Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_mal003.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_mal003.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target install_mal003.msi
- Size 5.8MB
- Sample260731-dcd8sshr91
- SHA256 3f5505b96fa425c75da8c193a7af091896f7d85e911e4bb2ddc5d7b7b118f4c4
- MD5 31ce0beac0336dcf69c88fe79fc1b001
- SHA1 4c303325a86322bb1c45ea12dcd6e74482e007dd
- SHA512 584e1d6b4649b9686dace662714e8d1371a2bf359f631b74a75553d1d6ae41217584529cf137e8dbfa215a419f8c32120c634e373b6fa241e75abf6011c9fdb7
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRz:3yOPsdq1N9vE1bPEiGut9HzgcPGY32K9
- TLSH T192563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\QQs81k = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 568 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 1800 7S79uP.exe - Loads dropped DLL 2 IoCs
pid Process 2872 MsiExec.exe 1800 7S79uP.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\QQs81k\\7S79uP.exe\"" 7S79uP.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 2872 MsiExec.exe 13 2872 MsiExec.exe 15 2872 MsiExec.exe 16 2872 MsiExec.exe 17 2872 MsiExec.exe 21 2872 MsiExec.exe 22 2872 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 5344 cmd.exe 5100 cmd.exe 6004 cmd.exe 4524 cmd.exe 4088 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 7S79uP.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF2E4470FA5FCEF291.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI1582.tmp msiexec.exe File created C:\Windows\Installer\e590df2.msi msiexec.exe File created C:\Windows\SystemTemp\~DF77BC66142B5C01EB.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF36828751605F4A7D.TMP msiexec.exe File created C:\Windows\Installer\e590df0.msi msiexec.exe File opened for modification C:\Windows\Installer\e590df0.msi msiexec.exe File created C:\Windows\SystemTemp\~DF82A9875223E2C4B5.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{4CA0D086-AA26-797D-3C5F-028810CDD1E6} msiexec.exe File opened for modification C:\Windows\Installer\MSI16DB.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 800 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2600 cmd.exe 5788 cmd.exe 2724 cmd.exe 5700 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\680D0AC462AAD797C3F5208801DC1D6E\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\PackageName = "install_mal003.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EE0DD599FAE22DB2585D0B62A28731E0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EE0DD599FAE22DB2585D0B62A28731E0\680D0AC462AAD797C3F5208801DC1D6E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\680D0AC462AAD797C3F5208801DC1D6E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\PackageCode = "98FF6061FB16E5349B09B4760EA3AEF9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\ProductName = "ENCPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Version = "84017285" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Media msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5376 schtasks.exe 708 schtasks.exe 4496 schtasks.exe 2104 schtasks.exe 6036 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 msiexec.exe 2280 msiexec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe 1800 7S79uP.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 800 msiexec.exe Token: SeIncreaseQuotaPrivilege 800 msiexec.exe Token: SeSecurityPrivilege 2280 msiexec.exe Token: SeCreateTokenPrivilege 800 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 800 msiexec.exe Token: SeLockMemoryPrivilege 800 msiexec.exe Token: SeIncreaseQuotaPrivilege 800 msiexec.exe Token: SeMachineAccountPrivilege 800 msiexec.exe Token: SeTcbPrivilege 800 msiexec.exe Token: SeSecurityPrivilege 800 msiexec.exe Token: SeTakeOwnershipPrivilege 800 msiexec.exe Token: SeLoadDriverPrivilege 800 msiexec.exe Token: SeSystemProfilePrivilege 800 msiexec.exe Token: SeSystemtimePrivilege 800 msiexec.exe Token: SeProfSingleProcessPrivilege 800 msiexec.exe Token: SeIncBasePriorityPrivilege 800 msiexec.exe Token: SeCreatePagefilePrivilege 800 msiexec.exe Token: SeCreatePermanentPrivilege 800 msiexec.exe Token: SeBackupPrivilege 800 msiexec.exe Token: SeRestorePrivilege 800 msiexec.exe Token: SeShutdownPrivilege 800 msiexec.exe Token: SeDebugPrivilege 800 msiexec.exe Token: SeAuditPrivilege 800 msiexec.exe Token: SeSystemEnvironmentPrivilege 800 msiexec.exe Token: SeChangeNotifyPrivilege 800 msiexec.exe Token: SeRemoteShutdownPrivilege 800 msiexec.exe Token: SeUndockPrivilege 800 msiexec.exe Token: SeSyncAgentPrivilege 800 msiexec.exe Token: SeEnableDelegationPrivilege 800 msiexec.exe Token: SeManageVolumePrivilege 800 msiexec.exe Token: SeImpersonatePrivilege 800 msiexec.exe Token: SeCreateGlobalPrivilege 800 msiexec.exe Token: SeBackupPrivilege 5760 vssvc.exe Token: SeRestorePrivilege 5760 vssvc.exe Token: SeAuditPrivilege 5760 vssvc.exe Token: SeBackupPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeBackupPrivilege 4008 srtasks.exe Token: SeRestorePrivilege 4008 srtasks.exe Token: SeSecurityPrivilege 4008 srtasks.exe Token: SeTakeOwnershipPrivilege 4008 srtasks.exe Token: SeBackupPrivilege 4008 srtasks.exe Token: SeRestorePrivilege 4008 srtasks.exe Token: SeSecurityPrivilege 4008 srtasks.exe Token: SeTakeOwnershipPrivilege 4008 srtasks.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 800 msiexec.exe 800 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 800 msiexec.exe 2280 msiexec.exe 2872 MsiExec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2280 wrote to memory of 4008 2280 msiexec.exe 94 PID 2280 wrote to memory of 2872 2280 msiexec.exe 96 PID 1800 wrote to memory of 568 1800 7S79uP.exe 99 PID 1800 wrote to memory of 4524 1800 7S79uP.exe 101 PID 4524 wrote to memory of 708 4524 cmd.exe 103 PID 4524 wrote to memory of 4156 4524 cmd.exe 106 PID 1800 wrote to memory of 4088 1800 7S79uP.exe 108 PID 1800 wrote to memory of 5344 1800 7S79uP.exe 112 PID 4524 wrote to memory of 3664 4524 cmd.exe 113 PID 4088 wrote to memory of 4496 4088 cmd.exe 115 PID 5344 wrote to memory of 2104 5344 cmd.exe 116 PID 4088 wrote to memory of 5340 4088 cmd.exe 117 PID 5344 wrote to memory of 4592 5344 cmd.exe 119 PID 4088 wrote to memory of 5048 4088 cmd.exe 120 PID 5344 wrote to memory of 1672 5344 cmd.exe 121 PID 1800 wrote to memory of 5100 1800 7S79uP.exe 122 PID 5100 wrote to memory of 6036 5100 cmd.exe 124 PID 5100 wrote to memory of 404 5100 cmd.exe 125 PID 5100 wrote to memory of 4200 5100 cmd.exe 127 PID 5700 wrote to memory of 4672 5700 cmd.exe 130 PID 5788 wrote to memory of 3792 5788 cmd.exe 131 PID 1800 wrote to memory of 6004 1800 7S79uP.exe 133 PID 6004 wrote to memory of 5376 6004 cmd.exe 135 PID 6004 wrote to memory of 2260 6004 cmd.exe 136 PID 2600 wrote to memory of 5628 2600 cmd.exe 132 PID 6004 wrote to memory of 1908 6004 cmd.exe 138 PID 2724 wrote to memory of 3732 2724 cmd.exe 141 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_mal003.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:800
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F45A06DE51B4DB7EB2AE57B126DBEA11 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5760
-
C:\Users\Public\QQs81k\7S79uP.exe"C:\Users\Public\QQs81k\7S79uP.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:568
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QQs81k\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QQs81k\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:708
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4156
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4496
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5340
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2104
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4592
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6036
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:404
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4200
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5376
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2260
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1908
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QQs81k" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QQs81k" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4672
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:5380
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5628
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3792
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3732
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e590df1.rbs
- Size 7KB
- SHA256 32489367abda1cf51b80a1c15c5819a61856acb047001fce96f497aef449f664
- MD5 6e2caa64fb324f956ee5935c2eb97e2e
- SHA1 d068aa0e1d0a0eeceafea5dcdbba9203299d7edc
- SHA512 b28b9a66a91a597a73dfa123dd7571a42fc59d6ffd657588e2884e140680d6e17068695aeeb5138905c25719b2a7e14b37347123154344d1cbabc617d2cd7c2e
- SSDEEP 96:Gnhgu0CbXSUUwnrD1CsThqFUwnrD1C6je1Hp/ThqlHm25yeWl0lnCKpljeHbAjBz:GnaCmz4rDIIz4rDIxjal4KpI4
- TLSH T154F1100666044BF3F8E66B35CB07176637E2D2E5929433DB1CCD80201FC77982E6868E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\QQs81k\7S79uP.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\QQs81k\UxEnhance64.dll
- Size 3.1MB
- SHA256 d61d28308b3d787d874faa0f3257be0eb260a6499f6a5df87b46f71d79a584d8
- MD5 ac698aa69c36b5f23e6530d90e3fee43
- SHA1 89949ddede08a294a866e19dba8eeb48e03d61d9
- SHA512 efd879d7801c134d9ed9ef43d20ed80c02a731982752967b2377f2551f0b8d6612f963b56ba5aeab766d20b3a254d810c1f37ee0de4ea4811ad45a7b58a7298b
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+y:P9m29xx3Tiqt06ox6+z2rNNrKoy
- TLSH T189E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\QQs81k\adoresd.dat
- Size 4.8MB
- SHA256 358805af9a0f032b24218fb4166b129d73f3a75cfdb783d7affcb7eb1bf8da02
- MD5 a158318a7a027f60a69a790c54c641bc
- SHA1 033cad7c09a81ef2bf730e538fcad08c46971ca7
- SHA512 b3c8c45db119965d45bb2e84b5ceeb02a23ccaa62d807d7389cc1f34e6b01cbdaa4bf4cbc13a39d2f8e982dac2dfe6a5c166f307a4a0aab11f12f47aa740cfc6
- SSDEEP 98304:duZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:WQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1AB363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\QQs81k\msadox.tb
- Size 8KB
- SHA256 c62b931ec0f714604d2370642c9f7092fb6ab49568a4f5d0f3ffcb49adfd15ec
- MD5 18e6555e8ad5d09bbc787db738fedba6
- SHA1 50d37305ed0fb52c87d1f67cff7173c636238b5e
- SHA512 e40afecc03b310763b0fa8851978982a4fa7921877ceb65ce2eaf121ed95d99b823820d84917456f463233bdc85e5aa608713e21ed76afb98556e9552e3decf4
- SSDEEP 192:PqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:PsZqZOXQ3uqvR2Kfzp
- TLSH T1AC029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI16DB.tmp
- Size 5.8MB
- SHA256 d4f0a7d05fd811fd2c9eeadb14696a445dc7b0735471390333aa464420f8f2b6
- MD5 8524ea3b8aca87d8db13ff2198e720fb
- SHA1 7fd63d851d9dd8982a4ba7d7ada736f24732fe61
- SHA512 5799efb6ce524ffec37ac5f55ccdebbc49a9d17c26eee89085a1c12f48d950026f4de87f887c14369d5d51d50db742fc56b9ca5ba0c2a46252053f4e6118e8f0
- SSDEEP 98304:kAnifxFCNdq4yN9vE1bVdEpUGoPHN9HGlZCCwCJtXG4X32KvqiHRB:kyOPsdq1N9vE1bPEiGut9HqgcPGY32K3
- TLSH T13E5633D1AA8A2A78D077D7F446976A3E701E3BD24E634C0DBAFA2F1D5D332156839301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e590df0.msi
- Size 5.8MB
- SHA256 3f5505b96fa425c75da8c193a7af091896f7d85e911e4bb2ddc5d7b7b118f4c4
- MD5 31ce0beac0336dcf69c88fe79fc1b001
- SHA1 4c303325a86322bb1c45ea12dcd6e74482e007dd
- SHA512 584e1d6b4649b9686dace662714e8d1371a2bf359f631b74a75553d1d6ae41217584529cf137e8dbfa215a419f8c32120c634e373b6fa241e75abf6011c9fdb7
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRz:3yOPsdq1N9vE1bPEiGut9HzgcPGY32K9
- TLSH T192563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 616309917371ae90af3ddac3e38c9600a000f2ed0f039a55119d5ec98c0963f9
- MD5 9cd804b9121f5ed9b2ea270ea9332860
- SHA1 a4d44678661eb40f6963900dcbb79d1087903787
- SHA512 7bfbb79ecfc20d62ae51a204af4e7d797692b6bbd5ab0cacfa2fdf8ddd9dd16363b5659234f428dcf139c0fe011725791d85978414a4d87f2158dfb503e4bf3f
- SSDEEP 24576:qFo3DMPcdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:jHI
- TLSH T1E557B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{61d50b6b-9161-49da-9112-6a036ab4a6fc}_OnDiskSnapshotProp
- Size 6KB
- SHA256 3351d9064616ef8a65897d10de3e204dc0b1e658d658941980650c2559ab38fb
- MD5 d1d57dc868b95f2f3ab76cd47debeeee
- SHA1 90a5e8e00c3a4b40b4fa8131cd0769f8c098275d
- SHA512 6fe2df0f07670259416fd9d099ea5fbde4579ec4ce93b643955c709b42754431a8b0c8f0af22d65f03a1fe4ee08e19d9af4f22a17485261c79883c79879babbc
- SSDEEP 96:FRIXb+vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:nIWb++uVm
- TLSH T14ED188084AE54711E2B3AB312CF18557A837B911EF33CB8E0198238E6631A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH