Analysis
- max time kernel
40s - max time network
42s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c41e94e16d97a8e8602b8f21a6284c56edee42726a6d735d16b299dae10b815.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
40 seconds
Behavioral task
behavioral2
Sample
5c41e94e16d97a8e8602b8f21a6284c56edee42726a6d735d16b299dae10b815.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
40 seconds
General
- Target 5c41e94e16d97a8e8602b8f21a6284c56edee42726a6d735d16b299dae10b815.msi
- Size 7.7MB
- Sample260728-s2jbdazyhs
- SHA256 5c41e94e16d97a8e8602b8f21a6284c56edee42726a6d735d16b299dae10b815
- MD5 bab6a9c8235038b3ebc4ccb0298005cd
- SHA1 9b6d399855b438ed0ba75828a9ce158ab17c201f
- SHA512 13485cc0da540c2aed9cdcdaaf5173885fce2c2a01193dce7622e8d3aa391a00a5882f48b58e67ff8eef5d90b5c1c5dca3b97125833888e7ca978c5032bc0c88
- SSDEEP 196608:x+b6VoPKiXflNXSPb59Rg1dHklfTjJrGQbtr:xzoVf/SPV9CG/JrF
- TLSH T16C8633C63CCA37B1D087C7F04153A09EB12A3FC27E669D0B6BD875444E32A1959B739A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1324 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 1324 MsiExec.exe 11 1324 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e59e584.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\e59e584.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFB4FDE9BF32018952.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD9F32FE178D3DCFB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIEA37.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB03.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5812 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059e6eec40365f0360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380159e6eec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410159e6eec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e359e6eec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e659e6eec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5428 msiexec.exe 5428 msiexec.exe 1324 MsiExec.exe 1324 MsiExec.exe 1324 MsiExec.exe 1324 MsiExec.exe 1324 MsiExec.exe 1324 MsiExec.exe 1324 MsiExec.exe 1324 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 5812 msiexec.exe Token: SeIncreaseQuotaPrivilege 5812 msiexec.exe Token: SeSecurityPrivilege 5428 msiexec.exe Token: SeCreateTokenPrivilege 5812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5812 msiexec.exe Token: SeLockMemoryPrivilege 5812 msiexec.exe Token: SeIncreaseQuotaPrivilege 5812 msiexec.exe Token: SeMachineAccountPrivilege 5812 msiexec.exe Token: SeTcbPrivilege 5812 msiexec.exe Token: SeSecurityPrivilege 5812 msiexec.exe Token: SeTakeOwnershipPrivilege 5812 msiexec.exe Token: SeLoadDriverPrivilege 5812 msiexec.exe Token: SeSystemProfilePrivilege 5812 msiexec.exe Token: SeSystemtimePrivilege 5812 msiexec.exe Token: SeProfSingleProcessPrivilege 5812 msiexec.exe Token: SeIncBasePriorityPrivilege 5812 msiexec.exe Token: SeCreatePagefilePrivilege 5812 msiexec.exe Token: SeCreatePermanentPrivilege 5812 msiexec.exe Token: SeBackupPrivilege 5812 msiexec.exe Token: SeRestorePrivilege 5812 msiexec.exe Token: SeShutdownPrivilege 5812 msiexec.exe Token: SeDebugPrivilege 5812 msiexec.exe Token: SeAuditPrivilege 5812 msiexec.exe Token: SeSystemEnvironmentPrivilege 5812 msiexec.exe Token: SeChangeNotifyPrivilege 5812 msiexec.exe Token: SeRemoteShutdownPrivilege 5812 msiexec.exe Token: SeUndockPrivilege 5812 msiexec.exe Token: SeSyncAgentPrivilege 5812 msiexec.exe Token: SeEnableDelegationPrivilege 5812 msiexec.exe Token: SeManageVolumePrivilege 5812 msiexec.exe Token: SeImpersonatePrivilege 5812 msiexec.exe Token: SeCreateGlobalPrivilege 5812 msiexec.exe Token: SeBackupPrivilege 3080 vssvc.exe Token: SeRestorePrivilege 3080 vssvc.exe Token: SeAuditPrivilege 3080 vssvc.exe Token: SeBackupPrivilege 5428 msiexec.exe Token: SeRestorePrivilege 5428 msiexec.exe Token: SeRestorePrivilege 5428 msiexec.exe Token: SeTakeOwnershipPrivilege 5428 msiexec.exe Token: SeRestorePrivilege 5428 msiexec.exe Token: SeTakeOwnershipPrivilege 5428 msiexec.exe Token: SeRestorePrivilege 5428 msiexec.exe Token: SeTakeOwnershipPrivilege 5428 msiexec.exe Token: SeBackupPrivilege 4184 srtasks.exe Token: SeRestorePrivilege 4184 srtasks.exe Token: SeSecurityPrivilege 4184 srtasks.exe Token: SeTakeOwnershipPrivilege 4184 srtasks.exe Token: SeBackupPrivilege 4184 srtasks.exe Token: SeRestorePrivilege 4184 srtasks.exe Token: SeSecurityPrivilege 4184 srtasks.exe Token: SeTakeOwnershipPrivilege 4184 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5812 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5812 msiexec.exe 5428 msiexec.exe 1324 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5428 wrote to memory of 4184 5428 msiexec.exe 94 PID 5428 wrote to memory of 1324 5428 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5c41e94e16d97a8e8602b8f21a6284c56edee42726a6d735d16b299dae10b815.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 403F25F64B54CCCBEF55D2428B2E4791 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSIEB03.tmp
- Size 7.7MB
- SHA256 91f782f7de6444b31eaa2be85328a881e1368d8615041ca15fc1cde11a0ed9fd
- MD5 1784e755c5e4fdb8c048c128b837fb86
- SHA1 b7093840fe85e22b9c7fe6868f03502870e741c3
- SHA512 e6d4f218c178a4027d053de98f76ce229a5349927ea12b011600103364c41b6e5e5a7b11b98ff228f065c266c4b2c772375539fd0aa5b02ec419eed27042db91
- SSDEEP 196608:G+b6VoPKiXflNXSPb59Rg1dHklfTjJrGQbt5:GzoVf/SPt9CG/Jrv
- TLSH T1AD8633C63CCA33B1D097D7F14252709EB11A33C27E666D0B6ADC69444E32E0D59BB39A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ac0d25d1010f988af6478c1d82b125b5538e9be1e47173cf7391d75defff9c96
- MD5 3bacaa632f0c6edc9925cbb240b0da79
- SHA1 1e5e7d719440d28a316eab7973ea52892fe100eb
- SHA512 c90404a9b8f4991f339df770c93dc9abdd0d8f2517d5a4d8de23a49930217d06016a9dae533829f5685787b13c98adc051b163d08d54449ef77c4531d1e80dbd
- SSDEEP 24576:PFo3DMPedoO/vvTL/ygCCC1wfLeIpblREfUg9fMKU3MaZlTy84x2yrYj2+8:UHo
- TLSH T13757B22436F92210E7B79F3CA8F06A234D397D5B9D15DE8D05451B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4eee659-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3714660e-eb8e-411b-a381-8b0559fe7579}_OnDiskSnapshotProp
- Size 6KB
- SHA256 3b2ea4c86388da9164c901824b95a3a851d117164ddb257409a5ca61b806667e
- MD5 7de46bf3b9f7377f67e4afb13f4e7e57
- SHA1 9517ec33f109559ab5b4322ff0ef02886292725b
- SHA512 1a68a875b4c84681660e2f2062af4a2d8ef3179429663a222a2b2798a148ed67b7ed3b97f0593b164e6dcebe304ad065e9b165ea71aceaf1b1fa0c05fc72a188
- SSDEEP 96:F22Eamkvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:ceLb++uVm
- TLSH T163D198081AF54711E2B3AB7129F18557A837B811EF33CB8E0198238E6670910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH