Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.1.0.2286300021.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.1.0.2286300021.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target setup.1.0.2286300021.msi
- Size 9.6MB
- Sample260722-dhp79aaa56
- SHA256 9d0af2d65f8030de57257c93020f9e53ef037099bf2b8851d1ccc71c54bef165
- MD5 8ba98be96bfcb3ba7b3a5d1114f19c44
- SHA1 6b038bc97e6174610fdc2be2a0033e65b6defcb5
- SHA512 4b501cb0cffacc35607c484dadcb10d90f147d64f6ad2cea03be377a8d06da3ce91f2fa33eab3d155c7472b01943c452909bae9e1ae1d33dd92ab11957c19dcc
- SSDEEP 196608:qI92DlIp+CK4ceVdZGeztvFAaL8H67158sIGN50y+w4D3HOX2RE7OA2gU237Zz:qI9aQZGez92a/4EVn4SWEWgftz
- TLSH T1DCA633C1F8896370E0CBE375590278FEBD1EBFC9B666484674E83A415BF26252376381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\treEPQ = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation 6TWEIf.exe - Executes dropped EXE 2 IoCs
pid Process 1428 6TWEIf.exe 3916 6TWEIf.exe - Loads dropped DLL 3 IoCs
pid Process 2864 MsiExec.exe 1428 6TWEIf.exe 3916 6TWEIf.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\treEPQ\\6TWEIf.exe\"" 6TWEIf.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 2864 MsiExec.exe 15 2864 MsiExec.exe 20 2864 MsiExec.exe 22 2864 MsiExec.exe 30 2864 MsiExec.exe 33 2864 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 4 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4520 cmd.exe 4488 cmd.exe 4780 cmd.exe 4204 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 6TWEIf.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\zfEZ2b 6TWEIf.exe File created C:\Program Files (x86)\zfEZ2b\zfEZ2b.exe 6TWEIf.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e5868c7.msi msiexec.exe File opened for modification C:\Windows\Installer\e5868c7.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DEB810EB-854C-4347-31EA-54CE741E7ECA} msiexec.exe File opened for modification C:\Windows\Installer\MSI6A00.tmp msiexec.exe File created C:\Windows\Installer\e5868c9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI6A8D.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1660 msiexec.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4320 cmd.exe 2604 cmd.exe 4420 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\ProductName = "Google Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE018BEDC458743413AE45EC47E1E7AC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Version = "84017285" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0D998F6B083E84562400466342627EF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\PackageName = "setup.1.0.2286300021.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE018BEDC458743413AE45EC47E1E7AC\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\PackageCode = "0F8FF5D3332A76F46BEF84143260EE05" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0D998F6B083E84562400466342627EF\BE018BEDC458743413AE45EC47E1E7AC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Clients = 3a0000000000 msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 720 schtasks.exe 6080 schtasks.exe 4400 schtasks.exe 1860 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 msiexec.exe 3880 msiexec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe 1428 6TWEIf.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeSecurityPrivilege 3880 msiexec.exe Token: SeCreateTokenPrivilege 1660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1660 msiexec.exe Token: SeLockMemoryPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeMachineAccountPrivilege 1660 msiexec.exe Token: SeTcbPrivilege 1660 msiexec.exe Token: SeSecurityPrivilege 1660 msiexec.exe Token: SeTakeOwnershipPrivilege 1660 msiexec.exe Token: SeLoadDriverPrivilege 1660 msiexec.exe Token: SeSystemProfilePrivilege 1660 msiexec.exe Token: SeSystemtimePrivilege 1660 msiexec.exe Token: SeProfSingleProcessPrivilege 1660 msiexec.exe Token: SeIncBasePriorityPrivilege 1660 msiexec.exe Token: SeCreatePagefilePrivilege 1660 msiexec.exe Token: SeCreatePermanentPrivilege 1660 msiexec.exe Token: SeBackupPrivilege 1660 msiexec.exe Token: SeRestorePrivilege 1660 msiexec.exe Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeDebugPrivilege 1660 msiexec.exe Token: SeAuditPrivilege 1660 msiexec.exe Token: SeSystemEnvironmentPrivilege 1660 msiexec.exe Token: SeChangeNotifyPrivilege 1660 msiexec.exe Token: SeRemoteShutdownPrivilege 1660 msiexec.exe Token: SeUndockPrivilege 1660 msiexec.exe Token: SeSyncAgentPrivilege 1660 msiexec.exe Token: SeEnableDelegationPrivilege 1660 msiexec.exe Token: SeManageVolumePrivilege 1660 msiexec.exe Token: SeImpersonatePrivilege 1660 msiexec.exe Token: SeCreateGlobalPrivilege 1660 msiexec.exe Token: SeBackupPrivilege 6116 vssvc.exe Token: SeRestorePrivilege 6116 vssvc.exe Token: SeAuditPrivilege 6116 vssvc.exe Token: SeBackupPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeBackupPrivilege 5468 srtasks.exe Token: SeRestorePrivilege 5468 srtasks.exe Token: SeSecurityPrivilege 5468 srtasks.exe Token: SeTakeOwnershipPrivilege 5468 srtasks.exe Token: SeBackupPrivilege 5468 srtasks.exe Token: SeRestorePrivilege 5468 srtasks.exe Token: SeSecurityPrivilege 5468 srtasks.exe Token: SeTakeOwnershipPrivilege 5468 srtasks.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe Token: SeTakeOwnershipPrivilege 3880 msiexec.exe Token: SeRestorePrivilege 3880 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1660 msiexec.exe 1660 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3880 wrote to memory of 5468 3880 msiexec.exe 91 PID 3880 wrote to memory of 2864 3880 msiexec.exe 93 PID 1428 wrote to memory of 4488 1428 6TWEIf.exe 111 PID 4488 wrote to memory of 720 4488 cmd.exe 114 PID 1428 wrote to memory of 4780 1428 6TWEIf.exe 115 PID 4488 wrote to memory of 5416 4488 cmd.exe 117 PID 4780 wrote to memory of 6080 4780 cmd.exe 119 PID 4488 wrote to memory of 6032 4488 cmd.exe 121 PID 4780 wrote to memory of 4612 4780 cmd.exe 122 PID 4780 wrote to memory of 540 4780 cmd.exe 123 PID 4320 wrote to memory of 3684 4320 cmd.exe 124 PID 1428 wrote to memory of 4204 1428 6TWEIf.exe 126 PID 4204 wrote to memory of 4400 4204 cmd.exe 129 PID 4204 wrote to memory of 4088 4204 cmd.exe 130 PID 2604 wrote to memory of 1140 2604 cmd.exe 133 PID 4204 wrote to memory of 3412 4204 cmd.exe 134 PID 1428 wrote to memory of 4520 1428 6TWEIf.exe 135 PID 4520 wrote to memory of 1860 4520 cmd.exe 137 PID 4520 wrote to memory of 5316 4520 cmd.exe 138 PID 4520 wrote to memory of 1472 4520 cmd.exe 141 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.1.0.2286300021.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1660
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5468
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 13148C16C4A8BA81859B58FE68ECAFD0 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6116
-
C:\Users\Public\treEPQ\6TWEIf.exeC:\Users\Public\treEPQ\6TWEIf.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\treEPQ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\treEPQ\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:720
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5416
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:6032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6080
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4612
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4400
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4088
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1860
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5316
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1472
-
-
-
C:\Users\Public\treEPQ\6TWEIf.exe"C:\Users\Public\treEPQ\6TWEIf.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3916
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\treEPQ" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\treEPQ" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3684
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:1224
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1140
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:4420
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5868c8.rbs
- Size 7KB
- SHA256 989059aec7d70691a373b019f472dab48ab4b8009ad6d0ef434db5afd5b6aa3a
- MD5 160848135d07173f4e22b7690e0d8036
- SHA1 358c0a5cf812adc99e2623d26505e80a0703c017
- SHA512 b9fc9566670eb3169c88c2469c3088a38873f5eee17adce659a0139602c539b062bcd8ebdc8a5e6352902c2fdd73d325b01b7e1850ac1a42588f6474ecff31a3
- SSDEEP 96:3R1RHkeChhUUg51CsThqiUg51C6jhtQ8VThqSHcT5B5W+/AaCKpljhT3MjjBZy:32e2zIIIkIIE0tsKp/
- TLSH T162F14102B60042EAFD965338CB4B1B5637AAC3D5C310631B06CE82602F4F38E6ED169B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\treEPQ\6TWEIf.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\treEPQ\UxEnhance64.dll
- Size 3.1MB
- SHA256 f417af9784123168f1772aacdb15a9af98292e28154de78cbe4564e25a6eba6a
- MD5 8bc5a08c919520beae411732aeed834b
- SHA1 ce6619bd802d0be8db47a35d0882d0b5a14cef71
- SHA512 faf941e817b093b215c4434c56b81ddf5da56f67de9278ca5c3eacd8239f5f75c2d92500f813098a63790e64bb12649920756868984873a9b9874d93bd4ff367
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+g:P9m29xx3Tiqt06ox6+z2rNNrKog
- TLSH T153E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\treEPQ\adoresd.dat
- Size 4.8MB
- SHA256 4ad74a8de4bc4d38132234d30e52020ee6f2388acafc5cdb2f84b97c8f2232fb
- MD5 cc9f4ef1b32be0e36bc79601635bb1bd
- SHA1 0bf219085f829caa4c8aaaa3c26861f1cb57a43c
- SHA512 effdfb10d6d10b2dfee351f529e327df343e1ec4b8affc7b47f404d782ef0a7eace09655f0c950b7c9303d12bc9d4ab264e26a1f6e5591bad980bf8ff54c18f3
- SSDEEP 98304:buZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:cQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T18F363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\treEPQ\msadox.tb
- Size 8KB
- SHA256 736af574d2f8015532fcceeff2aa5d8e5ae832c6865c0e5d919ab3fb1b9bff27
- MD5 7942b25209a1dff2a52f0e83651fd0de
- SHA1 b057dfd3e7bcff0207b996fc9d44358f25a85b88
- SHA512 0e69dbcacca661be9c2789c39425fa5da14718456de97cb06019fed834ca1b41f282fead4396b5366403841b5bbd87b7d6d9a3b5a8a88e840d296120e50e996a
- SSDEEP 192:3qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:3sZqZOXQ3uqvR2Kfzp
- TLSH T17E029E05D7B20CC3E6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6A8D.tmp
- Size 9.6MB
- SHA256 254b42ad49fc53764fb55a4fc6dc0f56a122295945d40b64c285299b09c1961e
- MD5 09ca50a295425177084b259d4a7c9417
- SHA1 2b4822c4062b4d644211f6f7b33f6aa70395aa92
- SHA512 10ddd21e1575ffa7b07ec68226e0c7b1c7460b4db611d36d99f6a28d5a5aecb0c0b4f359946718e382f8ed0062930b218425b3d01e515031afecf265d90fb68f
- SSDEEP 196608:MI92DlIp+CK4ceVdZGeztvFAaL8H671z8sIGN50y+w4D3HzX2RE7OA2gU237ZX:MI9aQZGez92a/uEVn4fWEWgftX
- TLSH T133A633C1B88963B0E1CBE375694278FEBD0E7FC9B5B60C4674E82A415FE26152376381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5868c7.msi
- Size 9.6MB
- SHA256 9d0af2d65f8030de57257c93020f9e53ef037099bf2b8851d1ccc71c54bef165
- MD5 8ba98be96bfcb3ba7b3a5d1114f19c44
- SHA1 6b038bc97e6174610fdc2be2a0033e65b6defcb5
- SHA512 4b501cb0cffacc35607c484dadcb10d90f147d64f6ad2cea03be377a8d06da3ce91f2fa33eab3d155c7472b01943c452909bae9e1ae1d33dd92ab11957c19dcc
- SSDEEP 196608:qI92DlIp+CK4ceVdZGeztvFAaL8H67158sIGN50y+w4D3HOX2RE7OA2gU237Zz:qI9aQZGez92a/4EVn4SWEWgftz
- TLSH T1DCA633C1F8896370E0CBE375590278FEBD1EBFC9B666484674E83A415BF26252376381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 f9c4353ca8180c53d937f3c725ffcd8ed6037369d9a74f3671099bb1218ede2c
- MD5 5b1d570c2629c43f94025ffc5d7e9f51
- SHA1 78375e7df974528e72d0a3f6d10348c1427454b3
- SHA512 766c50cbb8a9f2a3f1b0bbf260d9dcaabfa23cba9d2886f315edf6439be2130ddfa09e7fa02db68d273c4566d8487bdf21c593483bff031243182dd10b5f3093
- SSDEEP 24576:0u8m+1zydoO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:t
- TLSH T16F47C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7e593678-c915-4a19-a1c8-6ee3739a2d76}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c1d24fda7a99abd61b6f437469af89d5e0bcbc3ecaf7b81dee9701be15298faa
- MD5 7180f745960ff83e2f8acb92d7e061fa
- SHA1 aef00d98dfd955b88d3b9fdc6b9ca1abc120495b
- SHA512 0be6792f24d06b7a168edf8ac030c8dfd068c297bc9d24bdc1f74e3803a2d44a4fa2df535ae4d1a249aac6ef257742f184a798b00778cfa7094ae9c65ba6a9b3
- SSDEEP 96:F/ln2vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:N6b++ZVmN
- TLSH T1B2D189185AE54311E2B3AB7129F18557A877B811EF33CB8E0198638E6670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH