Overview

overview

7

Static

static

3

CSISysFile...ll.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    122s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CSISysFilesInstall.exe
  • Size 33.3MB
  • Sample260730-sraw9ack31
  • SHA256 af53c0d0919c4b1ca010ba5865edb74a5150929220358463e32895197a582e5e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Windows directory 35 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\CSISysFilesInstall.exe
    "C:\Users\Admin\AppData\Local\Temp\CSISysFilesInstall.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{61D64ADD-2C5B-4B10-B5EF-09A2A9278F13}\CSI SYSTEM FILES.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2448
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2748
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A6524F9C9BD3D430335586AED669E8A5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1588
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4C9B01F43E85A82E9553AA7A2CE1C604 M Global\MSI0000
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4184
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1628

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a087e.rbs
        • Path C:\Config.Msi\e5a087e.rbs
        • Size 636KB
        • SHA256 4e0bae3e4d8afc31b60336a2c7214cd1ba820f098f453633fd6f72cce9f19045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0x0409.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{61D64ADD-2C5B-4B10-B5EF-09A2A9278F13}\0x0409.ini
        • Size 6KB
        • SHA256 2a5eb805543b141d77ce7192c5f7e4e10ffb56de0a5a66905c79298dfc5ffbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CSI SYSTEM FILES.msi
        • Path C:\Users\Admin\AppData\Local\Temp\{61D64ADD-2C5B-4B10-B5EF-09A2A9278F13}\CSI SYSTEM FILES.msi
        • Size 33.0MB
        • SHA256 13128dead67da048714f6a32c0c3a402616f5357bd7dc183c970a6f3e1a4c1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{61D64ADD-2C5B-4B10-B5EF-09A2A9278F13}\Setup.INI
        • Size 2KB
        • SHA256 827c1bd3f6a9d43b5bb4ac089c071ce0fb833f08feafac183903e45bd40c7f98
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{61D64ADD-2C5B-4B10-B5EF-09A2A9278F13}\_ISMSIDEL.INI
        • Size 221B
        • SHA256 38a88e4a68c217a2f92020eb3352e6503ec2de69c2398c9ee7cba0d6b4b36134
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{61D64ADD-2C5B-4B10-B5EF-09A2A9278F13}\_ISMSIDEL.INI
        • Size 11B
        • SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
        • MD5 SHA1 SHA512
        Submit Download

        MSI18AB.tmp
        • Path C:\Windows\Installer\MSI18AB.tmp
        • Size 28KB
        • SHA256 00972e810316ed4bb96003f9b0796d2d475ab3d0fdb96b2e57fce124ce382847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 26.1MB
        • SHA256 ed925ef69ddff29346f5c9aa134ffbe9dd54e27d8fe20e07f1dd2dd3da795ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {fc7c37b7-abc4-4665-847b-681faff99b75}_OnDiskSnapshotProp
        • Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{fc7c37b7-abc4-4665-847b-681faff99b75}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 f9d38362c736ed56743cfcfecb6268986daa4a8d5e99ee367204bd5b5ecf72f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download