Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Dijkstra Installer.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dijkstra Installer.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Dijkstra Installer.msi
- Size 242KB
- Sample260802-agkdtsah45
- SHA256 504c2c7ad37766c437792f9edd0b5617d335178cee61f78442d9d8d347bc8ccf
- MD5 e9f450ddcf73622caa58e5da8bf8fef3
- SHA1 087124c2802e8c51fcdb88426ca6a817fce9053c
- SHA512 97666f6fa84990e5638e6f284c6fae3c413cf856c706ad1149134dceddddbd3a27c53a5b9e3e143f8a07d40e18a19dfad740c114e8ff61a691cf695f0fe41fc6
- SSDEEP 1536:aWFtC7FSUHlXAcEdVsBjwy283IpGqPuqaICZSrFCu8oN+i5oTPwjt+Wo:7CZXtEdSBLqPuApZCJoN+i5o+tU
- TLSH T1D2346C5675474732C9420232954F67E49F32CC484BB20A2A71AA7B4C3DF2DA5A3FBDD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Sheppard\Dijkstra Installer\Dijkstra.exe msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e59c6a2.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFDB69A140540D467C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFEB9EBFE003CB774A.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59c6a2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{7F35816F-3E42-493C-9776-FE7AE1D51D7E} msiexec.exe File created C:\Windows\SystemTemp\~DF126E561CC96AF772.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICCDB.tmp msiexec.exe File created C:\Windows\Installer\e59c6a4.msi msiexec.exe File created C:\Windows\SystemTemp\~DF6B570576077FF962.TMP msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4568 msiexec.exe 4568 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3444 msiexec.exe Token: SeIncreaseQuotaPrivilege 3444 msiexec.exe Token: SeSecurityPrivilege 4568 msiexec.exe Token: SeCreateTokenPrivilege 3444 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3444 msiexec.exe Token: SeLockMemoryPrivilege 3444 msiexec.exe Token: SeIncreaseQuotaPrivilege 3444 msiexec.exe Token: SeMachineAccountPrivilege 3444 msiexec.exe Token: SeTcbPrivilege 3444 msiexec.exe Token: SeSecurityPrivilege 3444 msiexec.exe Token: SeTakeOwnershipPrivilege 3444 msiexec.exe Token: SeLoadDriverPrivilege 3444 msiexec.exe Token: SeSystemProfilePrivilege 3444 msiexec.exe Token: SeSystemtimePrivilege 3444 msiexec.exe Token: SeProfSingleProcessPrivilege 3444 msiexec.exe Token: SeIncBasePriorityPrivilege 3444 msiexec.exe Token: SeCreatePagefilePrivilege 3444 msiexec.exe Token: SeCreatePermanentPrivilege 3444 msiexec.exe Token: SeBackupPrivilege 3444 msiexec.exe Token: SeRestorePrivilege 3444 msiexec.exe Token: SeShutdownPrivilege 3444 msiexec.exe Token: SeDebugPrivilege 3444 msiexec.exe Token: SeAuditPrivilege 3444 msiexec.exe Token: SeSystemEnvironmentPrivilege 3444 msiexec.exe Token: SeChangeNotifyPrivilege 3444 msiexec.exe Token: SeRemoteShutdownPrivilege 3444 msiexec.exe Token: SeUndockPrivilege 3444 msiexec.exe Token: SeSyncAgentPrivilege 3444 msiexec.exe Token: SeEnableDelegationPrivilege 3444 msiexec.exe Token: SeManageVolumePrivilege 3444 msiexec.exe Token: SeImpersonatePrivilege 3444 msiexec.exe Token: SeCreateGlobalPrivilege 3444 msiexec.exe Token: SeBackupPrivilege 4412 vssvc.exe Token: SeRestorePrivilege 4412 vssvc.exe Token: SeAuditPrivilege 4412 vssvc.exe Token: SeBackupPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3444 msiexec.exe 3444 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3444 msiexec.exe 4568 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4568 wrote to memory of 3596 4568 msiexec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Dijkstra Installer.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3444
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3596
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c6a3.rbs
- Size 8KB
- SHA256 836f963e2a4a7727f3277e56959e9e3cf8e38b8e0e7229a2ad66a98208d485bc
- MD5 c40e536707d9ea82735d9f5aa565fd51
- SHA1 1412befe4c662d99542d5d133ec0768a0342ef3c
- SHA512 d8815043d5d306ad67868ecf9203f84124633c2129a0e4cf320424e5bc5a8d7397d76c4aa59ccc6ce5f372b821cc1395d8fae7c9a9d092e569f28c2b70679c8e
- SSDEEP 96:R9LsSNuWCCV2bdUUFNTCsThquUFNTC6jfuxD46ThqGHpp5VGFBI0wySCLpzBfu47:zRCCVoznOIonOuq+BLpBdx
- TLSH T16A021402B64485E1EBEB2731D3575B103BA7E2EDC640276B0C9E45241F4379CEEAD58B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c6a2.msi
- Size 242KB
- SHA256 504c2c7ad37766c437792f9edd0b5617d335178cee61f78442d9d8d347bc8ccf
- MD5 e9f450ddcf73622caa58e5da8bf8fef3
- SHA1 087124c2802e8c51fcdb88426ca6a817fce9053c
- SHA512 97666f6fa84990e5638e6f284c6fae3c413cf856c706ad1149134dceddddbd3a27c53a5b9e3e143f8a07d40e18a19dfad740c114e8ff61a691cf695f0fe41fc6
- SSDEEP 1536:aWFtC7FSUHlXAcEdVsBjwy283IpGqPuqaICZSrFCu8oN+i5oTPwjt+Wo:7CZXtEdSBLqPuApZCJoN+i5o+tU
- TLSH T1D2346C5675474732C9420232954F67E49F32CC484BB20A2A71AA7B4C3DF2DA5A3FBDD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 fcba0d44f64c1277cb4a4a49123bee939d069cef1c3b0a5f20a98b55382bf10d
- MD5 e931a338cc6f48eec7ab6c8958bdd2f6
- SHA1 939722ef9fa143a7d8b215d9dd9e0c62e6edb4e6
- SHA512 2ee93a9c941f960fb42268c610c0565488fc29135cd1aa4c15a53e5ed17720a71e3fee7369609d7080bfd39576a09750421bf622c2a07a0c8bffd0a5368b4ec2
- SSDEEP 24576:7Fo3DMPqdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:YHA
- TLSH T12657B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{42449ac5-792f-4412-8f92-e50c56beece7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f9ec60c4288a1d7a55ddf844efac1058366b8b9a1b56f2c0e377c8d84e177e58
- MD5 0358dd6a956a294a21f9d99b33232f77
- SHA1 e7d00615795c0bdec9265b05a93af03ddba9c3d3
- SHA512 50be830b814773104f0539e7ef02c3d588fc610ee716d2c15634471e5c7de6afc47421dc0397ad47188e5d69b7bfaeb284b8f40cfd6655a9ee7b24eb3cda2f66
- SSDEEP 96:FR9jlJvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:1Xb++uVm
- TLSH T1C7D187085AE54311E2B3AB3128F14557A877B811EF33CB8E0298238E2631A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH