46c58a119174ffbed8087265c1811ba0d637f36de754dbf13b4e53ff51679cf2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_30v8005.msi
Size 7.7MB
Sample260730-hebb5sel5x
SHA256 46c58a119174ffbed8087265c1811ba0d637f36de754dbf13b4e53ff51679cf2
MD5 8d3fbde3f579345cca440da88d6549ef
SHA1 1e8d0f0d4ed755b2060e5902ba67e924cad8f2fe
SHA512 30d189a0c679ca8c141dd69e610db98fb68bdfc24a8bae3cb10daacb8d20de91d8169b429def89b59fbd222ba537f199920ec68c358d66240b7124cbacc9d401
SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2Gv:ZBajlEeW2nRo+Q
TLSH
T15A8633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4348	gvRH9j.exe

Loads dropped DLL 2 IoCs

pid	Process
2764	MsiExec.exe
4348	gvRH9j.exe

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	2764	MsiExec.exe
20	2764	MsiExec.exe
36	2764	MsiExec.exe
37	2764	MsiExec.exe
44	2764	MsiExec.exe
49	2764	MsiExec.exe
51	2764	MsiExec.exe
52	2764	MsiExec.exe
55	2764	MsiExec.exe
56	2764	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
372	cmd.exe
648	cmd.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	gvRH9j.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e589f29.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA042.tmp	msiexec.exe
File created	C:\Windows\Installer\e589f2b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589f29.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0C0.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4072	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4968	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "install_30v8005.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "5BE3044B6EF7DF748AC342BB94082667"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2992	schtasks.exe
2308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4816	msiexec.exe
4816	msiexec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe
4348	gvRH9j.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4072	msiexec.exe
Token: SeSecurityPrivilege	4816	msiexec.exe
Token: SeCreateTokenPrivilege	4072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4072	msiexec.exe
Token: SeLockMemoryPrivilege	4072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4072	msiexec.exe
Token: SeMachineAccountPrivilege	4072	msiexec.exe
Token: SeTcbPrivilege	4072	msiexec.exe
Token: SeSecurityPrivilege	4072	msiexec.exe
Token: SeTakeOwnershipPrivilege	4072	msiexec.exe
Token: SeLoadDriverPrivilege	4072	msiexec.exe
Token: SeSystemProfilePrivilege	4072	msiexec.exe
Token: SeSystemtimePrivilege	4072	msiexec.exe
Token: SeProfSingleProcessPrivilege	4072	msiexec.exe
Token: SeIncBasePriorityPrivilege	4072	msiexec.exe
Token: SeCreatePagefilePrivilege	4072	msiexec.exe
Token: SeCreatePermanentPrivilege	4072	msiexec.exe
Token: SeBackupPrivilege	4072	msiexec.exe
Token: SeRestorePrivilege	4072	msiexec.exe
Token: SeShutdownPrivilege	4072	msiexec.exe
Token: SeDebugPrivilege	4072	msiexec.exe
Token: SeAuditPrivilege	4072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4072	msiexec.exe
Token: SeChangeNotifyPrivilege	4072	msiexec.exe
Token: SeRemoteShutdownPrivilege	4072	msiexec.exe
Token: SeUndockPrivilege	4072	msiexec.exe
Token: SeSyncAgentPrivilege	4072	msiexec.exe
Token: SeEnableDelegationPrivilege	4072	msiexec.exe
Token: SeManageVolumePrivilege	4072	msiexec.exe
Token: SeImpersonatePrivilege	4072	msiexec.exe
Token: SeCreateGlobalPrivilege	4072	msiexec.exe
Token: SeBackupPrivilege	2688	vssvc.exe
Token: SeRestorePrivilege	2688	vssvc.exe
Token: SeAuditPrivilege	2688	vssvc.exe
Token: SeBackupPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeBackupPrivilege	2052	srtasks.exe
Token: SeRestorePrivilege	2052	srtasks.exe
Token: SeSecurityPrivilege	2052	srtasks.exe
Token: SeTakeOwnershipPrivilege	2052	srtasks.exe
Token: SeBackupPrivilege	2052	srtasks.exe
Token: SeRestorePrivilege	2052	srtasks.exe
Token: SeSecurityPrivilege	2052	srtasks.exe
Token: SeTakeOwnershipPrivilege	2052	srtasks.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4072	msiexec.exe
4072	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2052	4816	msiexec.exe	94
PID 4816 wrote to memory of 2764	4816	msiexec.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_30v8005.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5FB500F80E1898C5CB9AFCDFE071C460 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Users\Public\F5bHeU\gvRH9j.exe
C:\Users\Public\F5bHeU\gvRH9j.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\F5bHeU\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\F5bHeU\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2308

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\F5bHeU" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4968
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\F5bHeU" /t REG_DWORD /d 0 /f
  2⤵
  PID:3092

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589f2a.rbs

Path C:\Config.Msi\e589f2a.rbs
Size 7KB
SHA256 bb68eb917b89fd9744bbc910b4d5b114ddd862aaa3100ad5d2c6b2161ee4c377
MD5 bab1bb4e7c71a524de81df0f86ecbf35
SHA1 e8a513f4fe9c6faea44da77ff1730353345b1a56
SHA512 662ffe594a96c7d811f156b6b0f7c5e2aff4a3210a84823b2cbbfbaca6cf9b4d60f3c21f6fa2c3caab996b6640be17287a374991da78128a29a7bc4199038270
SSDEEP 96:PVj4uu1e6IxUUpdo21CsThqK/Updo21C6jdAsDThqKjHYIK5RPWELEyE/YwDfCKk:PVj4e5zfo2IIBsfo2ISBIHtI53qKpi
TLSH
T122F11F56B20481E2F9977730CF271B263BB3D3E49314630B0ADD84748E4738DAEA619E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\F5bHeU\UxEnhance64.dll
Size 3.1MB
SHA256 4aba610fd035e48fcc237a65684695e03ee2d83c20748c91d19bf46b1a635186
MD5 d8846a4a0e160d782e81d4411dc43ef4
SHA1 92831c8323ec1c9ce98cc3e3ed73ebb1b7bd1d61
SHA512 24fa0376ba4ad8c90c7bcdce259e059da0fc4f51ca61cf4f3b9f2b1aaaf886d41e6de7f7387c88a0c9fbe75a092a287d2daa615a5e8a598966e26cd9745d487a
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+r:P9m29xx3Tiqt06ox6+z2rNNrKor
TLSH
T1FFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\F5bHeU\adoresd.dat
Size 4.8MB
SHA256 1bc4511074a0b24c903a77f9fb924237b91511c3b4297d13e93f45de9ae22587
MD5 8331c7b6e7cae4cd54fd0d676ac99a5c
SHA1 d0b2f1662b99b1f2b8fe5b3e2a49a8f649fb41a3
SHA512 a820ce6f9911859350cdcd6399d8523784b060f70b308ba4905c39fd1ee83d08bfb86de688d9c28477cd6447a41164737b920094d6bc0bb0a69431519e172b46
SSDEEP 98304:puZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:6QDPnORb7AdPEm7Y7ltlVgxs
TLSH
T1A1363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gvRH9j.exe

Path C:\Users\Public\F5bHeU\gvRH9j.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\F5bHeU\msadox.tb
Size 8KB
SHA256 56ac43503ba775118897fe6218ecff3a7bc83516dfcd95ee5afb369abf5a3dfb
MD5 cafb1cfc1d25b3511a7a4d345dd37e22
SHA1 b0cbd1e83449a9190efa79883288dbc623946348
SHA512 453e64981dce717ea071c28a106c28c74eede09703669d659efaa5239148c33742b9e7c8e7a033239d9164bd17ccaa0a3a576bb6870b1a46fa7c48f9169427d9
SSDEEP 192:gqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:gsZqZOXQ3uqvR2Kfzp
TLSH
T151029E05D7A20CC3E6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA0C0.tmp

Path C:\Windows\Installer\MSIA0C0.tmp
Size 7.7MB
SHA256 548be4f8ddff78dd8f6cc3efedf375adafc431a7ba27e47ce6f03a7e77e61bd1
MD5 c2875c6c9071acbf11d75080a7b5fae7
SHA1 e506088be962eb6e0f06b47402daad8546e00ce7
SHA512 f5f13fe195af60fcfcf508867f5f0c85decd3ab16d02a2556c87124e8a729111a1df5ae24511ea9196f07d289a758378998a486bb1dc1bffa0cd23a4f4f46c9a
SSDEEP 196608:tBN9uhdNnvrjJElzusmWE1lB7kwKCtjE+Fc2G4:tBajlEeWKnRo+1
TLSH
T14A8633D63D8F16B0C1A7CBB08245393CBD663BC1B6A64C12B37939151E2372A9E73758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589f29.msi

Path C:\Windows\Installer\e589f29.msi
Size 7.7MB
SHA256 46c58a119174ffbed8087265c1811ba0d637f36de754dbf13b4e53ff51679cf2
MD5 8d3fbde3f579345cca440da88d6549ef
SHA1 1e8d0f0d4ed755b2060e5902ba67e924cad8f2fe
SHA512 30d189a0c679ca8c141dd69e610db98fb68bdfc24a8bae3cb10daacb8d20de91d8169b429def89b59fbd222ba537f199920ec68c358d66240b7124cbacc9d401
SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2Gv:ZBajlEeW2nRo+Q
TLSH
T15A8633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c65957ba59bd66cbf88c44137d75a63418e18298df6adf40295edb523acf559d
MD5 3ed691bf931bd679511cf1f502625e5b
SHA1 fd10edd8f86a25b3eb2c32ae55dd51852d8382c4
SHA512 2698fac3f9df4f09047d983f9e9c1590d815190d98c771b6463487a5954283f046feea877cff3de0cbd75f3dc2f5254bed41988d1113a7bade1f6e6beba5875d
SSDEEP 24576:Tu8m+1zUdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:M
TLSH
T15247D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3fd0d1fc-f95f-4e89-ad9d-3de93c7b7ff4}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3fd0d1fc-f95f-4e89-ad9d-3de93c7b7ff4}_OnDiskSnapshotProp
Size 6KB
SHA256 d7bc1b8353761a89b3dca575726352e3594079c07a94743f64593cded792e450
MD5 89cae12f9e46b46a8c2dbb86917e7aa9
SHA1 646c3f516376582fd4a964ead95dde6bbce848dc
SHA512 8e68b4734b83d5ecbd886a2cfeb52be1df0bc1ee00edd369d89b78933f6a96c2aa91fe8783373240b15ecca67c264456bcb61ba729b15d9b5ac3a03540027056
SSDEEP 96:FukDEV8vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Hjb++ZVm
TLSH
T1A3D19B184AE54311E2F3AB7129F14557A477B911EF33CB8E0198238E6630A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2764-13-0x00007FFF443C0000-0x00007FFF44A19000-memory.dmp

Download

memory/2764-39-0x00007FFF53FA0000-0x00007FFF53FB0000-memory.dmp

Download

memory/2764-16-0x00007FFF53FA0000-0x00007FFF53FB0000-memory.dmp

Download

memory/2764-12-0x00007FFF62670000-0x00007FFF62672000-memory.dmp

Download

memory/4348-62-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-73-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-59-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-61-0x00007FFF62680000-0x00007FFF62682000-memory.dmp

Download

memory/4348-53-0x00007FFF62670000-0x00007FFF62672000-memory.dmp

Download

memory/4348-66-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-67-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-68-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-69-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-54-0x00007FFF42BC0000-0x00007FFF430DE000-memory.dmp

Download

memory/4348-81-0x0000021E20EF0000-0x0000021E20F7A000-memory.dmp

Download

memory/4348-82-0x0000021E20EF0000-0x0000021E20F7A000-memory.dmp

Download

memory/4348-80-0x0000021E20EF0000-0x0000021E20F7A000-memory.dmp

Download

memory/4348-79-0x0000021E20EF0000-0x0000021E20F7A000-memory.dmp

Download

memory/4348-78-0x0000021E20A50000-0x0000021E20A9E000-memory.dmp

Download

memory/4348-87-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download

memory/4348-88-0x0000021E20150000-0x0000021E20A0E000-memory.dmp

Download