Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n019.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n019.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target Install_28n019.msi
- Size 8.6MB
- Sample260728-p6pr6shr7w
- SHA256 c78a97c78f5624ceb19dce074bddc3ca4f7a4b05fb4b52962a322d9dd4308ffa
- MD5 9552301fddcfa92bd76f03c67a85e4bb
- SHA1 8815a056fee871c53b90c179f3bec869ae959c8b
- SHA512 9ef0f3177b4344a90250c2ca4865c303e26aeee413c9705e861f3c7ad07065b5c293337832ceb8cd2839a381345ef7cc4bddfde86aaea2f23bdf3cc5fa1edcac
- SSDEEP 196608:4DPoHyBL2NB7i7z+cwih17wgQRnEAnG5keZbuS:4UHyBSo+Gh17wvGdbb
- TLSH T1589633AAB98B67B0C0DFC3F68502B07D76183FCA7F624D1A7A9D3B080D7160155B6B18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2064 9gm5Kw.exe - Loads dropped DLL 2 IoCs
pid Process 6064 MsiExec.exe 2064 9gm5Kw.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6064 MsiExec.exe 7 6064 MsiExec.exe 8 6064 MsiExec.exe 9 6064 MsiExec.exe 10 6064 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 9gm5Kw.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSIA3C9.tmp msiexec.exe File created C:\Windows\Installer\e599dcf.msi msiexec.exe File created C:\Windows\SystemTemp\~DF392773DE697440E6.TMP msiexec.exe File created C:\Windows\Installer\e599dcd.msi msiexec.exe File opened for modification C:\Windows\Installer\e599dcd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF2CE7F6E66BA0C230.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA33B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFB1FC751FEA38615B.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF8D3E16769CEBF0E2.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1160 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "5CC5C0354302F2A4BB51DD30710D499D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n019.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4164 msiexec.exe 4164 msiexec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 6064 MsiExec.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe 2064 9gm5Kw.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1160 msiexec.exe Token: SeIncreaseQuotaPrivilege 1160 msiexec.exe Token: SeSecurityPrivilege 4164 msiexec.exe Token: SeCreateTokenPrivilege 1160 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1160 msiexec.exe Token: SeLockMemoryPrivilege 1160 msiexec.exe Token: SeIncreaseQuotaPrivilege 1160 msiexec.exe Token: SeMachineAccountPrivilege 1160 msiexec.exe Token: SeTcbPrivilege 1160 msiexec.exe Token: SeSecurityPrivilege 1160 msiexec.exe Token: SeTakeOwnershipPrivilege 1160 msiexec.exe Token: SeLoadDriverPrivilege 1160 msiexec.exe Token: SeSystemProfilePrivilege 1160 msiexec.exe Token: SeSystemtimePrivilege 1160 msiexec.exe Token: SeProfSingleProcessPrivilege 1160 msiexec.exe Token: SeIncBasePriorityPrivilege 1160 msiexec.exe Token: SeCreatePagefilePrivilege 1160 msiexec.exe Token: SeCreatePermanentPrivilege 1160 msiexec.exe Token: SeBackupPrivilege 1160 msiexec.exe Token: SeRestorePrivilege 1160 msiexec.exe Token: SeShutdownPrivilege 1160 msiexec.exe Token: SeDebugPrivilege 1160 msiexec.exe Token: SeAuditPrivilege 1160 msiexec.exe Token: SeSystemEnvironmentPrivilege 1160 msiexec.exe Token: SeChangeNotifyPrivilege 1160 msiexec.exe Token: SeRemoteShutdownPrivilege 1160 msiexec.exe Token: SeUndockPrivilege 1160 msiexec.exe Token: SeSyncAgentPrivilege 1160 msiexec.exe Token: SeEnableDelegationPrivilege 1160 msiexec.exe Token: SeManageVolumePrivilege 1160 msiexec.exe Token: SeImpersonatePrivilege 1160 msiexec.exe Token: SeCreateGlobalPrivilege 1160 msiexec.exe Token: SeBackupPrivilege 932 vssvc.exe Token: SeRestorePrivilege 932 vssvc.exe Token: SeAuditPrivilege 932 vssvc.exe Token: SeBackupPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeBackupPrivilege 1644 srtasks.exe Token: SeRestorePrivilege 1644 srtasks.exe Token: SeSecurityPrivilege 1644 srtasks.exe Token: SeTakeOwnershipPrivilege 1644 srtasks.exe Token: SeBackupPrivilege 1644 srtasks.exe Token: SeRestorePrivilege 1644 srtasks.exe Token: SeSecurityPrivilege 1644 srtasks.exe Token: SeTakeOwnershipPrivilege 1644 srtasks.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe Token: SeTakeOwnershipPrivilege 4164 msiexec.exe Token: SeRestorePrivilege 4164 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1160 msiexec.exe 1160 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1160 msiexec.exe 4164 msiexec.exe 6064 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4164 wrote to memory of 1644 4164 msiexec.exe 94 PID 4164 wrote to memory of 6064 4164 msiexec.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n019.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1160
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0654C3F4D924BC21B5602E0BAF7BC923 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6064
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5568
-
C:\Users\Public\eSTZVO\9gm5Kw.exe"C:\Users\Public\eSTZVO\9gm5Kw.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e599dce.rbs
- Size 7KB
- SHA256 ea1b940e6cddc8efcd317dfda62c3e954cb01d4f08db35bcbcc02ccfa1577121
- MD5 03fa7c5f4a6c48d8e2899e709bc90e2f
- SHA1 b77791b8cad7e1afb87461bce91093485970bd80
- SHA512 ce8462f544f5d7dea27f24260f3f8cce29a5bc58a68efefb61d45a5d1bc9a6a68b4ae2cf294804de8e4d43ac357945511748bc9b33814a5c93a30fcc58145d82
- SSDEEP 96:uVcGgu0CzsxUUadR21CsThqK/UadR21C6jdAsDThqKjHKIK5RPWELEyE/YwJwCKH:uVcXCkzGR2IIBsGR2ISBaHtI5d3KpZ
- TLSH T15FF1F146B20481E2E9977731CF271F263BB3D3E4931463470ADE84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eSTZVO\9gm5Kw.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eSTZVO\UxEnhance64.dll
- Size 3.1MB
- SHA256 d5c53bce526a4c487491f0c0998c881594b74310493f068e98d061d9ded3c647
- MD5 2b450520316334404d9f86d6e0d822c7
- SHA1 5d648fb9339ffe097b09f3486ab922567f37b9a5
- SHA512 ce769a569dcc2ef824d7ed92f9296c8c88cdc8b097720817e294989536a303dbd36cf3dff1029d894782de41d6542146e0167feb9728cf42b376cda321100b6e
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+/:P9m29xx3Tiqt06ox6+z2rNNrKo/
- TLSH T154E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eSTZVO\adoresd.dat
- Size 4.8MB
- SHA256 2e016302d8084d75f244e6082d47f47ee426598dd9675b5d56736fd40915a985
- MD5 8518f983132c50ef6377c1c5438ad82c
- SHA1 603efdb5d05b5cccc8b9b9d96f1bb118175986bb
- SHA512 fce8baef48bb1c4eeb12b19b9dd78729e2b5b219dcfb9e5707c65fae2c9b9702ab7dcee4516b1bb112121a3f5ac7d2a053083b3fb2f7e24e3d09c2b71f43ff88
- SSDEEP 98304:luZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:eQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1F1363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eSTZVO\msadox.tb
- Size 8KB
- SHA256 1730da0df84e37289ccd9d4e85c58803f944f5be4a2bcb3503034d880d567959
- MD5 99453554d61d49b84cb1f40698458537
- SHA1 d543b654c4f58d0b3528eb98247896a1d9a31c0a
- SHA512 d1901e9f1e2283cdd378393dbbe3c591b33cc0566ece8cd97042cf44fcc1d9bf1a731c5a52aa74cf1f36a66deea0af2fee1ab8423b390df4224a1a219d1361a7
- SSDEEP 192:pqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:psZqZOXQ3uqvR2Kfzp
- TLSH T147029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA3C9.tmp
- Size 8.6MB
- SHA256 cfccba7764c9873b25e086db690e221c2555a79c85523756680bdeece1264e82
- MD5 917ccdbd5706c1f850b692d89a68792f
- SHA1 7f2c440834a011108db4e3d486f4ca1291f24ca7
- SHA512 f16fbcec62db76b5dd505b1011dcf25dfb2a84d47757c2e65bc9d9a44b6f842dff16bc918bf5a4ac908d6acdaa3db2e5000dfea81981b4be0af890be2da60306
- SSDEEP 196608:kDPoHyBL2NB7i7z+cwih17qgQRnEAnG5keZbtO:kUHyBSo+Gh17qvGdbY
- TLSH T1D19633EE798B62B4C0DFC3F69502743DB61833CA7F634D1A7A9D2B044D7260654BAB18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e599dcd.msi
- Size 8.6MB
- SHA256 c78a97c78f5624ceb19dce074bddc3ca4f7a4b05fb4b52962a322d9dd4308ffa
- MD5 9552301fddcfa92bd76f03c67a85e4bb
- SHA1 8815a056fee871c53b90c179f3bec869ae959c8b
- SHA512 9ef0f3177b4344a90250c2ca4865c303e26aeee413c9705e861f3c7ad07065b5c293337832ceb8cd2839a381345ef7cc4bddfde86aaea2f23bdf3cc5fa1edcac
- SSDEEP 196608:4DPoHyBL2NB7i7z+cwih17wgQRnEAnG5keZbuS:4UHyBSo+Gh17wvGdbb
- TLSH T1589633AAB98B67B0C0DFC3F68502B07D76183FCA7F624D1A7A9D3B080D7160155B6B18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 7f72bee795bc44fe957e99d1dcdd1ffbf38b876fa4351be51471f4e38aa05eca
- MD5 2caad03ae17b8a2a927fc329b4be06b9
- SHA1 72c9a0746c53c34a1baa7cfaf608c23d7d233d00
- SHA512 6a721d7be949f6a84795014fd859898ed3ae377b6861d3bb96cba95e052b0feec4edd1477f5d35900a14b89910bcf1b8bade7652ade286d56937ebe2fb455006
- SSDEEP 24576:mFo3DMPJdoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVe9:SH8
- TLSH T18F57D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{97951260-8e6f-451e-aded-4398f3aaa3f7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d71b1e9405179d658bd1524d61b154fbf0dd91a0685da9b9d2d5a151d39e2596
- MD5 3d29de6326b5cc4a34689a79cf4e8054
- SHA1 83a63c2f20862333a69d44e965ba19735b4819b8
- SHA512 76c364a6b7b60e85983d0420bab496ece52aa6bba574bd4f5bac97c65ed6b3076ebae495ae899d81b11d3343ab70b136f1e7da8251f4808db1e70445159f5dc1
- SSDEEP 96:F+2Eumvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:QNb++uVm
- TLSH T11FD187085AF54711E2B3AB712DF18557A837B911EF33CB8E0198238E6630A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH