f74854903f66701a1a4eafa5e27dd5e0dbb5237de0299cb2a381c8a834b2aeeb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20260706_033518_c703143c.msi
Size 6.8MB
Sample260728-gzzd2acl71
SHA256 f74854903f66701a1a4eafa5e27dd5e0dbb5237de0299cb2a381c8a834b2aeeb
MD5 a1f455245f9ff3bd32b633fc1c13e00d
SHA1 848e42729496e70834dfc3786c15ffee9a9c370f
SHA512 e8c8516b4db0ef0ff5f0a84e764d63b42b62e4396b9a45c8955e031c67a671ee27c8b2d679cd264e1a1d6af86f19a1ccdf86c42c7cf33604e868a9c4c6b6300e
SSDEEP 98304:CkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Hlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T1D3761221754E8C76C5AA363071769E7DDA3CBC305BA08BDB938339EE09315C052FDA96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3516	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
4432	MsiExec.exe
4432	MsiExec.exe
4432	MsiExec.exe
4692	MsiExec.exe

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3772	msiexec.exe
6	3772	msiexec.exe
8	3772	msiexec.exe
15	3772	msiexec.exe
16	3772	msiexec.exe
25	3772	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECDD.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Installer\e58ea7d.msi	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ea7a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDB8.tmp	msiexec.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIEF61.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-07-28_07-16-02~3516.log	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE46.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF22.tmp	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Installer\e58ea7a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3432	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3772	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "20260706_033518_c703143c.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5024	msiexec.exe
5024	msiexec.exe
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3772	msiexec.exe
Token: SeSecurityPrivilege	5024	msiexec.exe
Token: SeCreateTokenPrivilege	3772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3772	msiexec.exe
Token: SeLockMemoryPrivilege	3772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3772	msiexec.exe
Token: SeMachineAccountPrivilege	3772	msiexec.exe
Token: SeTcbPrivilege	3772	msiexec.exe
Token: SeSecurityPrivilege	3772	msiexec.exe
Token: SeTakeOwnershipPrivilege	3772	msiexec.exe
Token: SeLoadDriverPrivilege	3772	msiexec.exe
Token: SeSystemProfilePrivilege	3772	msiexec.exe
Token: SeSystemtimePrivilege	3772	msiexec.exe
Token: SeProfSingleProcessPrivilege	3772	msiexec.exe
Token: SeIncBasePriorityPrivilege	3772	msiexec.exe
Token: SeCreatePagefilePrivilege	3772	msiexec.exe
Token: SeCreatePermanentPrivilege	3772	msiexec.exe
Token: SeBackupPrivilege	3772	msiexec.exe
Token: SeRestorePrivilege	3772	msiexec.exe
Token: SeShutdownPrivilege	3772	msiexec.exe
Token: SeDebugPrivilege	3772	msiexec.exe
Token: SeAuditPrivilege	3772	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3772	msiexec.exe
Token: SeChangeNotifyPrivilege	3772	msiexec.exe
Token: SeRemoteShutdownPrivilege	3772	msiexec.exe
Token: SeUndockPrivilege	3772	msiexec.exe
Token: SeSyncAgentPrivilege	3772	msiexec.exe
Token: SeEnableDelegationPrivilege	3772	msiexec.exe
Token: SeManageVolumePrivilege	3772	msiexec.exe
Token: SeImpersonatePrivilege	3772	msiexec.exe
Token: SeCreateGlobalPrivilege	3772	msiexec.exe
Token: SeBackupPrivilege	5076	vssvc.exe
Token: SeRestorePrivilege	5076	vssvc.exe
Token: SeAuditPrivilege	5076	vssvc.exe
Token: SeBackupPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeShutdownPrivilege	4692	MsiExec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeBackupPrivilege	3516	action1_agent.exe
Token: SeSecurityPrivilege	3516	action1_agent.exe
Token: SeBackupPrivilege	3516	action1_agent.exe
Token: SeSecurityPrivilege	3516	action1_agent.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3772	msiexec.exe
3772	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3276	5024	msiexec.exe	102
PID 5024 wrote to memory of 4432	5024	msiexec.exe	104
PID 5024 wrote to memory of 4692	5024	msiexec.exe	105
PID 3516 wrote to memory of 3432	3516	action1_agent.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\20260706_033518_c703143c.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CCFA7EF32A73989532061771C777A517
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4432
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ECC94A69625AF37332D4FCAC6FB20A31 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ea7b.rbs

Path C:\Config.Msi\e58ea7b.rbs
Size 240KB
SHA256 87e45900d4769f01155a486f7f8687eec5959bb6faa941b50393e289f9cb8a99
MD5 4428ec75dec064c421f1db84e18396e5
SHA1 a81adbc187221380bf4d04f7485c6554d3b272a8
SHA512 cfe5da9390e6d8ad8e87dedbdedad1a239e7666ed57c17d545d86e1dd58428352bb31cbf0d7cee9cd211a95b966221ccd8360d7905b6cc61a53d05675da39937
SSDEEP 3072:zkXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:gqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T137348E217494547EEBFF0832953ADA71AE3DF2380B90C96EC384581E5D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ea7c.rbs

Path C:\Config.Msi\e58ea7c.rbs
Size 7KB
SHA256 1b94b1656143c574cda4beea8fe2249e6500bfbb11ece83e6388c802c126aca6
MD5 5d8a93ca881cc20ed61f4cb57b69f8d0
SHA1 aa79248471809e351cb4f85875b16791633c0da4
SHA512 fda3396e85bf0db445f5681ed8dd166409d7ec0f66a6359fc1d32077b4324fa8a3b260391953e6485831084f46d9d5d8f420a1c4cc2cce498c4bca695980a98e
SSDEEP 96:zy1tPeCcv7XkUa1AiOliCsThqxBXkUa1AiOliC6jZS2dThqxaH+35fyG9tbktqZX:zMezflhI2lhM+YS0/pm
TLSH
T199E130017A0046E3FA6A0736C3471F9837B2D2D943112B5B8CCDA6649F5BF8D2F951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D3A6ADE28D2362383293C423AFF660E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1D3A6ADE28D2362383293C423AFF660E
Size 751B
SHA256 6a8709204fa538315b742910eff3108640c27bdaf298559e41f60f5aff86dbc0
MD5 f9d9a65bfede63b602fe10988b47efc4
SHA1 f2147269c75f40b3b8b1b64293ea5886552fc6c8
SHA512 ef4e114193913a30d6e4190ffc2f5e10008bd0c97ebd00911e7c74ecbc4dc00f12ccf982f7cbcefc055f4c2ae76367a84ea30efebe015c59d483729536d59e88
TLSH
T14601205275250AC4A209BE883ED5D52115B2FBFC1BC649E0336C0949819A9693BA505D
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 637B
SHA256 0995e590d7a4911331ac2b91dfba37c2940b443d6b384280c9287fbef98c710c
MD5 9f6a2fdeb1f2ef94042db9f16bc1ecd0
SHA1 d8fd5805075015492f3c19cd118db86334c3ef8e
SHA512 aa62877cc35c9c5c5b87212d3dda8abf0515a36f7c0b0c082ff5a496b3931478b3dc389c1e16c74fde6958606653d00fda0022d931eb62124d6e19d4e92b641a
TLSH
T1FFF062021E2AD450BC3188BC4FA8D9AD25D0E03636E40E66A6958E620688391D39EECC
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 32f85273f3bcebbd88a5306e3db040f3629e5a63115ddde7c0c8bd6d8f5a25a3
MD5 2707bc70070cd8331ce3a5ccff9245e8
SHA1 778820bacbd1c6868acad5349cbdac9aa42c3377
SHA512 0a474bde3fc87e366189c16ff627aaa23713e4ce8d7359eeb2bf8316e8fc5b156c3212bcf591696279e90a792c2d1a11fd6b5a950df446910477304eb61a4fee
TLSH
T19831C9D3BFE47820AD166D40A89C8FB23CB034E5F45408B938B5445F9463F546857C1D
MD5 SHA1 SHA512 TLSH

Submit Download

1D3A6ADE28D2362383293C423AFF660E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1D3A6ADE28D2362383293C423AFF660E
Size 320B
SHA256 936a22650bf4d989b763f90c34f5d5e42af74a008046fcd227e2505c9ca1e43e
MD5 81f2c86dbe08710775bb0079da29e803
SHA1 221220c74ebef2879e47a3e70d975c776b0866cb
SHA512 b8fec0e7248a801775fc433110cce6148253652389cb5846d7ee553cc9c5387c16b5fac60a3b17a44cea42fb087907a8253471e4db3e77ba8ec10ff5d4b8d054
TLSH
T1D2E0C22406AC021FF0D886BD49A106A3BE21FD09B642C60E2BE5050E4015F426C6260F
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 488B
SHA256 026b5ae512b3b52f8fe5d5b074c5d47d340ff89fffa24cb92e84e256dda47b1d
MD5 a6108f999fbbcc58b80aa9d72a1890b1
SHA1 e50cc4acd367597220c7764eccd31d34287fcaa9
SHA512 a5d13ce3abfb8751d158261828e4605093bef577d9b3333f09af57b1b72639d0667f89c77518e8134602db13bf9eef393243e84d49a16ff2e050a9f784588d3e
TLSH
T1E4F055246AFA003EF0A4BA3E86D5A2439C29F11759000A6A26F01749EB07A429C22939
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 ddb6d01be4dfef4e2c14738f98bee4c34875b86bcb5d9ef7dd7ecb7702178168
MD5 e013c722c3abd7ea500e0b536b5677d4
SHA1 3bd69319f00cbe91d3e0ed92e93bde23a8a99cbb
SHA512 188540d4d620b313ad9db75b5e0aefecd6626c85dc1454889e34df5317019325d9e75ace39216acb9fd66fcc693e02defd38da970d5fb746d333c08db6427be3
TLSH
T138F05530267B406CE037997ACEC5A2569D7CF222B00102B316240A065F0BD822DD1633
MD5 SHA1 SHA512 TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEB84.tmp

Path C:\Windows\Installer\MSIEB84.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEDB8.tmp

Path C:\Windows\Installer\MSIEDB8.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ea7a.msi

Path C:\Windows\Installer\e58ea7a.msi
Size 6.8MB
SHA256 f74854903f66701a1a4eafa5e27dd5e0dbb5237de0299cb2a381c8a834b2aeeb
MD5 a1f455245f9ff3bd32b633fc1c13e00d
SHA1 848e42729496e70834dfc3786c15ffee9a9c370f
SHA512 e8c8516b4db0ef0ff5f0a84e764d63b42b62e4396b9a45c8955e031c67a671ee27c8b2d679cd264e1a1d6af86f19a1ccdf86c42c7cf33604e868a9c4c6b6300e
SSDEEP 98304:CkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Hlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T1D3761221754E8C76C5AA363071769E7DDA3CBC305BA08BDB938339EE09315C052FDA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xvmozipm.vh0.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_xvmozipm.vh0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 d50d2a6d881fa6d8b583caf99cc42c349a1093c79fa9b64247a723d4f8aca986
MD5 0eabf02fae2634d61bdf6ea9047f200e
SHA1 b5a5246bf07b6303aec560f26ce19e5ce1afc021
SHA512 1ae48aff256610fba93ff59ac28b9d0b298af088d49bb8304d8667e8ac6b913ce0c3aff2839fcd44311417477e66468006187fe5316a33beb71b833b96614a0d
SSDEEP 24576:Yu8m+1z+doO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:5
TLSH
T16A47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{85d2973b-08f3-45f9-be17-1464222a9d0e}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{85d2973b-08f3-45f9-be17-1464222a9d0e}_OnDiskSnapshotProp
Size 6KB
SHA256 bd7cc5636e8930aa0e66d6011993618274d5657c3388f9569a65aca177b9cbb7
MD5 3c00ca04f8bdbeaeacabf7317eabfc05
SHA1 5149195a6b0e46012f46aeaa724f66aa05692ad5
SHA512 5fba06c9475af62ebf6475e827948e2f2188561d14c3a581d365e51f7d5550e5c17a3cef596726c613fcd48a4221ad63003b9a76ecb04c8cdb6b0b2d90b65a79
SSDEEP 96:Fek+nJoRGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:P7GPGnb++ZVmN
TLSH
T18DD199085AE54711E2B3AB7229F14557A877B911EF33CB8E0198638E2670A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3432-57-0x0000024570220000-0x0000024570242000-memory.dmp

Download