Overview

overview

8

Static

static

3

IE11-Setup-Full.msi

windows10-ltsc_2021-x64

8

Resubmissions

29/07/2026, 16:51

260729-vcsvmabp818

29/07/2026, 16:46

260729-t94gysbp6v8

Analysis

  • user interaction
    yes
  • max time kernel
    44s
  • max time network
    46s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    29/07/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IE11-Setup-Full.msi
  • Size 492KB
  • Sample260729-vcsvmabp81
  • SHA256 b539b9bf19e2283285264f46f572f47e97eee4388ce823a9014400f2252b8250
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 27 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 62 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\IE11-Setup-Full.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1184
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2900
      • C:\Windows\Installer\MSI8BE1.tmp
        "C:\Windows\Installer\MSI8BE1.tmp"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IE-Setup.cmd
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1880
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IE-REDIST.EXE
            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IE-REDIST.exe /ieak-full:C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4196
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe ieadvpack.dll,LaunchINFSection C:\Program Files\Internet Explorer\SIGNUP\programs.inf,IEAKInstall.HKLM,1
              5⤵
              • System Binary Proxy Execution: Rundll32
              • System Location Discovery: System Language Discovery
              PID:2248
            • C:\Windows\system32\rundll32.exe
              SysNative\rundll32.exe ieadvpack.dll,LaunchINFSection C:\Program Files (x86)\Internet Explorer\SIGNUP\programs.inf,IEAKInstall.HKLM,1
              5⤵
              • System Binary Proxy Execution: Rundll32
              PID:3972
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3512
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3308
      • C:\Windows\system32\rundll32.exe
        RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs
        1⤵
          PID:3392
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa3a26055 /state1:0x41c64e6d
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:3980

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Installer Packages

              1
              T1546.016

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Installer Packages

              1
              T1546.016

              Defense Evasion

              Modify Registry

              3
              T1112

              System Binary Proxy Execution

              2
              T1218

              Msiexec

              1
              T1218.007

              Rundll32

              1
              T1218.011

              Credential Access

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              2
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e588941.rbs
              • Path C:\Config.Msi\e588941.rbs
              • Size 465KB
              • SHA256 433a51eea47b8d8bec3cf2ade8204d9819af6e245634f5cca889d16c2c82e8ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BRANDING.CAB
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BRANDING.CAB
              • Size 57KB
              • SHA256 4a3cc89f8c424a1f0386e4f3173a36c16be2088c0a02672b203a0a14a1f99a30
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IE-REDIST.EXE
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IE-REDIST.EXE
              • Size 256KB
              • SHA256 f2fd39a4a426cbb94d50811ab803583a4beda78f44ba1bb6f8c3935817d7a729
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IE-Setup.cmd
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IE-Setup.cmd
              • Size 38B
              • SHA256 52f1d4c52887bceb10a0413c8c341ce00e543c298dbc774d2c828192c65aaf41
              • MD5 SHA1 SHA512
              Submit Download

              IEDKCS32.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IEDKCS32.DLL
              • Size 257KB
              • SHA256 ab47a9012bb87ae26b164dc42832597439e2cd47b5d5ebb037abc7ba3a192909
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IESetup.CIF
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IESetup.CIF
              • Size 2KB
              • SHA256 55ccd442595a728e58bfecc38cb5834f0d668943fcf2136cdcec58fd33948683
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ieakcust.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ieakcust.dll
              • Size 35KB
              • SHA256 4a829cd69e1a2ace255fd2706d6d07fecb70bb0f1efde6e4b618785607f46db8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              iesetup.ini
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iesetup.ini
              • Size 34B
              • SHA256 8e300bb19cba6df5c43c83591dcaa9f8b01b2c3e20414935f78eef1de5792854
              • MD5 SHA1 SHA512
              Submit Download

              MSI8BE1.tmp
              • Path C:\Windows\Installer\MSI8BE1.tmp
              • Size 459KB
              • SHA256 f9677cdd5a0ac53a5787c408bbd4467f515b9e588c6e205ca938e4884132af6f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INSTALL.INS
              • Path C:\Windows\msdownld.tmp\AS58DA54.tmp\INSTALL.INS
              • Size 2KB
              • SHA256 b23a7d540971198a5ecabffe4552ab431e65fbbf20ffafadaf5b519f656d134e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Screenshot-2026-07-29-191220.ico
              • Path C:\Windows\msdownld.tmp\AS58DA54.tmp\Screenshot-2026-07-29-191220.ico
              • Size 120KB
              • SHA256 37efe7a1f9ceaa3f2af54f08f62a1a1ab71db85286ecf5804792cd37a91a436e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              programs.inf
              • Path C:\Windows\msdownld.tmp\AS58DA54.tmp\programs.inf
              • Size 907B
              • SHA256 54ab78fd3bf2cf1018605f286290ed435fefc18204e792d318ed49fdc10acabf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata-2
              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 24.0MB
              • SHA256 f4d64538a0b3cfcda3c0451ea579839daa4641492c5448ac1de02dfeac9b4a19
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {b6104c41-0caa-4ae9-a868-5dade6d46ac2}_OnDiskSnapshotProp
              • Path \??\Volume{d141e0cd-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b6104c41-0caa-4ae9-a868-5dade6d46ac2}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 0a453d505ce684765c5784f5989ac3fe1e2f78e7341073efc37509632638a7b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download