Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n002.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n002.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target Install_28n002.msi
- Size 5.7MB
- Sample260730-cnn2psxdqd
- SHA256 e227c9aee2506c1f142b0a97187e4db05b0e8296c7a06a029b8de936125afd70
- MD5 540e13d3493ec5af49b7576ec23670e0
- SHA1 0d8f370f73ee9d02387491996ea3a8b547138bed
- SHA512 c71d8bb0b723d60a314058bc197fa7f9fea0c85c1a8bed113fdd8b4dc905b5050342c9a162f033ff88d4575ba7be85c2ab00ff12c415b921feb144030a2313e4
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlS:8dCis4BEoZJLm4Kv8w+Gzerc
- TLSH T11E5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1144 qWdrnv.exe - Loads dropped DLL 2 IoCs
pid Process 932 MsiExec.exe 1144 qWdrnv.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 932 MsiExec.exe 3 932 MsiExec.exe 4 932 MsiExec.exe 9 932 MsiExec.exe 10 932 MsiExec.exe 11 932 MsiExec.exe 12 932 MsiExec.exe 13 932 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFAD87184BCD4DD9E2.TMP msiexec.exe File created C:\Windows\Installer\e59f5c2.msi msiexec.exe File created C:\Windows\SystemTemp\~DFB95151DAFB6E27FA.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD9E1CFC2C304FB7B.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59f5c0.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSIF999.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFA36.tmp msiexec.exe File created C:\Windows\Installer\e59f5c0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF6B839FF7EE83718F.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3496 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n002.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "DDBDB3AAAA3DFAD46BC0B0DC3E8339EA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 5976 msiexec.exe 5976 msiexec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 932 MsiExec.exe 1144 qWdrnv.exe 1144 qWdrnv.exe 1144 qWdrnv.exe 1144 qWdrnv.exe 1144 qWdrnv.exe 1144 qWdrnv.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3496 msiexec.exe Token: SeIncreaseQuotaPrivilege 3496 msiexec.exe Token: SeSecurityPrivilege 5976 msiexec.exe Token: SeCreateTokenPrivilege 3496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3496 msiexec.exe Token: SeLockMemoryPrivilege 3496 msiexec.exe Token: SeIncreaseQuotaPrivilege 3496 msiexec.exe Token: SeMachineAccountPrivilege 3496 msiexec.exe Token: SeTcbPrivilege 3496 msiexec.exe Token: SeSecurityPrivilege 3496 msiexec.exe Token: SeTakeOwnershipPrivilege 3496 msiexec.exe Token: SeLoadDriverPrivilege 3496 msiexec.exe Token: SeSystemProfilePrivilege 3496 msiexec.exe Token: SeSystemtimePrivilege 3496 msiexec.exe Token: SeProfSingleProcessPrivilege 3496 msiexec.exe Token: SeIncBasePriorityPrivilege 3496 msiexec.exe Token: SeCreatePagefilePrivilege 3496 msiexec.exe Token: SeCreatePermanentPrivilege 3496 msiexec.exe Token: SeBackupPrivilege 3496 msiexec.exe Token: SeRestorePrivilege 3496 msiexec.exe Token: SeShutdownPrivilege 3496 msiexec.exe Token: SeDebugPrivilege 3496 msiexec.exe Token: SeAuditPrivilege 3496 msiexec.exe Token: SeSystemEnvironmentPrivilege 3496 msiexec.exe Token: SeChangeNotifyPrivilege 3496 msiexec.exe Token: SeRemoteShutdownPrivilege 3496 msiexec.exe Token: SeUndockPrivilege 3496 msiexec.exe Token: SeSyncAgentPrivilege 3496 msiexec.exe Token: SeEnableDelegationPrivilege 3496 msiexec.exe Token: SeManageVolumePrivilege 3496 msiexec.exe Token: SeImpersonatePrivilege 3496 msiexec.exe Token: SeCreateGlobalPrivilege 3496 msiexec.exe Token: SeBackupPrivilege 4948 vssvc.exe Token: SeRestorePrivilege 4948 vssvc.exe Token: SeAuditPrivilege 4948 vssvc.exe Token: SeBackupPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeBackupPrivilege 1076 srtasks.exe Token: SeRestorePrivilege 1076 srtasks.exe Token: SeSecurityPrivilege 1076 srtasks.exe Token: SeTakeOwnershipPrivilege 1076 srtasks.exe Token: SeBackupPrivilege 1076 srtasks.exe Token: SeRestorePrivilege 1076 srtasks.exe Token: SeSecurityPrivilege 1076 srtasks.exe Token: SeTakeOwnershipPrivilege 1076 srtasks.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe Token: SeTakeOwnershipPrivilege 5976 msiexec.exe Token: SeRestorePrivilege 5976 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3496 msiexec.exe 3496 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3496 msiexec.exe 5976 msiexec.exe 932 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5976 wrote to memory of 1076 5976 msiexec.exe 94 PID 5976 wrote to memory of 932 5976 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n002.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3496
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 89258BE91AE855E97BED770ED0364351 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:932
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5736
-
C:\Users\Public\wiDojZ\qWdrnv.exe"C:\Users\Public\wiDojZ\qWdrnv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f5c1.rbs
- Size 7KB
- SHA256 af106714d3cc4677f4f70d418aecf14e4e6065b2ce799ed839d716e08ce9b169
- MD5 3d1ccce335e54d35c104cccef061f713
- SHA1 91c762df795cb82c5218d3cccde619a8ec4d15a0
- SHA512 d1995aae9783c758b80d5b041f789f1d5dc6447ed204cc153b648042fd85d23d6106af59b74a4dadf2637de0aa20b093b7bdcf3dc0f3b8804155d7cadffb13ec
- SSDEEP 96:mVBiGgu0CnYxUUpdD21CsThqK/UpdD21C6jdAsDThqKjHKIK5RPWELEyE/YwgpCS:mVoXCMzfD2IIBsfD2ISBaHtI5csKpB
- TLSH T1DEF1F046B20581E2F9977730CF271B263BB3D7E49314630B0ADE84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\wiDojZ\UxEnhance64.dll
- Size 3.1MB
- SHA256 6340886575e5dd65055330935ea00a87d909f97d951904a11cc4a8b7883062ad
- MD5 6688d52c5da486575a891912947f3d1e
- SHA1 34b6ea6ff4f929a8b975328f52ca2b5768fc3aff
- SHA512 d4bd51132c85e959d74edef027b76d10908257c029ac34ca72447c5c583bf605588265d3e9a7e1014194e00ec26ca504d1456eda8eb790451516decde635cbe4
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+0:P9m29xx3Tiqt06ox6+z2rNNrKo0
- TLSH T1EDE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\wiDojZ\adoresd.dat
- Size 4.8MB
- SHA256 7b1a10829e4f4e8575e734e169cd43ba096e2d01e2b236e1107a3ea597bee3aa
- MD5 8be20b31d112ac39a271456b3dfc0598
- SHA1 1f67a4541820745cce4c37b159410405da880bd6
- SHA512 bd1d18246dbebde7fc655f8a4ec584a8c1704a029aa88e7cb665c3c5a53125844b9d6edfb89c68e07c19df01f250b4f89f0518f59d19e0ebec2c5d82ab9e24ed
- SSDEEP 98304:RuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:CQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T166363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\wiDojZ\msadox.tb
- Size 8KB
- SHA256 3051e257cf338394fe335cdf3466b468d2a2de0a1835394768715a17de4d27fa
- MD5 30714ae57408ce0f1c90be41e53f351f
- SHA1 2e171a5dcb9d307c9f8a421fd5e5751ca04190c4
- SHA512 85f2d645401068e4287ab63b0a856be7bb667fd9ab5bcac336e9876600400b2e4f37aba807d0c8552af1de008ed2704a12f260b41565a7fa14f72c15154f7258
- SSDEEP 192:hqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:hsZqZOXQ3uqvR2Kfzp
- TLSH T1BF029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\wiDojZ\qWdrnv.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIFA36.tmp
- Size 5.7MB
- SHA256 f2f0cc6f7b1e3334ca03256781a86ab7c7c728a28de49714dde0e915fa4eb146
- MD5 528e32e0083a77b685012405a91c6492
- SHA1 beb6b6d191c2772b2e10dc17e4ab2416b6810858
- SHA512 8195a58ee3cb5b2d33bff4694aefb266551e45a17acad33ab84133cb5f2b43c854f5fa3791b340b813ff61757d68df07b652857d502d1a726a8eee2a889b891b
- SSDEEP 98304:w6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVLS6dYXzIrrrHlG:TdCis4BEoZJLm4Kv8wWGzerI
- TLSH T14A5633D139C66F70D1A3CBF4665A391D3CAE3BD5B9728C0A67D43A00AE73615DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59f5c0.msi
- Size 5.7MB
- SHA256 e227c9aee2506c1f142b0a97187e4db05b0e8296c7a06a029b8de936125afd70
- MD5 540e13d3493ec5af49b7576ec23670e0
- SHA1 0d8f370f73ee9d02387491996ea3a8b547138bed
- SHA512 c71d8bb0b723d60a314058bc197fa7f9fea0c85c1a8bed113fdd8b4dc905b5050342c9a162f033ff88d4575ba7be85c2ab00ff12c415b921feb144030a2313e4
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlS:8dCis4BEoZJLm4Kv8w+Gzerc
- TLSH T11E5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ff967a9730b10279e2a41d5bdbfb0f1db316dac28a7e46be9ac9995911ae8a18
- MD5 46d28772a18a7ff3d90add5b07875812
- SHA1 9da39001fe9edc133b1558cb2508f803db3ca26a
- SHA512 4b242a863ee60d05464d773b070e82916e6f5ff8bacbe9feb13bd4311f2a5d65bddb387bde59870ff67c4891fcba669a7a5bc35c0f7c8ee00224dd3358843d81
- SSDEEP 24576:FFo3DMP4doO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+c:4HY
- TLSH T1E257F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6a284163-1c53-49ad-9428-928c38e05462}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f39d9764a9bddc2082c17d31516ac6def6739d4376ffbed44106545b962790b3
- MD5 0ab47c54c2b821abf9081df9a90d66c9
- SHA1 ec37cf825cd4cbc6c7821d738b511eb572dc79be
- SHA512 fe0d01f6b3df53b850f3028e6f9a82541eb1248ef9111249b19e417f2deb381a3fa2d1bf5e938a11b0ed1a3dfbd9db6e72809f62e37fd85efa023f8504cd81e4
- SSDEEP 96:FWr2E7bvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:wHb++uVm
- TLSH T10DD187184AF54711E2B3AB312DF18557A837B811EF33CB8E0198238E6631A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH