Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 08:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n009.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n009.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Install_28n009.msi
- Size 9.9MB
- Sample260729-klghvassbx
- SHA256 809787de45a5a6d579ea200fef1331f9ae37b2f844fe08b256016a5040badd49
- MD5 8d8ad182f89edb22675ac418d2532df2
- SHA1 dfaed53b3cf900c9f07d14990cf1f7273d08281b
- SHA512 3e02b610cf612083eff1ef499511402ac3a56396c61e6fa53553cc79b10b9a622631fb1e820b962b3ef8b9fddde272b5bd5cf76cf9c17fd2ebbf770c16d6c5d9
- SSDEEP 196608:4Jo9NyvZGBpsXoC6TopnZZsSsDKEKEsTyMXpjinfLQ0LnyrWSp80nHsM:J9YvZG7QoCTbCKhGTjLnALp8SH1
- TLSH T179A633EA3E833B3AC00BC7B24146612E7179BFC9FF318C9666A9791C19736203677615
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\gz43oi = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation T1K3gJ.exe - Executes dropped EXE 1 IoCs
pid Process 4780 T1K3gJ.exe - Loads dropped DLL 2 IoCs
pid Process 4256 MsiExec.exe 4780 T1K3gJ.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\gz43oi\\T1K3gJ.exe\"" T1K3gJ.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 32 4256 MsiExec.exe 49 4256 MsiExec.exe 51 4256 MsiExec.exe 67 4256 MsiExec.exe 73 4256 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4876 cmd.exe 4788 cmd.exe 2804 cmd.exe 1344 cmd.exe 2012 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b T1K3gJ.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e58a768.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSIA8FE.tmp msiexec.exe File created C:\Windows\Installer\e58a766.msi msiexec.exe File opened for modification C:\Windows\Installer\e58a766.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA841.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2960 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 64 cmd.exe 1296 cmd.exe 2868 cmd.exe 1084 cmd.exe 4420 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "D8631DF34EC18D74D9529782E70E41AF" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n009.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4596 schtasks.exe 4340 schtasks.exe 3592 schtasks.exe 4468 schtasks.exe 2620 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3824 msiexec.exe 3824 msiexec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4256 MsiExec.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe 4780 T1K3gJ.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2960 msiexec.exe Token: SeIncreaseQuotaPrivilege 2960 msiexec.exe Token: SeSecurityPrivilege 3824 msiexec.exe Token: SeCreateTokenPrivilege 2960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2960 msiexec.exe Token: SeLockMemoryPrivilege 2960 msiexec.exe Token: SeIncreaseQuotaPrivilege 2960 msiexec.exe Token: SeMachineAccountPrivilege 2960 msiexec.exe Token: SeTcbPrivilege 2960 msiexec.exe Token: SeSecurityPrivilege 2960 msiexec.exe Token: SeTakeOwnershipPrivilege 2960 msiexec.exe Token: SeLoadDriverPrivilege 2960 msiexec.exe Token: SeSystemProfilePrivilege 2960 msiexec.exe Token: SeSystemtimePrivilege 2960 msiexec.exe Token: SeProfSingleProcessPrivilege 2960 msiexec.exe Token: SeIncBasePriorityPrivilege 2960 msiexec.exe Token: SeCreatePagefilePrivilege 2960 msiexec.exe Token: SeCreatePermanentPrivilege 2960 msiexec.exe Token: SeBackupPrivilege 2960 msiexec.exe Token: SeRestorePrivilege 2960 msiexec.exe Token: SeShutdownPrivilege 2960 msiexec.exe Token: SeDebugPrivilege 2960 msiexec.exe Token: SeAuditPrivilege 2960 msiexec.exe Token: SeSystemEnvironmentPrivilege 2960 msiexec.exe Token: SeChangeNotifyPrivilege 2960 msiexec.exe Token: SeRemoteShutdownPrivilege 2960 msiexec.exe Token: SeUndockPrivilege 2960 msiexec.exe Token: SeSyncAgentPrivilege 2960 msiexec.exe Token: SeEnableDelegationPrivilege 2960 msiexec.exe Token: SeManageVolumePrivilege 2960 msiexec.exe Token: SeImpersonatePrivilege 2960 msiexec.exe Token: SeCreateGlobalPrivilege 2960 msiexec.exe Token: SeBackupPrivilege 5108 vssvc.exe Token: SeRestorePrivilege 5108 vssvc.exe Token: SeAuditPrivilege 5108 vssvc.exe Token: SeBackupPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeBackupPrivilege 1716 srtasks.exe Token: SeRestorePrivilege 1716 srtasks.exe Token: SeSecurityPrivilege 1716 srtasks.exe Token: SeTakeOwnershipPrivilege 1716 srtasks.exe Token: SeBackupPrivilege 1716 srtasks.exe Token: SeRestorePrivilege 1716 srtasks.exe Token: SeSecurityPrivilege 1716 srtasks.exe Token: SeTakeOwnershipPrivilege 1716 srtasks.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe Token: SeTakeOwnershipPrivilege 3824 msiexec.exe Token: SeRestorePrivilege 3824 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2960 msiexec.exe 2960 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3824 wrote to memory of 1716 3824 msiexec.exe 98 PID 3824 wrote to memory of 4256 3824 msiexec.exe 101 PID 4780 wrote to memory of 1344 4780 T1K3gJ.exe 116 PID 1344 wrote to memory of 4596 1344 cmd.exe 119 PID 1344 wrote to memory of 4444 1344 cmd.exe 120 PID 1344 wrote to memory of 2868 1344 cmd.exe 123 PID 1084 wrote to memory of 1892 1084 cmd.exe 124 PID 4780 wrote to memory of 2012 4780 T1K3gJ.exe 126 PID 2012 wrote to memory of 4340 2012 cmd.exe 129 PID 2012 wrote to memory of 4080 2012 cmd.exe 130 PID 2012 wrote to memory of 1940 2012 cmd.exe 132 PID 4420 wrote to memory of 4804 4420 cmd.exe 134 PID 4780 wrote to memory of 4876 4780 T1K3gJ.exe 135 PID 4876 wrote to memory of 3592 4876 cmd.exe 137 PID 4876 wrote to memory of 1796 4876 cmd.exe 138 PID 4876 wrote to memory of 4300 4876 cmd.exe 141 PID 64 wrote to memory of 4752 64 cmd.exe 142 PID 4780 wrote to memory of 4788 4780 T1K3gJ.exe 143 PID 4788 wrote to memory of 4468 4788 cmd.exe 145 PID 4788 wrote to memory of 4812 4788 cmd.exe 146 PID 1296 wrote to memory of 4548 1296 cmd.exe 149 PID 4788 wrote to memory of 4556 4788 cmd.exe 150 PID 4780 wrote to memory of 2804 4780 T1K3gJ.exe 151 PID 2804 wrote to memory of 2620 2804 cmd.exe 153 PID 2804 wrote to memory of 4444 2804 cmd.exe 154 PID 2804 wrote to memory of 1832 2804 cmd.exe 157 PID 2868 wrote to memory of 1912 2868 cmd.exe 158 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n009.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2960
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2A027AEEFEAE24F0604E4D6852809AF2 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4256
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Users\Public\gz43oi\T1K3gJ.exeC:\Users\Public\gz43oi\T1K3gJ.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\gz43oi\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\gz43oi\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4596
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4444
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4340
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4080
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1940
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3592
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1796
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4468
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4812
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2620
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4444
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1832
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\gz43oi" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\gz43oi" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1892
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:5084
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4804
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4752
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4548
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1912
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a767.rbs
- Size 7KB
- SHA256 cb48b84ab1936792d1e67b06cb388d980d1acdd5909ba925e85c374e00ec2ff4
- MD5 bdaf8df58354ef79a1033f8d6e8551ad
- SHA1 5fa805c8c3d2d603cf127f87a85b5dd40da77e24
- SHA512 0ce32c312a24ef68219084f03621bef532939a6cd9b95f4bc0c1918ad47e75a6cb07c0bed2beb4de964f07d36ca0392abb9bd0e0f7904be74dad580394610345
- SSDEEP 96:zV+4uu1e2RxUUjda21CsThqK/Ujda21C6jdAsDThqKjHYIK5RPWELEyE/YwuRCKS:zV+4e2zxa2IIBsxa2ISBIHtI5CkKp8
- TLSH T14AF1FF46B20581E2F9977730CF271B663BB3D3E49314630B0ADE84748E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gz43oi\T1K3gJ.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gz43oi\UxEnhance64.dll
- Size 3.1MB
- SHA256 575f2d8a932083b71ce4d43c42d685266c2b04d412b117396c39bdbbc4432dab
- MD5 83eaf28ccd3616362d94abe93a3cfe96
- SHA1 15caf382bdde0df95bb71472f045e1e5e09371bd
- SHA512 8dd1fb738ec3a97ab5699c9e6accb72f62d2886ceb0d8a122e5d40cbe7e482b723a14fa1cdd01ab9a063be62e897e69d5a1f5c4c0e57d0f21d3a6802f993f9f0
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+C:P9m29xx3Tiqt06ox6+z2rNNrKoC
- TLSH T1B3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gz43oi\adoresd.dat
- Size 4.8MB
- SHA256 b9796ec7aaf458d5355c4a9f765920214748a5ec852cf6ca07096cabf769536a
- MD5 1fc100193b019c0632b4e246f223baa8
- SHA1 d6cd2bf7cca1b44d40befeb1b168f2f2175f25c4
- SHA512 1d014f6582f01409a3b23272ee010de2dd6d5ad476b0adb1d95aea188310a2a87c722e89e5f8279f66134ec1c37941cbdae3527dbaf098f0e990c235b00ae606
- SSDEEP 98304:uuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:zQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1DB363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gz43oi\msadox.tb
- Size 8KB
- SHA256 8528be2693acc8cf58c61c5777b4292426c1d7e95c54d584ddebd61306201f13
- MD5 bc128cde6736b2cdde715a6e72442e93
- SHA1 ec0d3284e7ccc3313ba7ace0ebce5859f22517c9
- SHA512 40fadd3a076938af3800ebb87961762ab8879de70b178bcfa9ea3d3f6f83c07ac27f6cb9b8f9d6a77aad0adc548306b399c01510972f4ae031134e90481a2525
- SSDEEP 192:ZqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ZsZqZOXQ3uqvR2Kfzp
- TLSH T1E1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA8FE.tmp
- Size 9.8MB
- SHA256 514db5f345a2d4caa99b8265dfa5cf46f3041da780c488d87cb6176a50064a29
- MD5 16348556bc8d3425f0e41f90a7eb2cd2
- SHA1 ac4f33c162dc5c98445b9c17c57ac3083f68eac6
- SHA512 0605d7812a5df671f7123f90d3ee8db698d33425b60140b73794858584e4095388e647c8980e502f8371bbce53a833a9b4c49a83f3267d03e859d6c89a788bbd
- SSDEEP 196608:/Jo9NyvZGBpsXoC6TopnZZsSsDKEKSsTyMXpjinfLQ0LnyzWSp80nHsU:+9YvZG7QoCTbCK7GTjLnALp8SHH
- TLSH T1B2A633EA3E833B79C007C7B24186342E717A73CAFF319C9A66F9691D19A35203637615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58a766.msi
- Size 9.9MB
- SHA256 809787de45a5a6d579ea200fef1331f9ae37b2f844fe08b256016a5040badd49
- MD5 8d8ad182f89edb22675ac418d2532df2
- SHA1 dfaed53b3cf900c9f07d14990cf1f7273d08281b
- SHA512 3e02b610cf612083eff1ef499511402ac3a56396c61e6fa53553cc79b10b9a622631fb1e820b962b3ef8b9fddde272b5bd5cf76cf9c17fd2ebbf770c16d6c5d9
- SSDEEP 196608:4Jo9NyvZGBpsXoC6TopnZZsSsDKEKEsTyMXpjinfLQ0LnyrWSp80nHsM:J9YvZG7QoCTbCKhGTjLnALp8SH1
- TLSH T179A633EA3E833B3AC00BC7B24146612E7179BFC9FF318C9666A9791C19736203677615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 8e7dfdebc383a677cee15cd619d134fb83ff87b3f02b21b3ccee60b9c459c470
- MD5 22aac8c0a7eb0d66111ade3ae4fade3f
- SHA1 8bf0bf2f372b4234ce707acf902265b7b3be641e
- SHA512 8da6112c4de77cd770a0a181bf2a1c40bf0f080bc7a169911a94ee8408f00011a372bc31dc2e31cfed318fa1e2968df87a89bd37ee7bdbfeaac7324ce60d0709
- SSDEEP 24576:Ku8m+1z8doO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:h
- TLSH T17C47D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cc1725e8-0aec-4ce8-a379-3787bb5aefc4}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1339259ed3d9162f979d541692616389e3d3d101f2e4fd7a3741ba2e6aec7c83
- MD5 6fe82864bd714d90b3c175c4de527d9b
- SHA1 9c1cce2cf76205dad964ecddc9f4866ca0bd5438
- SHA512 42c4697ab655d2a0bdc238587c8b05221d1761e7b5aa4ba45a19553a2a80a8432669ef395be758a57c77172e85b3025c52495b776e8c2cadd6f7f487a566e4d9
- SSDEEP 96:F4stDEhdgyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:WstEyIb++ZVm
- TLSH T1DBD198085AF54711E2B3AB7129F18557A837B811EF33CB8E0298238E6630910F876F5F
- MD5 SHA1 SHA512 SSDEEP TLSH