Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n012.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n012.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target Install_28n012.msi
- Size 7.9MB
- Sample260729-mcbmcadr7x
- SHA256 4b52c9cb1410dfaf19c1d6545316704f48408e42e8cf654915da4cd1dc55ac70
- MD5 88ec8089ddc87a77b439416f3199502f
- SHA1 7af7624a9c21cd0bb9bc8d8854c559d6451bcd7e
- SHA512 ff62864b699461a7d402da3c284682ae194fa47d134e20d8538ffc9ecaec7b5b66d99c9a71989698aeedb99f2050fdd5ce3070eae9a47bf67b239ccf7440fb76
- SSDEEP 196608:2e8HloFs9HAv6JwipEJg0jwZ7e4gt7KQcCdnAxaW2Bhv9sUZoXj:0HloAHTJRpEJ8Z8Ax78rsym
- TLSH T14F8633D52FC62B75E05BD3F496427A2D341A3FC2BF650C467F9936803EB262064BA718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5392 V21jQI.exe - Loads dropped DLL 2 IoCs
pid Process 1936 MsiExec.exe 5392 V21jQI.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 1936 MsiExec.exe 15 1936 MsiExec.exe 16 1936 MsiExec.exe 17 1936 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b V21jQI.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF7DACFD728FCDF9F5.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSIE2D4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE391.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF9099424D2089622.TMP msiexec.exe File created C:\Windows\Installer\e59de33.msi msiexec.exe File created C:\Windows\SystemTemp\~DF804EADEAD885C8BA.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF854DA22DBFB288A4.TMP msiexec.exe File created C:\Windows\Installer\e59de31.msi msiexec.exe File opened for modification C:\Windows\Installer\e59de31.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2016 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "C45DCD0533CC3DD4EB78B8A85C8207F1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n012.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4192 msiexec.exe 4192 msiexec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 1936 MsiExec.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe 5392 V21jQI.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2016 msiexec.exe Token: SeIncreaseQuotaPrivilege 2016 msiexec.exe Token: SeSecurityPrivilege 4192 msiexec.exe Token: SeCreateTokenPrivilege 2016 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2016 msiexec.exe Token: SeLockMemoryPrivilege 2016 msiexec.exe Token: SeIncreaseQuotaPrivilege 2016 msiexec.exe Token: SeMachineAccountPrivilege 2016 msiexec.exe Token: SeTcbPrivilege 2016 msiexec.exe Token: SeSecurityPrivilege 2016 msiexec.exe Token: SeTakeOwnershipPrivilege 2016 msiexec.exe Token: SeLoadDriverPrivilege 2016 msiexec.exe Token: SeSystemProfilePrivilege 2016 msiexec.exe Token: SeSystemtimePrivilege 2016 msiexec.exe Token: SeProfSingleProcessPrivilege 2016 msiexec.exe Token: SeIncBasePriorityPrivilege 2016 msiexec.exe Token: SeCreatePagefilePrivilege 2016 msiexec.exe Token: SeCreatePermanentPrivilege 2016 msiexec.exe Token: SeBackupPrivilege 2016 msiexec.exe Token: SeRestorePrivilege 2016 msiexec.exe Token: SeShutdownPrivilege 2016 msiexec.exe Token: SeDebugPrivilege 2016 msiexec.exe Token: SeAuditPrivilege 2016 msiexec.exe Token: SeSystemEnvironmentPrivilege 2016 msiexec.exe Token: SeChangeNotifyPrivilege 2016 msiexec.exe Token: SeRemoteShutdownPrivilege 2016 msiexec.exe Token: SeUndockPrivilege 2016 msiexec.exe Token: SeSyncAgentPrivilege 2016 msiexec.exe Token: SeEnableDelegationPrivilege 2016 msiexec.exe Token: SeManageVolumePrivilege 2016 msiexec.exe Token: SeImpersonatePrivilege 2016 msiexec.exe Token: SeCreateGlobalPrivilege 2016 msiexec.exe Token: SeBackupPrivilege 3056 vssvc.exe Token: SeRestorePrivilege 3056 vssvc.exe Token: SeAuditPrivilege 3056 vssvc.exe Token: SeBackupPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeBackupPrivilege 4728 srtasks.exe Token: SeRestorePrivilege 4728 srtasks.exe Token: SeSecurityPrivilege 4728 srtasks.exe Token: SeTakeOwnershipPrivilege 4728 srtasks.exe Token: SeBackupPrivilege 4728 srtasks.exe Token: SeRestorePrivilege 4728 srtasks.exe Token: SeSecurityPrivilege 4728 srtasks.exe Token: SeTakeOwnershipPrivilege 4728 srtasks.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2016 msiexec.exe 2016 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2016 msiexec.exe 4192 msiexec.exe 1936 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4192 wrote to memory of 4728 4192 msiexec.exe 94 PID 4192 wrote to memory of 1936 4192 msiexec.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n012.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2016
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 371F8323D64CB0D213F94F7172C2B28C E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
C:\Users\Public\3Cwd1Z\V21jQI.exe"C:\Users\Public\3Cwd1Z\V21jQI.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59de32.rbs
- Size 7KB
- SHA256 4cb48b119d905f53eb535382fb9841042056fbc5bfd225958564c7796ef81829
- MD5 4980f8d018baec5a24c4b831d5727615
- SHA1 7344899b45dcc2c5327f7cc43444b2f169b59a6c
- SHA512 1685b0df82e3594b7cb467683e19c5541cf8b30424df680d441b003ca3c9a41497296cf3d25aa0ede589ca5497cbcf4907f73254e06474c38f426453ee3a6fbd
- SSDEEP 96:iVDGgu0CD9xUUjdq21CsThqK/Ujdq21C6jdAsDThqKjHKIK5RPWELEyE/YwgCKpk:iVDXCnzxq2IIBsxq2ISBaHtI5TKpk
- TLSH T1D4F1F046B20485E2E9977730CF271B263BB3D3E49314A3071ADD84749E4738D6EA619F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3Cwd1Z\UxEnhance64.dll
- Size 3.1MB
- SHA256 90dfb2829a047b003256fe5a94d6b2cd1a6dfb0c0fa58edb2adc04732b630aa6
- MD5 741bd0691470b5b7d3300764e8caa94f
- SHA1 835f26598b9c4ecfca75d2b3c1bf2a533612d344
- SHA512 b31af91b6246f38959d9bfededbd4806a761d6eee5fa7c2374d7d66e708a4f124a2f1e2dd7cb07dbb80d000ff160be87f685b486f90ac2a0c4da2a974de2c535
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+4:P9m29xx3Tiqt06ox6+z2rNNrKo4
- TLSH T1B8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3Cwd1Z\V21jQI.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3Cwd1Z\adoresd.dat
- Size 4.8MB
- SHA256 e1b714867c9da41a084f77c8924d0c4072532780acda0789008190b7e162f8cd
- MD5 00c05e6a7d2de711c9fba7e8c8d694a3
- SHA1 8d413c1624d1f47c3d6fb4826d3b817c2b9a03bd
- SHA512 677692924bfa18d04888842588c555f740621a51d4f903f745ae91d4b3817900864d82734078aef9e3fe13621a74ca48204e462b76b5b19d422c6f903dec19dc
- SSDEEP 98304:OuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:TQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T15F363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3Cwd1Z\msadox.tb
- Size 8KB
- SHA256 94769727683291722c0e9d1c2b50148a807d66c543e4dd2e7aadf4e7d4940dc3
- MD5 f078be737ee8d23231ff91b07bd4a482
- SHA1 c21710e5cb874e01542e50e95a73d83d8539daa9
- SHA512 e06883f764584675786526a74f84fbc938b19603ea9eb57a0af1576880b0cae4c4034080568c41583ad528465e536204c0a9fdbee2d1c0bd2ea40bbddbce7070
- SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
- TLSH T15B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE391.tmp
- Size 7.9MB
- SHA256 80af4ec52df0dfa90d419ab866b6b9965af4c3a4743856b35bb4d45629b4e56f
- MD5 343d9f5f79b357472259996e118c48f9
- SHA1 a9cbc3e885e028715a5d02d91a92cf079282921f
- SHA512 ea32d02f5483854b736f03b4db35fca416a32d52fedf012e867e3cfa38cd2ba2d0b8f022088feff5afca00eee303a9468147a274ca8eb9e0234f5be6e840a0ec
- SSDEEP 196608:re8HloFs9HAv6JwipEJg0jBZ7e4gt7KQcCdnAxaW2Bhv9sUZoX/:LHloAHTJRpEJ9Z8Ax78rsym
- TLSH T10E8633E52FCA27B4E15FD3F4D6827A2D741A3BC2FE650C457F9926803EA2610747A708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59de31.msi
- Size 7.9MB
- SHA256 4b52c9cb1410dfaf19c1d6545316704f48408e42e8cf654915da4cd1dc55ac70
- MD5 88ec8089ddc87a77b439416f3199502f
- SHA1 7af7624a9c21cd0bb9bc8d8854c559d6451bcd7e
- SHA512 ff62864b699461a7d402da3c284682ae194fa47d134e20d8538ffc9ecaec7b5b66d99c9a71989698aeedb99f2050fdd5ce3070eae9a47bf67b239ccf7440fb76
- SSDEEP 196608:2e8HloFs9HAv6JwipEJg0jwZ7e4gt7KQcCdnAxaW2Bhv9sUZoXj:0HloAHTJRpEJ8Z8Ax78rsym
- TLSH T14F8633D52FC62B75E05BD3F496427A2D341A3FC2BF650C467F9936803EB262064BA718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 84fa1e870eab89586055fc17afaaf80f8569d2fde68b27da76e968fbbf077893
- MD5 cb3b7701be6b10dc2687bbcdffe97bb3
- SHA1 2f0fa0bdb44e6ee6bef2e1120facbd5612f2bfcc
- SHA512 a3a5392ac6f1ec0107442b5c4acbd3ef0886744e4213e2873ecf64500abe25851fd989862586840109645ab2a3a9c9739f1cc8bc13de0af642588404ca4f698a
- SSDEEP 24576:HFo3DMPldoO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+4:XHU
- TLSH T15557F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{dd6989e8-520b-4fad-b417-57b8b744e267}_OnDiskSnapshotProp
- Size 6KB
- SHA256 fe29c567a2ed7421179ac0315e68d6b85bbdb349b574813100d569f4c5197429
- MD5 1efcdf81e83a4e98d761519587527a6d
- SHA1 d65f94d6e4265f92a9e825facdf8f77f3409ef8d
- SHA512 86a12ab0d97ca8297d234cc3a426ff04e69d94547c03aba1b6d427a1a4c7f3cce6f09bc29da73090dcf777be28562458055eaa550ba6f66f5cfe4ba9725ddb6d
- SSDEEP 96:Fw2E7hvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:2Nb++uVm
- TLSH T18BD187084AF54711E2B3AB312DF58557A837B811EF33CB8E0198238E6631A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH