Overview

overview

7

Static

static

1

Transwiz.msi

windows10-2004-x64

7

Transwiz.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Transwiz.msi
  • Size 2.8MB
  • Sample260723-ppf4psyena
  • SHA256 511c2c0908883bc9d05295e5145b767f2633461c93a31d1cb8d765ee09cdd801
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Transwiz.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5576
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5944
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4DF89B0A785A73F89DFB27D8C34CD0A0
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2676
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B1DDE69A5E980DED00B51809F9C7D341 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3812
      • C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe
        "C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe" -tf
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5208
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5736
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5524

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59c117.rbs
            • Path C:\Config.Msi\e59c117.rbs
            • Size 9KB
            • SHA256 61c5343f9421432324d454e17d57adb866650f77e4ad79fd1800779f8f1cf55e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            licfldr.exe
            • Path C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe
            • Size 78KB
            • SHA256 00bcc6ba3e27fa3a3f1b9418749fbbe8d5c2c5537c346e27ae9f7ea5bb988e11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Transwiz.config
            • Path C:\ProgramData\ForensiT\Transwiz\Deployment Files\Transwiz.config
            • Size 799B
            • SHA256 f8ce6f4572b696e7c96e0606c48ba206f2528857a290c8e0b576207ca08e37a6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Transwiz.exe
            • Path C:\ProgramData\ForensiT\Transwiz\Deployment Files\Transwiz.exe
            • Size 1.8MB
            • SHA256 7b557a3d47416e5e15964ac00161bcc3eb9bf97617085501c0ef60a1b4f3795e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIC54A.tmp
            • Path C:\Windows\Installer\MSIC54A.tmp
            • Size 392KB
            • SHA256 d9a307d175c72ea0922296f0686ab5a2a72f67e3c8c848e6623cb36aeaddf2ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSICF91.tmp
            • Path C:\Windows\Installer\MSICF91.tmp
            • Size 380KB
            • SHA256 91c94656fb4d2b4a9386a4ddafda0548f75b09fbb6b6e888578ed4f4f40e28c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59c114.msi
            • Path C:\Windows\Installer\e59c114.msi
            • Size 2.8MB
            • SHA256 511c2c0908883bc9d05295e5145b767f2633461c93a31d1cb8d765ee09cdd801
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 1f1394ce7ba8c79c512c0a0ffe49fdfab4dc116628fbca366939c6a0fa5cdd44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {80883e30-c468-4910-b8c4-504764de73d4}_OnDiskSnapshotProp
            • Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{80883e30-c468-4910-b8c4-504764de73d4}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 e81970f56eeb3c9840cadd0f332fb1ee37ddc70e5168a10e6d35c76c187bfe55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download