Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target install.msi
- Size 44KB
- Sample260723-dtwjeadl5v
- SHA256 c560beb3b567797cdd3cc478934e27ad2a8991fb5aa350b7effa77a88a94441a
- MD5 88eb07098c1c8f6475fad46925807ab7
- SHA1 9b729c981c0153559303c013a054dbe1018a03b0
- SHA512 1d9f810ac3e1d5dfc36019c6cf45cc861b0d45fb3aa6feffad5213d5e8f915a36bc9e867c2bde91156a0795d2eae381227f089beef227722c0d3968b71cbc675
- SSDEEP 384:S6+shIL7iyUrrS15nO2EUIFwmdNb8rdUEeGDGFOzF1XXoP4Csu1XXoP4CY+tcq5n:7IL73KIIUIFwmTbtEVDGcPFCJFCP6q
- TLSH T1EC135B6A72609332C08207364B5FC7E56B759C58DFB3522732DAB74D1E72D9413A3AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4344 Application Frame Host.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Frame Host = "\"C:\\Users\\Admin\\AppData\\Local\\mps\\Application Frame Host.exe\"" msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF5E18BEA8C4C54C91.TMP msiexec.exe File created C:\Windows\Installer\e59e150.msi msiexec.exe File created C:\Windows\SystemTemp\~DF89B18AFF8896D330.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF603DE6D468FBE684.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFCB8548353BEC1565.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{06AF5C54-1292-40B9-8A9C-14871F239AD5} msiexec.exe File opened for modification C:\Windows\Installer\MSIE4B9.tmp msiexec.exe File created C:\Windows\Installer\e59e14e.msi msiexec.exe File opened for modification C:\Windows\Installer\e59e14e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4392 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5216 msiexec.exe 5216 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4392 msiexec.exe Token: SeIncreaseQuotaPrivilege 4392 msiexec.exe Token: SeSecurityPrivilege 5216 msiexec.exe Token: SeCreateTokenPrivilege 4392 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4392 msiexec.exe Token: SeLockMemoryPrivilege 4392 msiexec.exe Token: SeIncreaseQuotaPrivilege 4392 msiexec.exe Token: SeMachineAccountPrivilege 4392 msiexec.exe Token: SeTcbPrivilege 4392 msiexec.exe Token: SeSecurityPrivilege 4392 msiexec.exe Token: SeTakeOwnershipPrivilege 4392 msiexec.exe Token: SeLoadDriverPrivilege 4392 msiexec.exe Token: SeSystemProfilePrivilege 4392 msiexec.exe Token: SeSystemtimePrivilege 4392 msiexec.exe Token: SeProfSingleProcessPrivilege 4392 msiexec.exe Token: SeIncBasePriorityPrivilege 4392 msiexec.exe Token: SeCreatePagefilePrivilege 4392 msiexec.exe Token: SeCreatePermanentPrivilege 4392 msiexec.exe Token: SeBackupPrivilege 4392 msiexec.exe Token: SeRestorePrivilege 4392 msiexec.exe Token: SeShutdownPrivilege 4392 msiexec.exe Token: SeDebugPrivilege 4392 msiexec.exe Token: SeAuditPrivilege 4392 msiexec.exe Token: SeSystemEnvironmentPrivilege 4392 msiexec.exe Token: SeChangeNotifyPrivilege 4392 msiexec.exe Token: SeRemoteShutdownPrivilege 4392 msiexec.exe Token: SeUndockPrivilege 4392 msiexec.exe Token: SeSyncAgentPrivilege 4392 msiexec.exe Token: SeEnableDelegationPrivilege 4392 msiexec.exe Token: SeManageVolumePrivilege 4392 msiexec.exe Token: SeImpersonatePrivilege 4392 msiexec.exe Token: SeCreateGlobalPrivilege 4392 msiexec.exe Token: SeBackupPrivilege 3736 vssvc.exe Token: SeRestorePrivilege 3736 vssvc.exe Token: SeAuditPrivilege 3736 vssvc.exe Token: SeBackupPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4392 msiexec.exe 4392 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4392 msiexec.exe 5216 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5216 wrote to memory of 2996 5216 msiexec.exe 94 PID 5216 wrote to memory of 4344 5216 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4392
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2996
-
-
C:\Users\Admin\AppData\Local\mps\Application Frame Host.exe"C:\Users\Admin\AppData\Local\mps\Application Frame Host.exe"2⤵
- Executes dropped EXE
PID:4344
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3736
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e14f.rbs
- Size 8KB
- SHA256 90adffa197ee13d60313f612f834bcf710dc5b7db0f80f1e53589b6051c51ba2
- MD5 bbebb834e1358842fd443b9a7cd2324d
- SHA1 1a3aa22d1814dfe6efd7146de7e70777119a0e71
- SHA512 155e1ae62a0f83aa9bc76357137624034e15e661e60b9db8a2b6d5f4c8edf1b61b6b76ca46f921b35fd02e2bcee748d74c24f89126eb76416512ec16ba6fc08d
- SSDEEP 192:SO2PCkwpRyGOBG+yGOBTr8LzN99NYKCZCEEOepdnsf/KBy0K:S3wyGObyGOAjk4XOr
- TLSH T1EF022281B144C9D2E49E6B3FD693174B7BB7D3EEA750634B088E90244E53BC89F891C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\mps\Application Frame Host.exe
- Size 20KB
- SHA256 f08f812b68c2ea5166deb418af6f84c3730e5a0a1b51d0e7ba6cce4cd9b700f6
- MD5 ba0e53efca55513daa7ca9f5b88087e0
- SHA1 6773ca4410f657eda8153434ddbc42c04ae6ccd2
- SHA512 266d4927e652d1492c3ce6814ae7464089809a335a9e11566292593976674ae1b5211561df08525f87bb237a2b8d4d77c543cf96947fee66879d7e77cc670ca2
- SSDEEP 384:vN00Q07Y4NSugbH7EuWcZya9AWTUXHuSWv8QJfbB2Ax8XEVW:l1Q0k4NTCYlo9/UXktBri
- TLSH T19192F942B7FC0219E7FD9A388DF392514575BA459A12DB8E0CE9384F19317909A22FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59e14e.msi
- Size 44KB
- SHA256 c560beb3b567797cdd3cc478934e27ad2a8991fb5aa350b7effa77a88a94441a
- MD5 88eb07098c1c8f6475fad46925807ab7
- SHA1 9b729c981c0153559303c013a054dbe1018a03b0
- SHA512 1d9f810ac3e1d5dfc36019c6cf45cc861b0d45fb3aa6feffad5213d5e8f915a36bc9e867c2bde91156a0795d2eae381227f089beef227722c0d3968b71cbc675
- SSDEEP 384:S6+shIL7iyUrrS15nO2EUIFwmdNb8rdUEeGDGFOzF1XXoP4Csu1XXoP4CY+tcq5n:7IL73KIIUIFwmTbtEVDGcPFCJFCP6q
- TLSH T1EC135B6A72609332C08207364B5FC7E56B759C58DFB3522732DAB74D1E72D9413A3AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e63eb7c78d3581777d5f68007c56d099bcb50fe6b918e0adcc334f0966858620
- MD5 54f8bbdb8269d29652b1cdb596d1703a
- SHA1 018d2c85c3432ce3ac7efa7309257d0a35692539
- SHA512 72796809fa8ac329250b289ece70f68ba868392d8a3610a7eabc96764dc3d66f7cedbd9a07551c6313beb2649e576b7affefc2173ed5dcb42bdc2fea2ba44d2f
- SSDEEP 24576:dFo3DMPXdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+Y:fH0
- TLSH T11E57E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2c9b3777-0a82-453a-b0cf-e6231351e18d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 875411bd80f31a40081565e72c567c565bde487017fbb29b45f7a7ce8d270d1e
- MD5 594a3cbc3963436fd9685d10a0c303d2
- SHA1 87e1611f57a4b683d3fd03edf91772441e5ea229
- SHA512 2fd5fb7f2c3dfb3a5f6410b18141a4436298ca8b1d4da2fe15fa39cbbe1b95851fd96a4f79a1bbcefc0cc3375436f853e2e536650a7235a1d097fc86085f2291
- SSDEEP 96:F/DQ2Ovc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:dWb++uVm
- TLSH T176D186181AF54711E2B3AB312CF18557A877B911EF33CB8E0298638E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH