Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.1.0.2286300021.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.1.0.2286300021.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target setup.1.0.2286300021.msi
- Size 9.6MB
- Sample260722-dhp79aaa57
- SHA256 48897bb03b6bc0b60ab01cad89c1464131e74b00f313809856d300ad50615fb6
- MD5 3bb97504f1cad118ff78f77a8514aa5c
- SHA1 bafab085467c9240a751eb5e878b7e00f72e65c1
- SHA512 4c4707804f03947e8b973ff88fd22bd2709bf9ca3a28d29c7a62e536533bcaeca3cadb6de4f14685853d34458c9b90856edaae91af10a9c14831fa41360f1c1e
- SSDEEP 196608:qI92DlIp+CK4ceVdZGeztvFAaL8H67158sIGN50y+w4D3HOX2RE7OA2gU237ZL:qI9aQZGez92a/4EVn4SWEWgftL
- TLSH T138A633C1F8896370E0CBE375590278FEBD1EBFC9B666484674E83A415BF26252376381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\iOiPSQ = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation Ue1PLf.exe - Executes dropped EXE 1 IoCs
pid Process 3292 Ue1PLf.exe - Loads dropped DLL 2 IoCs
pid Process 3096 MsiExec.exe 3292 Ue1PLf.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\iOiPSQ\\Ue1PLf.exe\"" Ue1PLf.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 3096 MsiExec.exe 12 3096 MsiExec.exe 16 3096 MsiExec.exe 36 3096 MsiExec.exe 38 3096 MsiExec.exe 39 3096 MsiExec.exe 50 3096 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 2068 cmd.exe 4620 cmd.exe 4440 cmd.exe 3192 cmd.exe 3472 cmd.exe - Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b Ue1PLf.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\dLucx1 Ue1PLf.exe File created C:\Program Files (x86)\dLucx1\dLucx1.exe Ue1PLf.exe File created C:\Program Files (x86)\dLucx1\XPSPLOG.dll Ue1PLf.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e5847b4.msi msiexec.exe File created C:\Windows\Installer\e5847b2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e5847b2.msi msiexec.exe File created C:\Windows\Installer\SourceHash{DEB810EB-854C-4347-31EA-54CE741E7ECA} msiexec.exe File opened for modification C:\Windows\Installer\MSI489D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI493A.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 712 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4128 cmd.exe 2880 cmd.exe 720 cmd.exe 2440 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0D998F6B083E84562400466342627EF\BE018BEDC458743413AE45EC47E1E7AC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE018BEDC458743413AE45EC47E1E7AC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\PackageName = "setup.1.0.2286300021.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE018BEDC458743413AE45EC47E1E7AC\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\ProductName = "Google Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0D998F6B083E84562400466342627EF msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\PackageCode = "0F8FF5D3332A76F46BEF84143260EE05" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2412 schtasks.exe 4736 schtasks.exe 2620 schtasks.exe 988 schtasks.exe 3252 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3920 msiexec.exe 3920 msiexec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe 3292 Ue1PLf.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 712 msiexec.exe Token: SeIncreaseQuotaPrivilege 712 msiexec.exe Token: SeSecurityPrivilege 3920 msiexec.exe Token: SeCreateTokenPrivilege 712 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 712 msiexec.exe Token: SeLockMemoryPrivilege 712 msiexec.exe Token: SeIncreaseQuotaPrivilege 712 msiexec.exe Token: SeMachineAccountPrivilege 712 msiexec.exe Token: SeTcbPrivilege 712 msiexec.exe Token: SeSecurityPrivilege 712 msiexec.exe Token: SeTakeOwnershipPrivilege 712 msiexec.exe Token: SeLoadDriverPrivilege 712 msiexec.exe Token: SeSystemProfilePrivilege 712 msiexec.exe Token: SeSystemtimePrivilege 712 msiexec.exe Token: SeProfSingleProcessPrivilege 712 msiexec.exe Token: SeIncBasePriorityPrivilege 712 msiexec.exe Token: SeCreatePagefilePrivilege 712 msiexec.exe Token: SeCreatePermanentPrivilege 712 msiexec.exe Token: SeBackupPrivilege 712 msiexec.exe Token: SeRestorePrivilege 712 msiexec.exe Token: SeShutdownPrivilege 712 msiexec.exe Token: SeDebugPrivilege 712 msiexec.exe Token: SeAuditPrivilege 712 msiexec.exe Token: SeSystemEnvironmentPrivilege 712 msiexec.exe Token: SeChangeNotifyPrivilege 712 msiexec.exe Token: SeRemoteShutdownPrivilege 712 msiexec.exe Token: SeUndockPrivilege 712 msiexec.exe Token: SeSyncAgentPrivilege 712 msiexec.exe Token: SeEnableDelegationPrivilege 712 msiexec.exe Token: SeManageVolumePrivilege 712 msiexec.exe Token: SeImpersonatePrivilege 712 msiexec.exe Token: SeCreateGlobalPrivilege 712 msiexec.exe Token: SeBackupPrivilege 1564 vssvc.exe Token: SeRestorePrivilege 1564 vssvc.exe Token: SeAuditPrivilege 1564 vssvc.exe Token: SeBackupPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeBackupPrivilege 2096 srtasks.exe Token: SeRestorePrivilege 2096 srtasks.exe Token: SeSecurityPrivilege 2096 srtasks.exe Token: SeTakeOwnershipPrivilege 2096 srtasks.exe Token: SeBackupPrivilege 2096 srtasks.exe Token: SeRestorePrivilege 2096 srtasks.exe Token: SeSecurityPrivilege 2096 srtasks.exe Token: SeTakeOwnershipPrivilege 2096 srtasks.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe Token: SeTakeOwnershipPrivilege 3920 msiexec.exe Token: SeRestorePrivilege 3920 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 712 msiexec.exe 712 msiexec.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3920 wrote to memory of 2096 3920 msiexec.exe 92 PID 3920 wrote to memory of 3096 3920 msiexec.exe 94 PID 3292 wrote to memory of 3192 3292 Ue1PLf.exe 105 PID 3192 wrote to memory of 2412 3192 cmd.exe 108 PID 3292 wrote to memory of 3472 3292 Ue1PLf.exe 109 PID 3192 wrote to memory of 4956 3192 cmd.exe 111 PID 3472 wrote to memory of 4736 3472 cmd.exe 113 PID 3192 wrote to memory of 1692 3192 cmd.exe 114 PID 3472 wrote to memory of 3344 3472 cmd.exe 115 PID 3472 wrote to memory of 2568 3472 cmd.exe 116 PID 4128 wrote to memory of 4772 4128 cmd.exe 118 PID 3292 wrote to memory of 2068 3292 Ue1PLf.exe 120 PID 2068 wrote to memory of 2620 2068 cmd.exe 123 PID 2068 wrote to memory of 4192 2068 cmd.exe 124 PID 2068 wrote to memory of 4696 2068 cmd.exe 127 PID 2880 wrote to memory of 1552 2880 cmd.exe 128 PID 3292 wrote to memory of 4620 3292 Ue1PLf.exe 129 PID 4620 wrote to memory of 988 4620 cmd.exe 131 PID 4620 wrote to memory of 3836 4620 cmd.exe 132 PID 4620 wrote to memory of 748 4620 cmd.exe 134 PID 3292 wrote to memory of 4440 3292 Ue1PLf.exe 135 PID 4440 wrote to memory of 3252 4440 cmd.exe 137 PID 4440 wrote to memory of 4260 4440 cmd.exe 139 PID 4440 wrote to memory of 412 4440 cmd.exe 142 PID 2440 wrote to memory of 1784 2440 cmd.exe 143 PID 720 wrote to memory of 4616 720 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.1.0.2286300021.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:712
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CC7BE3A004DE620B06E237F005A50CF5 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
C:\Users\Public\iOiPSQ\Ue1PLf.exeC:\Users\Public\iOiPSQ\Ue1PLf.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\iOiPSQ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\iOiPSQ\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2412
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4956
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4736
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3344
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2620
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4192
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:988
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3836
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3252
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4260
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:412
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\iOiPSQ" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\iOiPSQ" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4772
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:1896
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1552
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4616
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1784
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5847b3.rbs
- Size 7KB
- SHA256 9ae9dfe8fc9efa62646a61735acf34f0eb0ed699f64e962c1ae7c14795646a64
- MD5 b25eeadb7ec6040af373e408388af50c
- SHA1 7b25b478012ef4c79393ad9450e037c990c132ce
- SHA512 ec7f563e3fd21b6be6f82e47a1d51bab5abb14884697ecdcb8e15b967b8fceecfe5a53c58a0b0e6f4c1e32d5b3e8a8d564e291a889ac4f7c44fd106b79f80b00
- SSDEEP 96:0R1RHkeeYhUUg51CsThqiUg51C6jhtQ8VThqSHcT5B5W+/AaCKpljhT3MjjBZy:02eRzIIIkIIE0tsKp/
- TLSH T17DF13202B70482D6FC965739CB4B1B5637AAC3D5C310635B06CE82606F8F78E6ED169B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\iOiPSQ\Ue1PLf.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\iOiPSQ\UxEnhance64.dll
- Size 3.1MB
- SHA256 bf130451e768de94256f5bcd8e3b17108a35e77a9291226749fadd7d63330dee
- MD5 b635038ca05798cd34c41c71cad8f347
- SHA1 fbd517328a3717a3733d3db957ae3b552fc4377d
- SHA512 f049af953429ff387f48641fec2b5c3d9eb1f7b4885255a4aa369fd9d1506898ff9e2a439071243c3b4bfde11159fd20a81cf7f85c5d3f1793c21d492ebb0a92
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+p:P9m29xx3Tiqt06ox6+z2rNNrKop
- TLSH T1EDE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\iOiPSQ\adoresd.dat
- Size 4.8MB
- SHA256 9c1bc04331d1f7b5e62a85f73492200f4923ef0c32e09009743f224c8a9c41a6
- MD5 bd161122fc550bbbeec9268dd90b866d
- SHA1 f6422eb89f9e37a84b737b26e198324c29e93c3a
- SHA512 7beccc2989301a0cb68c58c7bdb120ebddca39fb89de8202b516d7781cd101cc6a82832c939d7fce4ae194bdda8a0f0e233cc50541539fe0ee4d17ca7f3fc1cf
- SSDEEP 98304:EuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:ZQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1C5363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\iOiPSQ\msadox.tb
- Size 8KB
- SHA256 5fb1c3b9b59eb8a7d999fba80c32fac535c1a60b239a70ed20dfe7a7936a7406
- MD5 1f033808b43914c3b5e5a8787a2bfab9
- SHA1 9ac092f897338b9ff18458d87d6126c2c9543730
- SHA512 427108d7ed98631710eb8d6229eec8d9e09ff586b2bd51ea8231c52b09f25c2a64b5d2121fed0ac951a32101d31a674a9de359b4dba0019cf6ca316511a08d3b
- SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
- TLSH T19B029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI493A.tmp
- Size 9.6MB
- SHA256 254b42ad49fc53764fb55a4fc6dc0f56a122295945d40b64c285299b09c1961e
- MD5 09ca50a295425177084b259d4a7c9417
- SHA1 2b4822c4062b4d644211f6f7b33f6aa70395aa92
- SHA512 10ddd21e1575ffa7b07ec68226e0c7b1c7460b4db611d36d99f6a28d5a5aecb0c0b4f359946718e382f8ed0062930b218425b3d01e515031afecf265d90fb68f
- SSDEEP 196608:MI92DlIp+CK4ceVdZGeztvFAaL8H671z8sIGN50y+w4D3HzX2RE7OA2gU237ZX:MI9aQZGez92a/uEVn4fWEWgftX
- TLSH T133A633C1B88963B0E1CBE375694278FEBD0E7FC9B5B60C4674E82A415FE26152376381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5847b2.msi
- Size 9.6MB
- SHA256 48897bb03b6bc0b60ab01cad89c1464131e74b00f313809856d300ad50615fb6
- MD5 3bb97504f1cad118ff78f77a8514aa5c
- SHA1 bafab085467c9240a751eb5e878b7e00f72e65c1
- SHA512 4c4707804f03947e8b973ff88fd22bd2709bf9ca3a28d29c7a62e536533bcaeca3cadb6de4f14685853d34458c9b90856edaae91af10a9c14831fa41360f1c1e
- SSDEEP 196608:qI92DlIp+CK4ceVdZGeztvFAaL8H67158sIGN50y+w4D3HOX2RE7OA2gU237ZL:qI9aQZGez92a/4EVn4SWEWgftL
- TLSH T138A633C1F8896370E0CBE375590278FEBD1EBFC9B666484674E83A415BF26252376381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 100c71d937ac64c87172284611adfb72513381e58402db4623ef1be00edc9702
- MD5 4a557838411457546365169b11183026
- SHA1 5a0c7f1021ff3367e7069c60cf7933f1c76e5c52
- SHA512 b02cf5dc89e441a81a34ee84d4337b8c6adc003624415f18a2b2ebe25ba47222ca7b6e109a4052795dd647d7f10347c29b1baa3b3ca3bdc6d76b6e2b74875dee
- SSDEEP 24576:Xu8m+1zXdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:b
- TLSH T16547B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8b2c9415-916b-4842-866a-76e06bd3963d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c8070f7f852f37ec6f2e701296a69d2bbf62506073d253b505fd150965b46efa
- MD5 77d23ac453effda6a7195dcdc6cf08a5
- SHA1 fec28edd9ae718aaf73990a7533b7da99ed36f59
- SHA512 8cfb71428df0cf46f912abdda477b34b75efc816d34a9b5de2161f9f46968e952beec5f8889e01e3665e881e4033af1ae8a7949d39f4d2e839ee35822b6e1274
- SSDEEP 96:FNlJCGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:TuGPGnb++ZVmN
- TLSH T12DD199085AF54711E2B3AB3229F14557A877B811EF33CB8E0198238E2630910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH