190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
putty-64bit-0.84-installer.msi
Size 3.7MB
Sample260728-pmlleawerc
SHA256 190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b
MD5 20777e8868965ffcc9ce2ff4b12f6651
SHA1 83acc3eee50675ef211969c14b8545652d05e8ed
SHA512 edd36fab83d469765cc88546e0a91175fa80884ad79216d1673a907ee4438e5094ba6db828c01d413b6cf6c87f38aa5e65df54565f46de49d294e6cc6a5e85a6
SSDEEP 98304:j8+rY0FMAm3b5OFQ05gd+qruxFdy9m8WQFKK9Ht4:jzFwb5BdNu37QcT
TLSH
T1CA061213B889C139EC361971CD8F9EEA1A387D603D514C07B7A97E0DECB1690A76335A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3676	MsiExec.exe
3676	MsiExec.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2620	msiexec.exe
6	2620	msiexec.exe
13	2620	msiexec.exe
19	2620	msiexec.exe
21	2620	msiexec.exe
31	2620	msiexec.exe
53	1824	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\PuTTY\puttygen.exe	msiexec.exe
File created	C:\Program Files\PuTTY\website.url	msiexec.exe
File created	C:\Program Files\PuTTY\putty.chm	msiexec.exe
File created	C:\Program Files\PuTTY\LICENCE	msiexec.exe
File created	C:\Program Files\PuTTY\plink.exe	msiexec.exe
File created	C:\Program Files\PuTTY\pscp.exe	msiexec.exe
File created	C:\Program Files\PuTTY\putty.exe	msiexec.exe
File created	C:\Program Files\PuTTY\README.txt	msiexec.exe
File created	C:\Program Files\PuTTY\pageant.exe	msiexec.exe
File created	C:\Program Files\PuTTY\psftp.exe	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592716.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592716.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FEE89B49-1A47-476C-864C-1D5076FC2891}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2929.tmp	msiexec.exe
File created	C:\Windows\Installer\{FEE89B49-1A47-476C-864C-1D5076FC2891}\installericon.exe	msiexec.exe
File created	C:\Windows\Installer\e592718.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{FEE89B49-1A47-476C-864C-1D5076FC2891}\installericon.exe	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2620	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 43 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\ = "PuTTY Private Key File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\ProductName = "PuTTY release 0.84 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\PackageCode = "D69488E64DB4B2F409FEF77A84B886C7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\shell\open\command\ = "\"C:\\Program Files\\PuTTY\\pageant.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PPK_Assoc_ProgId\shell\edit	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ppk	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B98EEF74A1C67468C4D10567CF8219\DesktopFeature = "\x06"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\168AAE9C27B2FAF4F9EEEE1BDAF51DE5\94B98EEF74A1C67468C4D10567CF8219	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\shell\edit\ = "Edit with PuTTYgen"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PPK_Assoc_ProgId\shell\edit\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B98EEF74A1C67468C4D10567CF8219\PathFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B98EEF74A1C67468C4D10567CF8219\PPKFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\ProductIcon = "C:\\Windows\\Installer\\{FEE89B49-1A47-476C-864C-1D5076FC2891}\\installericon.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\shell\edit\command\ = "\"C:\\Program Files\\PuTTY\\puttygen.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppk\ = "PPK_Assoc_ProgId"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppk\Content Type = "application/x-putty-private-key"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PPK_Assoc_ProgId	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList\PackageName = "putty-64bit-0.84-installer.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PPK_Assoc_ProgId\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B98EEF74A1C67468C4D10567CF8219	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\Version = "5505024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\168AAE9C27B2FAF4F9EEEE1BDAF51DE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPK_Assoc_ProgId\shell\open\ = "Load into Pageant"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B98EEF74A1C67468C4D10567CF8219\FilesFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B98EEF74A1C67468C4D10567CF8219\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PPK_Assoc_ProgId\shell\open	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1824	msiexec.exe
1824	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2620	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	1824	msiexec.exe
Token: SeCreateTokenPrivilege	2620	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2620	msiexec.exe
Token: SeLockMemoryPrivilege	2620	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2620	msiexec.exe
Token: SeMachineAccountPrivilege	2620	msiexec.exe
Token: SeTcbPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2620	msiexec.exe
Token: SeTakeOwnershipPrivilege	2620	msiexec.exe
Token: SeLoadDriverPrivilege	2620	msiexec.exe
Token: SeSystemProfilePrivilege	2620	msiexec.exe
Token: SeSystemtimePrivilege	2620	msiexec.exe
Token: SeProfSingleProcessPrivilege	2620	msiexec.exe
Token: SeIncBasePriorityPrivilege	2620	msiexec.exe
Token: SeCreatePagefilePrivilege	2620	msiexec.exe
Token: SeCreatePermanentPrivilege	2620	msiexec.exe
Token: SeBackupPrivilege	2620	msiexec.exe
Token: SeRestorePrivilege	2620	msiexec.exe
Token: SeShutdownPrivilege	2620	msiexec.exe
Token: SeDebugPrivilege	2620	msiexec.exe
Token: SeAuditPrivilege	2620	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2620	msiexec.exe
Token: SeChangeNotifyPrivilege	2620	msiexec.exe
Token: SeRemoteShutdownPrivilege	2620	msiexec.exe
Token: SeUndockPrivilege	2620	msiexec.exe
Token: SeSyncAgentPrivilege	2620	msiexec.exe
Token: SeEnableDelegationPrivilege	2620	msiexec.exe
Token: SeManageVolumePrivilege	2620	msiexec.exe
Token: SeImpersonatePrivilege	2620	msiexec.exe
Token: SeCreateGlobalPrivilege	2620	msiexec.exe
Token: SeCreateTokenPrivilege	2620	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2620	msiexec.exe
Token: SeLockMemoryPrivilege	2620	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2620	msiexec.exe
Token: SeMachineAccountPrivilege	2620	msiexec.exe
Token: SeTcbPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2620	msiexec.exe
Token: SeTakeOwnershipPrivilege	2620	msiexec.exe
Token: SeLoadDriverPrivilege	2620	msiexec.exe
Token: SeSystemProfilePrivilege	2620	msiexec.exe
Token: SeSystemtimePrivilege	2620	msiexec.exe
Token: SeProfSingleProcessPrivilege	2620	msiexec.exe
Token: SeIncBasePriorityPrivilege	2620	msiexec.exe
Token: SeCreatePagefilePrivilege	2620	msiexec.exe
Token: SeCreatePermanentPrivilege	2620	msiexec.exe
Token: SeBackupPrivilege	2620	msiexec.exe
Token: SeRestorePrivilege	2620	msiexec.exe
Token: SeShutdownPrivilege	2620	msiexec.exe
Token: SeDebugPrivilege	2620	msiexec.exe
Token: SeAuditPrivilege	2620	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2620	msiexec.exe
Token: SeChangeNotifyPrivilege	2620	msiexec.exe
Token: SeRemoteShutdownPrivilege	2620	msiexec.exe
Token: SeUndockPrivilege	2620	msiexec.exe
Token: SeSyncAgentPrivilege	2620	msiexec.exe
Token: SeEnableDelegationPrivilege	2620	msiexec.exe
Token: SeManageVolumePrivilege	2620	msiexec.exe
Token: SeImpersonatePrivilege	2620	msiexec.exe
Token: SeCreateGlobalPrivilege	2620	msiexec.exe
Token: SeCreateTokenPrivilege	2620	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2620	msiexec.exe
Token: SeLockMemoryPrivilege	2620	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2620	msiexec.exe
2620	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 3676	1824	msiexec.exe	96
PID 1824 wrote to memory of 4228	1824	msiexec.exe	101
PID 3676 wrote to memory of 4308	3676	MsiExec.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\putty-64bit-0.84-installer.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E1022E20366DD28DEFFD694DD49E4F3B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\PuTTY\README.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592717.rbs

Path C:\Config.Msi\e592717.rbs
Size 12KB
SHA256 4b29623a1e6ce455aee30602f25c5a9a47a5f06ecbd0af69d8a7d7456d1c291f
MD5 1bd6c7eade2fb678092ee1a06bf0d266
SHA1 a011508134265cc08bb950ffe3e41899a53e4ae3
SHA512 fbf6358a7acc915f151a6ecdf676838bad26792393276611a9eaaade8286b1b95a7fa6d0d76ff539b9ddd8f5378f1af5ce7e4f75848ba6a5932578b4683d8845
SSDEEP 192:RaDFOcmohQM5yrnsNdPXHkxvQe9OE7IiE7mpHkkYLa7YsdpX:g5OcmohQM5yrnodfHNEzELC
TLSH
T198427242A745D3D2F9522B35C70B07627BB3E3EA9315239F10CE61289F537C80F6649A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.txt

Path C:\Program Files\PuTTY\README.txt
Size 1KB
SHA256 11bdf4f12d34f617cf81f0c30aef7b596dbd00d0d19cf9e3c2e4648d672b3809
MD5 6cf727766580b6019becca7e62c49e70
SHA1 6842fa969ca4a83a8780e59b75bd30d8859917c1
SHA512 0710ad72f032f54946b089aed10dc3da00f54d9bf835e09cd6fcc90603afb2ca91a6efd0a496b71d51275828f545996885a8718468d69edb45bd4070234b9234
TLSH
T1C031E12F6FEE93F52C55D6D63389D637C201A11843321072785FC048B6AA366E3AE0BD
MD5 SHA1 SHA512 TLSH

Submit Download

PuTTY.lnk~RFe592c85.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)\PuTTY.lnk~RFe592c85.TMP
Size 945B
SHA256 3c5850b7c0de49658e3d12ca7f7eaeebbbf20a8c38540abbe402f49f91d87659
MD5 68102ddb26ea75282565a9bb98e4fb1a
SHA1 693788294a4fe04b0d6b9db6d4b1493387f3d614
SHA512 2be5e7d377df9d19249e87b3fe0081065c5084869cba6419e68c40c519d7100e6f59ab4f5e99aa0f6b3e968fbb0178c55842aa2272ff9e403ba36f3f16c4d9d2
TLSH
T1701185025A822BA5E3A6D1751A2A0B714A3BF843FF554F3A51D682C808B4100A658FAF
MD5 SHA1 SHA512 TLSH

Submit Download

~uTTY.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)\~uTTY.tmp
Size 1KB
SHA256 24c98a15fda51eb8f2dabdba19b704fb8109c7bfba3d574ec24a81df8a7fc935
MD5 36f50cfad3d5fed0cf2cd4a60e21e8e4
SHA1 5b39dedf6f5659ce5c512019359e66e249efd850
SHA512 d4668b263cdebd03b156db7911950372398376676f7676bea95dfb711dd9fe57a70be89f5af3fe19e8efb369c711de76a52b78bf4fad76ad1abb730218aca956
TLSH
T17B11AB025A932BA5E3A6E1751A1A0B71473BFC43FF544F3A51C686CC08B4100A55CFAF
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 66f9ed8ae7ddef9fdbed19c2961ce83e3a018bd723c8b3a7ce8292f9b54bbb53
MD5 e45d26b2f9af565bb5a0ec231026ff2c
SHA1 62273d8fbf143531be5b168360b0799bdd38ac80
SHA512 f792c0d27e7da325dd13b3d698e4513d93ff35cd0d0e5fd400337887e423a716c61f1c8c6524296054ac556fac4c89954dddf13a9c04b0948620a302ce374c7c
TLSH
T1900165D40D1879EB5F45CCE253AACC3A5681B138388485EB3863128CCE52FA88725D8C
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_D665BA8E68FA19E17C77043D2120E619

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_D665BA8E68FA19E17C77043D2120E619
Size 638B
SHA256 dd875e24743b131da941d6d90b5ae73b227b3b672c579ff1c5485e09d46ed82c
MD5 68721803e70cfedec28d765c3a0716e2
SHA1 1995a0df686a30f2fd116b1e7cbf7d4f41fc00c2
SHA512 f792cca49313126fba0d95a9ee70fc53a290ebaed062a4a3bfc79d64599390a666205008e69c88433f0f9d4a832a3b2d73ec476fb4deeea11669e1a06145c1ed
TLSH
T116F068834D3B944CF7F548480CDC71D4BC1555D339C5738A7B39925096A67E51F07204
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 5dbc6d2e4358ba8c81cf5be03fbf8d3ae138f7e0a1f84a2b5d242439cf286b03
MD5 8c12f2ca50959ff5b4f12820c7e8518d
SHA1 4f1222c2839c2df14d51774bf8810be87ee0fc64
SHA512 29404a03b9a6eb46aba78665032a037955b5ce163eef341604a27e83b5a979b90f896b777bd19dcf66e02d54150119ac30efac4cd992f587193d49b45e304c41
TLSH
T15CF0AB380CE7003AF1768C74D6C5A1E7B855F307300299B61AB92344494BF8A6D9217E
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_D665BA8E68FA19E17C77043D2120E619

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_D665BA8E68FA19E17C77043D2120E619
Size 484B
SHA256 23f756494a3d661934017e8b849ac48c85be78b999168007e33d14dcaa70a092
MD5 6384cd12aecd30d993a8948da6155ef6
SHA1 f61b52a5329e3d11f20a60c0f9d42d6b4b5c888d
SHA512 f63fcaf9deddef49103cd2baf1e6b817bfefaef938d839d118fef5d459068f7fe665acf7cc3eeca06cf6b5c2b1e6f92e24705435c2ac029ed022f00e0ccb6d64
TLSH
T1F9F0A32C38EF005EE1B6C57503C44D725C15F035204E279D02900715AF03F405DD2E55
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3BE7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3BE7.tmp
Size 199KB
SHA256 fb7a6eb19d1d1042d3bd8b3add9271116b8b6db3714dfcc0b6fee8e088d4a2cc
MD5 3a4e61909500d677745ef2ab508f3f3b
SHA1 ee398e1a153ca96c2592816eb8e8b2b7bb845e1e
SHA512 feba07bba5007a20e0a1e2ca8c9050ae8624e8fbb0f24aada5dc7c2bde3be561b844453a573cab2a24c3769a8dba401db4eeef0d22ef86e2109b67e54392ee45
SSDEEP 3072:/gCUXX2mXSRH48su9/3wvGxtKyHcas3AOOjflQnERfjqmmQ+cx3XD:/gCgPwYo9/3RtKvasQr2L
TLSH
T11B148D3175D4803DE6FB1932A66EE270AE7DF1142764C59E83848C1FADA40D16BB3B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID2DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID2DB.tmp
Size 102KB
SHA256 097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef
MD5 d9ac1b56edf330a6eb7894ab293f14f6
SHA1 022d8944e3927fff2b330dab54716ddcbb366d16
SHA512 e434410e2b2c2bb1fba4f3fc7c277b978c45b1df1d3c3994d6dc1530558393d7d42a713506bf95d013b2e40e9da36fd3e588fea8d8dc062a24ad931e4d76c328
SSDEEP 3072:6SucbZHLGhmArwB2l9sv69okpLPpxVXpj:aoZ6Zrw0Lrv
TLSH
T1E6A38D21B0C0C172D9BF2D3D4574D6650BBFB830EEA59EAB635402691EB81C0BE35E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592716.msi

Path C:\Windows\Installer\e592716.msi
Size 3.7MB
SHA256 190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b
MD5 20777e8868965ffcc9ce2ff4b12f6651
SHA1 83acc3eee50675ef211969c14b8545652d05e8ed
SHA512 edd36fab83d469765cc88546e0a91175fa80884ad79216d1673a907ee4438e5094ba6db828c01d413b6cf6c87f38aa5e65df54565f46de49d294e6cc6a5e85a6
SSDEEP 98304:j8+rY0FMAm3b5OFQ05gd+qruxFdy9m8WQFKK9Ht4:jzFwb5BdNu37QcT
TLSH
T1CA061213B889C139EC361971CD8F9EEA1A387D603D514C07B7A97E0DECB1690A76335A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c6fcf2f35f0af646de2e61545e20713b9de3dd290ef82e5719597696658d0091
MD5 dbe9436ea72b790513df9660286c363a
SHA1 13bf846a0cee01966fc892e2becf7ba2d67d3222
SHA512 d5d1a2f9bf42685a8899f3b5cee305b7e90b0b5a9ae24caccdd1b08f4064a0e90cbfd7097e8e052fdafeb678281d54c8a073b9863f136898fb3d30fde137d9e5
SSDEEP 24576:Qu8m+1zudoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:F
TLSH
T1CF47D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{206c50e2-90a6-4379-95d8-f73a3fe6bfe6}_OnDiskSnapshotProp

Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{206c50e2-90a6-4379-95d8-f73a3fe6bfe6}_OnDiskSnapshotProp
Size 6KB
SHA256 0c457590770ababadf8482a48fdee3b04bc4101ed675600c2e6c466b0d16ecd2
MD5 58bba61acc789e1047a9038438e4f095
SHA1 0ddb4d9b296fc649f1225e5bb460d9b9d4bcda16
SHA512 bec9ad3f75274c19a6565212eab5c40c09307e9848a8fb3328e36e7c566271e17aec197f9b24b0452cfd7a516efba23c48836d313892c798f88ec84103a1d45c
SSDEEP 96:FxAhduUyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:DsjIb++ZVm
TLSH
T1E7D19A185AF54311E2B3AB7129F18557A477B951EF33CB8E0298238E2670A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download