Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 10:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n016.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n016.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target Install_28n016.msi
- Size 7.6MB
- Sample260729-l9e6csff52
- SHA256 ea7437eca1b3f6eceb41c9a3d2de4d141c0079ab88c5db9cc67dc2e1c855fd3d
- MD5 77372af7fca6411614094b35625d32f4
- SHA1 40c4a3710e7c6d7d5007c58c0255506d0d0d1fce
- SHA512 e2bdbfc0a248782ca1cd865709b4c488ad567b1a307cb7237f10bd2fbd22e986db1a6721a04edf87648c495878c8b0463a54abd67e2e99af32f45f1c609645c2
- SSDEEP 196608:abHbJEFnpsQyLt2ZwUGtmGc3uk0C9bW3i7WqIYht6La9lwGrN:a/JEvsQyLmwUGtmG6ukjFWSrNku9lxN
- TLSH T1DB86338678D232B1C587C371869BD89E7E283F903FA3CD12B99E35110E7773A5676242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5940 XxQUqi.exe - Loads dropped DLL 2 IoCs
pid Process 3796 MsiExec.exe 5940 XxQUqi.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 3796 MsiExec.exe 11 3796 MsiExec.exe 16 3796 MsiExec.exe 17 3796 MsiExec.exe 18 3796 MsiExec.exe 19 3796 MsiExec.exe 21 3796 MsiExec.exe 22 3796 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6C97C39E1851E5AAB36E260F19BBDD5 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b XxQUqi.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFCF17AA09521F8A15.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFCE913B504DAB0A50.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFD972CA3F1DB1FD1F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE620.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE806.tmp msiexec.exe File created C:\Windows\Installer\e59e075.msi msiexec.exe File created C:\Windows\Installer\e59e073.msi msiexec.exe File opened for modification C:\Windows\Installer\e59e073.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF15134727DC67CA77.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2420 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n016.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "6A6A15760BCD99542AB7D9BD53D22AE6" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4588 msiexec.exe 4588 msiexec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 3796 MsiExec.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe 5940 XxQUqi.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2420 msiexec.exe Token: SeIncreaseQuotaPrivilege 2420 msiexec.exe Token: SeSecurityPrivilege 4588 msiexec.exe Token: SeCreateTokenPrivilege 2420 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2420 msiexec.exe Token: SeLockMemoryPrivilege 2420 msiexec.exe Token: SeIncreaseQuotaPrivilege 2420 msiexec.exe Token: SeMachineAccountPrivilege 2420 msiexec.exe Token: SeTcbPrivilege 2420 msiexec.exe Token: SeSecurityPrivilege 2420 msiexec.exe Token: SeTakeOwnershipPrivilege 2420 msiexec.exe Token: SeLoadDriverPrivilege 2420 msiexec.exe Token: SeSystemProfilePrivilege 2420 msiexec.exe Token: SeSystemtimePrivilege 2420 msiexec.exe Token: SeProfSingleProcessPrivilege 2420 msiexec.exe Token: SeIncBasePriorityPrivilege 2420 msiexec.exe Token: SeCreatePagefilePrivilege 2420 msiexec.exe Token: SeCreatePermanentPrivilege 2420 msiexec.exe Token: SeBackupPrivilege 2420 msiexec.exe Token: SeRestorePrivilege 2420 msiexec.exe Token: SeShutdownPrivilege 2420 msiexec.exe Token: SeDebugPrivilege 2420 msiexec.exe Token: SeAuditPrivilege 2420 msiexec.exe Token: SeSystemEnvironmentPrivilege 2420 msiexec.exe Token: SeChangeNotifyPrivilege 2420 msiexec.exe Token: SeRemoteShutdownPrivilege 2420 msiexec.exe Token: SeUndockPrivilege 2420 msiexec.exe Token: SeSyncAgentPrivilege 2420 msiexec.exe Token: SeEnableDelegationPrivilege 2420 msiexec.exe Token: SeManageVolumePrivilege 2420 msiexec.exe Token: SeImpersonatePrivilege 2420 msiexec.exe Token: SeCreateGlobalPrivilege 2420 msiexec.exe Token: SeBackupPrivilege 2660 vssvc.exe Token: SeRestorePrivilege 2660 vssvc.exe Token: SeAuditPrivilege 2660 vssvc.exe Token: SeBackupPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeBackupPrivilege 4316 srtasks.exe Token: SeRestorePrivilege 4316 srtasks.exe Token: SeSecurityPrivilege 4316 srtasks.exe Token: SeTakeOwnershipPrivilege 4316 srtasks.exe Token: SeBackupPrivilege 4316 srtasks.exe Token: SeRestorePrivilege 4316 srtasks.exe Token: SeSecurityPrivilege 4316 srtasks.exe Token: SeTakeOwnershipPrivilege 4316 srtasks.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2420 msiexec.exe 2420 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2420 msiexec.exe 4588 msiexec.exe 3796 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4316 4588 msiexec.exe 93 PID 4588 wrote to memory of 3796 4588 msiexec.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n016.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2420
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 58D469A6062829CF185BB824FD985BA6 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3796
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
C:\Users\Public\2VdRmL\XxQUqi.exe"C:\Users\Public\2VdRmL\XxQUqi.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5940
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e074.rbs
- Size 7KB
- SHA256 28ee51588d6a07c2453d779dd063408ef5132da2784c732c9185b74253f3e540
- MD5 b086a0388c17cef4d62b70885371f26c
- SHA1 43bcfe12847b466d621f4fb5a4ec69f50f2161be
- SHA512 4cec7607ce0f9b2402f39b6509d284b98abd6b6edc1742331283d7670f2dcb7966b959c7640d2b42e2455a4ca3dc899efc5e104e4f62658a7c3db3ce9c12c052
- SSDEEP 96:7V7Ggu0CXpxUUjdR21CsThqK/UjdR21C6jdAsDThqKjHKIK5RPWELEyE/YwNYCKy:7V7XCvzxR2IIBsxR2ISBaHtI5RvKpw
- TLSH T134F1F046B20481E2E9D76730CF271F263BB3D3E49314A34B1ADE84749E4738D6EA519E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\2VdRmL\UxEnhance64.dll
- Size 3.1MB
- SHA256 f03d284e2c91c13e946d3e9531906aed89adb37cad73247b2d4728477f5d28b0
- MD5 0185ede01bded48a2d819b3e4b5c825e
- SHA1 b16a975c8bae3d815528acc58b22e38fb650a3f3
- SHA512 f6723f8cc2b1dd741147e2e32c753b80163083a9b749aea8d82d8231f2bd5fd0b56601ff440dc8be4b03f748af0c7366029c42ac60c70fc33f8fd1110f366164
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+w:P9m29xx3Tiqt06ox6+z2rNNrKow
- TLSH T11CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\2VdRmL\XxQUqi.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\2VdRmL\adoresd.dat
- Size 4.8MB
- SHA256 df53feca3b9419e7f2a364faa196d56d9f45eb267fc9cc3863a00ecb98e8c88c
- MD5 6e37c03ab4febc6409dc11ac17cf72c2
- SHA1 9b513494ab453ca1e8939c09bd14e3ba41cca26c
- SHA512 ee14a0cc69a874424d9b1f192187df447f283ed190c32ca1b812bde7ed8bc10236a527e9dcf39a55c0ac05dfa09b306acee8e0bbecd9329892a0b3d2ce760b20
- SSDEEP 98304:tuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:mQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1AD363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\2VdRmL\msadox.tb
- Size 8KB
- SHA256 04b500237fd8f44b11f7a9b6767d51f8a99995525458cd1d462659add5720a01
- MD5 9944a3792ea35fb7676125cceeada075
- SHA1 447603545fde570006dbc14e2fc3c3b0f0e46cdc
- SHA512 6e3f27ee53ac3d1d0fb6d01416d03941627a00a8e4cc7263f73540ca2edaa6402c31f68fe5daf32b69478a9490dc11599a51e332de426251e0b94bc485abb1c9
- SSDEEP 192:yqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ysZqZOXQ3uqvR2Kfzp
- TLSH T10B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE806.tmp
- Size 7.5MB
- SHA256 f248387fde2a483ff4023a4d31603aa055ecf9f8ba69eb2fe3c6fd8c10add60d
- MD5 9c5df7d89652b77c90c02838b2650625
- SHA1 1f6e3026ea8a270b24354d15668187ac0e23c3e2
- SHA512 2d27ff5e786f168a41cd5f3299bc092feff6085e8b9c2cb56c74d738b18ec4aaae183a410aeaff711d8cb3b241a8d44a81bc347aa899d2ec8f3c0c8208a2a770
- SSDEEP 196608:5bHbJEFnpsQyLt2ZwUGtmGc3ukaC9bW3i7WqIYht6La9lwGrR:5/JEvsQyLmwUGtmG6ukpFWSrNku9lxR
- TLSH T11186338674D332B0C5C7C371869BD89E7D283FA03EF3DD12B99E29110E5772A6636642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59e073.msi
- Size 7.6MB
- SHA256 ea7437eca1b3f6eceb41c9a3d2de4d141c0079ab88c5db9cc67dc2e1c855fd3d
- MD5 77372af7fca6411614094b35625d32f4
- SHA1 40c4a3710e7c6d7d5007c58c0255506d0d0d1fce
- SHA512 e2bdbfc0a248782ca1cd865709b4c488ad567b1a307cb7237f10bd2fbd22e986db1a6721a04edf87648c495878c8b0463a54abd67e2e99af32f45f1c609645c2
- SSDEEP 196608:abHbJEFnpsQyLt2ZwUGtmGc3uk0C9bW3i7WqIYht6La9lwGrN:a/JEvsQyLmwUGtmG6ukjFWSrNku9lxN
- TLSH T1DB86338678D232B1C587C371869BD89E7E283F903FA3CD12B99E35110E7773A5676242
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 8db05336541a690badb59be0d69e2c362a1f84a435422239146a8277178fad13
- MD5 7a4b97432154444f721806b8808e389c
- SHA1 514eb0e97ee94707bc64f45a811fabe6b85b5d20
- SHA512 7858def3e0ec50029a3c6ab5373136a80a41f98a15a97cd3f7a39507071fddf3ea19bf9d90f4153edc3c3e6ab8ced43657495d52b1a2b500964b597a26ccd311
- SSDEEP 24576:sFo3DMP8LdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nuh:jLHg
- TLSH T14E57F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{abb03ea7-3133-4e4f-95fb-6506a49aeac8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 53b1c254c3718e9e1ac09a690a5908e44abaf893f1b591c5be815cecf065f624
- MD5 ffaf3f6c84c166022fc0cc3ae435fc66
- SHA1 0e6d2d0837861476345220a24d38613fae91b486
- SHA512 04bbeaa1566e2230931a06906e9d1e161bf305f8832e01603d7d007d94c681efe394a9f54ee76af12fc39fe6a4c1bf1184a711c92245ae603dfb272b62629da4
- SSDEEP 96:FqIG2Ebmvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:0Bqb++uVm
- TLSH T1CCD186085AF54711E2F3AB3129F18557A877B911EF33CB8E0198238E6631A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH