Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
appstup.32.0.6tt0007.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
appstup.32.0.6tt0007.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target appstup.32.0.6tt0007.msi
- Size 5.1MB
- Sample260722-j73sja1grd
- SHA256 45f1df04305750f1e253293adc228071c212ec9e2fc7c9c985ba5e995e3749ca
- MD5 dab66a81b5cdeb1e8af322e43a86119c
- SHA1 c3e7ac6e0f330b84825a3543433600f1c6c08c2a
- SHA512 a12945a94d6c5f3d061cf226323281657d1f85137bb06178ab2d9220b7aa0ab17048e8beee304999a5c73a1821a595f0fbff02a561426586cfee937f8ad89645
- SSDEEP 98304:aree/cAqUO8niD14q0cfzlGtKlwgvALk2gzIuMoK4nfwjPSQz9YpmFl:zeUAq5E82nuhXfwrSTYn
- TLSH T1343633E679C662B0D087C3B19A53756EB0293FD76F115C1B37EA3A086EF2616D0B6340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2212 MsiExec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 2212 MsiExec.exe 13 2212 MsiExec.exe 14 2212 MsiExec.exe 15 2212 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFDEBEB00AE9C511FC.TMP msiexec.exe File created C:\Windows\Installer\e5992b1.msi msiexec.exe File opened for modification C:\Windows\Installer\e5992b1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF1CBE162E55F9CEF9.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DD481E5F-35A7-771A-8B05-06755D11322E} msiexec.exe File opened for modification C:\Windows\Installer\MSI9716.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9794.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5820 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1696 msiexec.exe 1696 msiexec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe 2212 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 5820 msiexec.exe Token: SeIncreaseQuotaPrivilege 5820 msiexec.exe Token: SeSecurityPrivilege 1696 msiexec.exe Token: SeCreateTokenPrivilege 5820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5820 msiexec.exe Token: SeLockMemoryPrivilege 5820 msiexec.exe Token: SeIncreaseQuotaPrivilege 5820 msiexec.exe Token: SeMachineAccountPrivilege 5820 msiexec.exe Token: SeTcbPrivilege 5820 msiexec.exe Token: SeSecurityPrivilege 5820 msiexec.exe Token: SeTakeOwnershipPrivilege 5820 msiexec.exe Token: SeLoadDriverPrivilege 5820 msiexec.exe Token: SeSystemProfilePrivilege 5820 msiexec.exe Token: SeSystemtimePrivilege 5820 msiexec.exe Token: SeProfSingleProcessPrivilege 5820 msiexec.exe Token: SeIncBasePriorityPrivilege 5820 msiexec.exe Token: SeCreatePagefilePrivilege 5820 msiexec.exe Token: SeCreatePermanentPrivilege 5820 msiexec.exe Token: SeBackupPrivilege 5820 msiexec.exe Token: SeRestorePrivilege 5820 msiexec.exe Token: SeShutdownPrivilege 5820 msiexec.exe Token: SeDebugPrivilege 5820 msiexec.exe Token: SeAuditPrivilege 5820 msiexec.exe Token: SeSystemEnvironmentPrivilege 5820 msiexec.exe Token: SeChangeNotifyPrivilege 5820 msiexec.exe Token: SeRemoteShutdownPrivilege 5820 msiexec.exe Token: SeUndockPrivilege 5820 msiexec.exe Token: SeSyncAgentPrivilege 5820 msiexec.exe Token: SeEnableDelegationPrivilege 5820 msiexec.exe Token: SeManageVolumePrivilege 5820 msiexec.exe Token: SeImpersonatePrivilege 5820 msiexec.exe Token: SeCreateGlobalPrivilege 5820 msiexec.exe Token: SeBackupPrivilege 3352 vssvc.exe Token: SeRestorePrivilege 3352 vssvc.exe Token: SeAuditPrivilege 3352 vssvc.exe Token: SeBackupPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeBackupPrivilege 3136 srtasks.exe Token: SeRestorePrivilege 3136 srtasks.exe Token: SeSecurityPrivilege 3136 srtasks.exe Token: SeTakeOwnershipPrivilege 3136 srtasks.exe Token: SeBackupPrivilege 3136 srtasks.exe Token: SeRestorePrivilege 3136 srtasks.exe Token: SeSecurityPrivilege 3136 srtasks.exe Token: SeTakeOwnershipPrivilege 3136 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5820 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5820 msiexec.exe 1696 msiexec.exe 2212 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1696 wrote to memory of 3136 1696 msiexec.exe 94 PID 1696 wrote to memory of 2212 1696 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\appstup.32.0.6tt0007.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5820
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2FEF061F64568D3C6D6AF792FB193A20 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2212
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI9794.tmp
- Size 5.0MB
- SHA256 4f269d392b46e414ac9a6fe528c989e21d84678d6563f7e2101b693a21c3b785
- MD5 d2782d84ccaf2470260ff9c5f3da6642
- SHA1 499775e3c9a8367d5e5a8a7f0971f24394b850ba
- SHA512 f7aec4e5ef6cf0e2f7a8961ce37b4a65d40e1dd6722a67cd9f7d2218c93140cf12664884155b379d0c062428fed212e89ce789d988e13bab63d21ddbc3111137
- SSDEEP 98304:+ree/cAqUO8niD14q0cfzlGtKlwgvALk2gzIuMoKYnfwjPSQz9YpmFo:/eUAq5E82nuh/fwrSTYO
- TLSH T10D3633E579C762B0E087C3B19A53756FB02937D77E105C1A37E92A086EF361AD0BA341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 60ddcc279485a64980b03f900c8731df138a5ae5bef9da38ac2a5aaab024c476
- MD5 7e42eae4a39dad966392145269b38b88
- SHA1 1b5445ca11268c2aa70e9dd16e590dca95f27003
- SHA512 3296673dc32347270dc4f5dbbe968aea26e5867fa656cc1dd2a6e8b4fee43bb1ebcd40257be7ecae1f17aa9c1f15170a76a3791efb7f14876181288a70cddb43
- SSDEEP 24576:BFo3DMPydoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVep:mHA
- TLSH T11357D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{65d4aebc-5c2d-4cdc-9f8b-8983df4dd9c2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6570658cdc1d3852e1fbc27ba16eb7b61fd5e8f935790406ee16433199d31fd9
- MD5 16971a5d30cc5bb6a0aaba3be90ad6b2
- SHA1 51c945629043d92a722c9c53e43c8aac053d05f8
- SHA512 96d786d4a2e0cc40f3494eb5e64a1938a1c8a11e5df4819872d8dc6ffa1ca2a32a2d374ff3a1964118e63c20a60a9d6c54c48bb034cd8b58f4f7f6b265e0e8ff
- SSDEEP 96:F7xuuEvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:xxKb++uVm
- TLSH T16FD188185AF54711E2B3AB712DF18557A837B911EF33CB8E0198638E2630910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH