Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 15:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_c0rd018.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_c0rd018.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target install_c0rd018.msi
- Size 6.2MB
- Sample260731-sqmvesce52
- SHA256 b4a3518b5685d343a9e995addb93da58d39616abce382ceaab5df7fd315b079f
- MD5 df7f49344cfa0d8d97298d89f63e6aa3
- SHA1 8a3ba6394c942101d879a2231bffb69fe84cd861
- SHA512 525e92346b7488de7c787579976a8c5cd006b2a2678c0cccd1699bb45a60a6fdf0e33a231f0c9b1d8afa5df20760c069c85302213e80a1f8659edea9f65ba9cf
- SSDEEP 196608:HJrMk1jQb8WotBWNaBVZnlZrdNzfXQBn0:HJrM7Cdnl/NzfAl0
- TLSH T18A5633D23CC52771D497C7B24086A62CB27A3FC5BE669C167BED36145E73B1228B2348
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\WQ7M1u = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation TGQKiR.exe - Executes dropped EXE 1 IoCs
pid Process 4808 TGQKiR.exe - Loads dropped DLL 2 IoCs
pid Process 1760 MsiExec.exe 4808 TGQKiR.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\WQ7M1u\\TGQKiR.exe\"" TGQKiR.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 18 1760 MsiExec.exe 20 1760 MsiExec.exe 36 1760 MsiExec.exe 37 1760 MsiExec.exe 38 1760 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 1976 cmd.exe 3640 cmd.exe 3740 cmd.exe 4228 cmd.exe 1864 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b TGQKiR.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{D9042978-6444-D40B-2C07-4A301453BD6D} msiexec.exe File opened for modification C:\Windows\Installer\MSI9DD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E4F.tmp msiexec.exe File created C:\Windows\Installer\e589ce9.msi msiexec.exe File created C:\Windows\Installer\e589ce7.msi msiexec.exe File opened for modification C:\Windows\Installer\e589ce7.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1864 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3624 cmd.exe 1768 cmd.exe 4760 cmd.exe 1892 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\ProductName = "CPUSD Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16\8792409D4446B04DC270A4034135DBD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\PackageName = "install_c0rd018.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\PackageCode = "DEFBD8EA67DB4A7438A4B83BBF410C08" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3464 schtasks.exe 4624 schtasks.exe 652 schtasks.exe 3140 schtasks.exe 3400 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 msiexec.exe 5028 msiexec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 1760 MsiExec.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe 4808 TGQKiR.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1864 msiexec.exe Token: SeIncreaseQuotaPrivilege 1864 msiexec.exe Token: SeSecurityPrivilege 5028 msiexec.exe Token: SeCreateTokenPrivilege 1864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1864 msiexec.exe Token: SeLockMemoryPrivilege 1864 msiexec.exe Token: SeIncreaseQuotaPrivilege 1864 msiexec.exe Token: SeMachineAccountPrivilege 1864 msiexec.exe Token: SeTcbPrivilege 1864 msiexec.exe Token: SeSecurityPrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe Token: SeLoadDriverPrivilege 1864 msiexec.exe Token: SeSystemProfilePrivilege 1864 msiexec.exe Token: SeSystemtimePrivilege 1864 msiexec.exe Token: SeProfSingleProcessPrivilege 1864 msiexec.exe Token: SeIncBasePriorityPrivilege 1864 msiexec.exe Token: SeCreatePagefilePrivilege 1864 msiexec.exe Token: SeCreatePermanentPrivilege 1864 msiexec.exe Token: SeBackupPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeShutdownPrivilege 1864 msiexec.exe Token: SeDebugPrivilege 1864 msiexec.exe Token: SeAuditPrivilege 1864 msiexec.exe Token: SeSystemEnvironmentPrivilege 1864 msiexec.exe Token: SeChangeNotifyPrivilege 1864 msiexec.exe Token: SeRemoteShutdownPrivilege 1864 msiexec.exe Token: SeUndockPrivilege 1864 msiexec.exe Token: SeSyncAgentPrivilege 1864 msiexec.exe Token: SeEnableDelegationPrivilege 1864 msiexec.exe Token: SeManageVolumePrivilege 1864 msiexec.exe Token: SeImpersonatePrivilege 1864 msiexec.exe Token: SeCreateGlobalPrivilege 1864 msiexec.exe Token: SeBackupPrivilege 1916 vssvc.exe Token: SeRestorePrivilege 1916 vssvc.exe Token: SeAuditPrivilege 1916 vssvc.exe Token: SeBackupPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeBackupPrivilege 2568 srtasks.exe Token: SeRestorePrivilege 2568 srtasks.exe Token: SeSecurityPrivilege 2568 srtasks.exe Token: SeTakeOwnershipPrivilege 2568 srtasks.exe Token: SeBackupPrivilege 2568 srtasks.exe Token: SeRestorePrivilege 2568 srtasks.exe Token: SeSecurityPrivilege 2568 srtasks.exe Token: SeTakeOwnershipPrivilege 2568 srtasks.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe Token: SeTakeOwnershipPrivilege 5028 msiexec.exe Token: SeRestorePrivilege 5028 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1864 msiexec.exe 1864 msiexec.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 5028 wrote to memory of 2568 5028 msiexec.exe 98 PID 5028 wrote to memory of 1760 5028 msiexec.exe 100 PID 4808 wrote to memory of 3640 4808 TGQKiR.exe 105 PID 3640 wrote to memory of 652 3640 cmd.exe 107 PID 3640 wrote to memory of 4308 3640 cmd.exe 108 PID 4808 wrote to memory of 3740 4808 TGQKiR.exe 109 PID 3740 wrote to memory of 3140 3740 cmd.exe 112 PID 3640 wrote to memory of 1252 3640 cmd.exe 113 PID 3740 wrote to memory of 4220 3740 cmd.exe 115 PID 3740 wrote to memory of 716 3740 cmd.exe 116 PID 1892 wrote to memory of 4336 1892 cmd.exe 117 PID 4808 wrote to memory of 4228 4808 TGQKiR.exe 120 PID 4228 wrote to memory of 3400 4228 cmd.exe 122 PID 4228 wrote to memory of 3544 4228 cmd.exe 123 PID 4228 wrote to memory of 1268 4228 cmd.exe 126 PID 3624 wrote to memory of 3112 3624 cmd.exe 127 PID 4808 wrote to memory of 1864 4808 TGQKiR.exe 128 PID 1864 wrote to memory of 3464 1864 cmd.exe 130 PID 1864 wrote to memory of 4084 1864 cmd.exe 131 PID 1768 wrote to memory of 2724 1768 cmd.exe 134 PID 1864 wrote to memory of 4180 1864 cmd.exe 135 PID 4808 wrote to memory of 1976 4808 TGQKiR.exe 136 PID 1976 wrote to memory of 4624 1976 cmd.exe 138 PID 1976 wrote to memory of 1076 1976 cmd.exe 139 PID 4760 wrote to memory of 3600 4760 cmd.exe 142 PID 1976 wrote to memory of 3148 1976 cmd.exe 143 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_c0rd018.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1864
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0CD9C2FB35B9C29C7162E7DE0881D774 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
C:\Users\Public\WQ7M1u\TGQKiR.exeC:\Users\Public\WQ7M1u\TGQKiR.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WQ7M1u\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WQ7M1u\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:652
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4308
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1252
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3140
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4220
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3400
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3544
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3464
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4084
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4624
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1076
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3148
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WQ7M1u" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WQ7M1u" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4336
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:936
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3112
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2724
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3600
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589ce8.rbs
- Size 7KB
- SHA256 92e7f9cbc07aafcc573479e9fafdbec28fc98caeb3a515b6494a6da9fd57bf99
- MD5 5eca72ff2774be10c9f319fa3e4802c1
- SHA1 fdda95258fd45c34c67c14a4cfb604a8680ca0e7
- SHA512 a5106c2d53cd70772777fd87ffd361cf5c2d22062a32be2aec7fd78254835c88a08e6518100f705e933b0e1bae706320be4e91a1b19fd3c1ae63dd9147e94f39
- SSDEEP 192:MP9LezGlzrIIdrIW7d7u0aXWjPwE/VKpbNx5aTEbZ1:MPoGRrprL7dK/XWjPwE/4Nx5aTEbZ1
- TLSH T1BEF1FC45BF0196D2EE962B34C71737253BB2C79E9241635B0DCE80A06F0778A9ED518A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\WQ7M1u\TGQKiR.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\WQ7M1u\UxEnhance64.dll
- Size 3.1MB
- SHA256 5f5f4ae88ac2ee9257c655133362eb9996ccfe390f85002c3d5288c7a57acd1d
- MD5 cd221312b41194aa3bf7a183d3a6dffd
- SHA1 7b58169130d4de78259384c6416942e2c686882e
- SHA512 bef5dd97909304459beaea7dfedd09fc8d846ad72cc8d2fb9cc9cadd4baccb624eb27a114d0a0864e5bbed057e87f8721e3400eeb3f65f667519dcb1cb505be1
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+k:P9m29xx3Tiqt06ox6+z2rNNrKok
- TLSH T1F1E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\WQ7M1u\adoresd.dat
- Size 4.7MB
- SHA256 493063386aeba8b6c0a7cefa2f5d9204af90b932b96f2ad2bc8aa38ed0375070
- MD5 3a55dd867ef4ef18229e688878534192
- SHA1 39a7d1b262f3bc5f611365b7c862ed939a1b87cf
- SHA512 d3f66a1431517e8689a85d2265c5624214a42c631be181fd3b7d2607079bdfd180674e69385092bd408b2dcadeef144fc5c2e2f8b84470187ddc3d1c11bccf2d
- SSDEEP 98304:kmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Hu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1083633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\WQ7M1u\msadox.tb
- Size 8KB
- SHA256 6127ad967b9401163f0e1b0c3de05aa8ec28cabeceae90374c752afc80c056cc
- MD5 dfec764677836fa27091fbb7a35d501f
- SHA1 f041adf19a909ef49dddc00fbd52638812b1ef9b
- SHA512 f1d92530c9a8706e9eb765e05a9bdfa54e82f30c81b812a1a691e1493dd9061fe50ad07744166c9407e02895eba0bcb9cc5d8517705402e942262a45d45781aa
- SSDEEP 192:nqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:nsZqZOXQ3uqvR2Kfzp
- TLSH T134029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9E4F.tmp
- Size 6.1MB
- SHA256 6267f19d91d8c2dedd711c2807bf0d1ea359d97e13561e57e287dfb1e44bae19
- MD5 ef166306c09cb8d506e94b0449f97f97
- SHA1 851fa8cd3bae7d04e3561490d9aae389bc378aad
- SHA512 e1e0bd09f55c1fa0f24064afb021fb844b7a05035c76acc5c89fc61df4c2f6e0285d7d3db1e73927037b0e774507f27361ad2e901b5bbaf5e0274a9953fb5f97
- SSDEEP 196608:rJrMk1jQb8WotBWNaBVZnpZrdNzfXQBnZ:rJrM7Cdnp/NzfAlZ
- TLSH T1A15633D23CD52770D4A7C7F25082BA2DB27A37C6BE669C157BED2A105D73B0668B1308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e589ce7.msi
- Size 6.2MB
- SHA256 b4a3518b5685d343a9e995addb93da58d39616abce382ceaab5df7fd315b079f
- MD5 df7f49344cfa0d8d97298d89f63e6aa3
- SHA1 8a3ba6394c942101d879a2231bffb69fe84cd861
- SHA512 525e92346b7488de7c787579976a8c5cd006b2a2678c0cccd1699bb45a60a6fdf0e33a231f0c9b1d8afa5df20760c069c85302213e80a1f8659edea9f65ba9cf
- SSDEEP 196608:HJrMk1jQb8WotBWNaBVZnlZrdNzfXQBn0:HJrM7Cdnl/NzfAl0
- TLSH T18A5633D23CC52771D497C7B24086A62CB27A3FC5BE669C167BED36145E73B1228B2348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 00adfbbbbf4e94d0bd9f93344dfb45faecb9d3f366d0a531a88e6077e38402d3
- MD5 8a6af2acc429aac35eed35f027ae91df
- SHA1 826fd1272281a0193bed2858767b307e00d8afe4
- SHA512 bdcb12c8a09d3593f3ad769b3ac56b2cf4d0e70e8258261e810d44bafb3c5ca60b12a2ebd9b5ecb1f67ec675bc2967fbf7876b827f92ec3df4b9f7c43fb40b1f
- SSDEEP 24576:2u8m+1zPdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:y
- TLSH T12447D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{34e2e459-0e0f-41df-b175-01cca17a8294}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c8d0b301de94c9f17a504ba46402dd98251527c60af71f5411c6115443af7836
- MD5 903ffd9540e653da38dfb53b5310597b
- SHA1 2c0b4ee56b7b016fcb19294da54a560235b83b1a
- SHA512 45bcc5a0167f5c90c660de1490f15cf43acd5c3c99ff29defbdbc6d546523777da5d2ac6d8f8ad7ab0ac5cf8cb47085d6c7db95cef603529eccb9e0428f9ce5f
- SSDEEP 96:FmyOhdzyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:wzdIb++ZVm
- TLSH T176D188085AE54711E2B3AB7129F18557A877B911EF33CB8E0198238E2630910F876F5F
- MD5 SHA1 SHA512 SSDEEP TLSH