306eb89c8358458adf5180f3ecd61236d
- SHA512 079fa91cdf8129b877d86c8ca701c8ec98117feac4fdb10fcde884abb6a85bd28f79b67c6ec3025c849b7ac5e01bfad3b7bc3ff4cde62961d67c558b91746bb8
- SSDEEP 24576:IFo3DMPVdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+o:sHk
- TLSH T1D657E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{52b8b6d0-e33e-448d-824f-4eec97e29352}_OnDiskSnapshotProp
- Size 6KB
- SHA256 83f788ce81458c11e107e0bdc05a49930400dd63c9450bcb095436e4f8b90486
- MD5 0dfd8a224b20d72fc0294925887222ea
- SHA1 c02aecde19fd0356b0bc548d9c057008a6243489
- SHA512 6679add40b592b58bbc2edec09eb3e90587adda6d0306ee53dbee3fa95afaa16c15bc5d88383da9bef58853d5f3c122cb7cd0fca21e70138a45e890c7b2fb9ce
- SSDEEP 96:FZuQSOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:L/b++uVmN
- TLSH T140D187081AF54711E2B3AB3128F58557A877B912FF33CB8E0198238E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH