Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 07:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
intll.0.88004.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
intll.0.88004.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target intll.0.88004.msi
- Size 6.3MB
- Sample260724-h2fkdatxaz
- SHA256 573d094a2ea3fa98551517c00be186a2097c7ae88a1d80e4891958e56439b0cf
- MD5 3cdf1be893bd2640644e2bacc508ae17
- SHA1 cb6b20b641f2509c8f1ad6593cca913dac6d2c2a
- SHA512 112aa84ae996ff3901547ec92d2c51731a9081d48c30abe75ef725cb14d02b2a6f2f5284a7c37b830210b60cfc63db465fd72924811e66d3ca8f7587f7ff553e
- SSDEEP 196608:qOBv1qDgnnhvuJt0mkZH6m7Ox/iXGZDNsE9k4juiRqefqmew:qav1qWZmkZamA99Ow
- TLSH T134663395BC8A2771C1D3C7B04583647F7E1A7F12BE638C1676E97A491DB2A102A3F342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1164 MsiExec.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 1164 MsiExec.exe 13 1164 MsiExec.exe 16 1164 MsiExec.exe 17 1164 MsiExec.exe 19 1164 MsiExec.exe 20 1164 MsiExec.exe 21 1164 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF628EDFE390361CF2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI50B6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5163.tmp msiexec.exe File created C:\Windows\Installer\e594be4.msi msiexec.exe File opened for modification C:\Windows\Installer\e594be4.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF43CDF861507F74BD.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{2FB57C8C-8FBB-AB0E-1855-DF8D061B1351} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4140 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4064 msiexec.exe 4064 msiexec.exe 1164 MsiExec.exe 1164 MsiExec.exe 1164 MsiExec.exe 1164 MsiExec.exe 1164 MsiExec.exe 1164 MsiExec.exe 1164 MsiExec.exe 1164 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 4140 msiexec.exe Token: SeIncreaseQuotaPrivilege 4140 msiexec.exe Token: SeSecurityPrivilege 4064 msiexec.exe Token: SeCreateTokenPrivilege 4140 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4140 msiexec.exe Token: SeLockMemoryPrivilege 4140 msiexec.exe Token: SeIncreaseQuotaPrivilege 4140 msiexec.exe Token: SeMachineAccountPrivilege 4140 msiexec.exe Token: SeTcbPrivilege 4140 msiexec.exe Token: SeSecurityPrivilege 4140 msiexec.exe Token: SeTakeOwnershipPrivilege 4140 msiexec.exe Token: SeLoadDriverPrivilege 4140 msiexec.exe Token: SeSystemProfilePrivilege 4140 msiexec.exe Token: SeSystemtimePrivilege 4140 msiexec.exe Token: SeProfSingleProcessPrivilege 4140 msiexec.exe Token: SeIncBasePriorityPrivilege 4140 msiexec.exe Token: SeCreatePagefilePrivilege 4140 msiexec.exe Token: SeCreatePermanentPrivilege 4140 msiexec.exe Token: SeBackupPrivilege 4140 msiexec.exe Token: SeRestorePrivilege 4140 msiexec.exe Token: SeShutdownPrivilege 4140 msiexec.exe Token: SeDebugPrivilege 4140 msiexec.exe Token: SeAuditPrivilege 4140 msiexec.exe Token: SeSystemEnvironmentPrivilege 4140 msiexec.exe Token: SeChangeNotifyPrivilege 4140 msiexec.exe Token: SeRemoteShutdownPrivilege 4140 msiexec.exe Token: SeUndockPrivilege 4140 msiexec.exe Token: SeSyncAgentPrivilege 4140 msiexec.exe Token: SeEnableDelegationPrivilege 4140 msiexec.exe Token: SeManageVolumePrivilege 4140 msiexec.exe Token: SeImpersonatePrivilege 4140 msiexec.exe Token: SeCreateGlobalPrivilege 4140 msiexec.exe Token: SeBackupPrivilege 4548 vssvc.exe Token: SeRestorePrivilege 4548 vssvc.exe Token: SeAuditPrivilege 4548 vssvc.exe Token: SeBackupPrivilege 4064 msiexec.exe Token: SeRestorePrivilege 4064 msiexec.exe Token: SeRestorePrivilege 4064 msiexec.exe Token: SeTakeOwnershipPrivilege 4064 msiexec.exe Token: SeRestorePrivilege 4064 msiexec.exe Token: SeTakeOwnershipPrivilege 4064 msiexec.exe Token: SeRestorePrivilege 4064 msiexec.exe Token: SeTakeOwnershipPrivilege 4064 msiexec.exe Token: SeBackupPrivilege 3472 srtasks.exe Token: SeRestorePrivilege 3472 srtasks.exe Token: SeSecurityPrivilege 3472 srtasks.exe Token: SeTakeOwnershipPrivilege 3472 srtasks.exe Token: SeBackupPrivilege 3472 srtasks.exe Token: SeRestorePrivilege 3472 srtasks.exe Token: SeSecurityPrivilege 3472 srtasks.exe Token: SeTakeOwnershipPrivilege 3472 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4140 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4140 msiexec.exe 4064 msiexec.exe 1164 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4064 wrote to memory of 3472 4064 msiexec.exe 94 PID 4064 wrote to memory of 1164 4064 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\intll.0.88004.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4140
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 96C4DCA441A7A14B580C483D00473475 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI5163.tmp
- Size 6.2MB
- SHA256 8301b23bcfee26eefae26a6275daf5b536946f04e717fb627e87ac4fd920e061
- MD5 4b09cbf5d97e68ce8167ef935a982fe4
- SHA1 b0e21e5fd671cc5d2260503c722c17748792439f
- SHA512 4a4bea86c7da7e8b87ad3da7651340ff90514cf3a9d32d3c0b0c624b553f6fc167becef93b84beef8bbc709858470af974adf0eb9b8c185a98c7dc22dc7d614f
- SSDEEP 196608:SOBv1qDgnnhvuJt0mkZH6m7Ox/iXGZDNzE9k4juiRqefqmev:Sav1qWZmkZamR99Ov
- TLSH T1F16633D9BC8B2670C2D3CBB14583747F7D1A3763BA634C1676E97A451DA2A102A3F342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0fee999872538113d3b117695a4de2f076009cd881515d6b27c37206ed9786da
- MD5 ecf74a53729763bf1851b6e53d30830f
- SHA1 3fe2b5eb945acabe5d42d854b8f61033f5f8bda7
- SHA512 451e288226a08906b9cf370f26d5bfb1a3336c96837263a444dff144ae3917fc8418f449fb683aa3cfe6247aa6508aaa8862409a2fe68cdd89e76fde5226e663
- SSDEEP 24576:FFo3DMP2doO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:2HA
- TLSH T1E957B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{bfd57760-f2b2-41e1-9069-3bcbb2084f38}_OnDiskSnapshotProp
- Size 6KB
- SHA256 683e2d22cf417860e40f2037eb6a31a2533991dafee80ae6b9778eb313a45093
- MD5 83d5959e4f6de03aaacf37ebbd1c44d3
- SHA1 98846fa1fa5c891e9edaf8c84083cb06b6a2a549
- SHA512 79a01e135c342c8d01bf2652eea20ff0cd67872564a7bc7b0fb75b89b1e7d031015cf8e51797ce16428b6e883570017f81badc7c98e6da000990f1f456d08fad
- SSDEEP 96:Fctl4vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Kkb++uVm
- TLSH T12ED188181AF54711E2B3AB3129F14557A877B911EF33CB8E0198238E2631910F936F6B
- MD5 SHA1 SHA512 SSDEEP TLSH