eed3bdaa7242a3585c86ea33f4d51ff1aeeb39340ba0dc7a09dc250792c05036

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_s0up005.msi
Size 7.7MB
Sample260802-bcv57sbb98
SHA256 eed3bdaa7242a3585c86ea33f4d51ff1aeeb39340ba0dc7a09dc250792c05036
MD5 2730a082dde3db1ea502a947c2863d8b
SHA1 a7b387ff261f9a22b49f986c68165087b3280636
SHA512 2a20d5800060e6179a88849cea55c09c0e779f60b2d9cefa478da406c0a16cfb34d9f5937109381ead951b9db9f61bc22224f9c4f038fa1d17472057b1dfc062
SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gP:IA8oKhVeLwUSPVjqSwq
TLSH
T1498633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4420	8IxMKU.exe

Loads dropped DLL 2 IoCs

pid	Process
916	MsiExec.exe
4420	8IxMKU.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
36	916	MsiExec.exe
62	916	MsiExec.exe
89	916	MsiExec.exe
94	916	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF77.tmp	msiexec.exe
File created	C:\Windows\Installer\e590e6f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e590e6d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1005.tmp	msiexec.exe
File created	C:\Windows\Installer\e590e6d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2236	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "054164483070034468643B3C4B93A426"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_s0up005.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1752	msiexec.exe
1752	msiexec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
4420	8IxMKU.exe
4420	8IxMKU.exe
4420	8IxMKU.exe
4420	8IxMKU.exe
4420	8IxMKU.exe
4420	8IxMKU.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2236	msiexec.exe
Token: SeSecurityPrivilege	1752	msiexec.exe
Token: SeCreateTokenPrivilege	2236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2236	msiexec.exe
Token: SeLockMemoryPrivilege	2236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2236	msiexec.exe
Token: SeMachineAccountPrivilege	2236	msiexec.exe
Token: SeTcbPrivilege	2236	msiexec.exe
Token: SeSecurityPrivilege	2236	msiexec.exe
Token: SeTakeOwnershipPrivilege	2236	msiexec.exe
Token: SeLoadDriverPrivilege	2236	msiexec.exe
Token: SeSystemProfilePrivilege	2236	msiexec.exe
Token: SeSystemtimePrivilege	2236	msiexec.exe
Token: SeProfSingleProcessPrivilege	2236	msiexec.exe
Token: SeIncBasePriorityPrivilege	2236	msiexec.exe
Token: SeCreatePagefilePrivilege	2236	msiexec.exe
Token: SeCreatePermanentPrivilege	2236	msiexec.exe
Token: SeBackupPrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeShutdownPrivilege	2236	msiexec.exe
Token: SeDebugPrivilege	2236	msiexec.exe
Token: SeAuditPrivilege	2236	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2236	msiexec.exe
Token: SeChangeNotifyPrivilege	2236	msiexec.exe
Token: SeRemoteShutdownPrivilege	2236	msiexec.exe
Token: SeUndockPrivilege	2236	msiexec.exe
Token: SeSyncAgentPrivilege	2236	msiexec.exe
Token: SeEnableDelegationPrivilege	2236	msiexec.exe
Token: SeManageVolumePrivilege	2236	msiexec.exe
Token: SeImpersonatePrivilege	2236	msiexec.exe
Token: SeCreateGlobalPrivilege	2236	msiexec.exe
Token: SeBackupPrivilege	1016	vssvc.exe
Token: SeRestorePrivilege	1016	vssvc.exe
Token: SeAuditPrivilege	1016	vssvc.exe
Token: SeBackupPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeBackupPrivilege	1780	srtasks.exe
Token: SeRestorePrivilege	1780	srtasks.exe
Token: SeSecurityPrivilege	1780	srtasks.exe
Token: SeTakeOwnershipPrivilege	1780	srtasks.exe
Token: SeBackupPrivilege	1780	srtasks.exe
Token: SeRestorePrivilege	1780	srtasks.exe
Token: SeSecurityPrivilege	1780	srtasks.exe
Token: SeTakeOwnershipPrivilege	1780	srtasks.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2236	msiexec.exe
2236	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1780	1752	msiexec.exe	93
PID 1752 wrote to memory of 916	1752	msiexec.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_s0up005.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2236

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5EB8AD810069E61BE97C45C3FA469134 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Users\Public\sdslGp\8IxMKU.exe
C:\Users\Public\sdslGp\8IxMKU.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e590e6e.rbs

Path C:\Config.Msi\e590e6e.rbs
Size 7KB
SHA256 3979e99b0f0bb563614e902d8451c52253cf8de3e7ae6b0e1d4a19a4edbf790c
MD5 1a365d5637770c13bd121f907c8fe4ed
SHA1 bcfcc537c5265c0824bb64a90089e9ad37e679d9
SHA512 34975ee44e93a73698bef8534e34e70a95380e1eb17e4f20b5ba1d43f8645974c29fe268bf38714604be589f21ccb13d9e3edff0799795f0f7013e8b80965a5a
SSDEEP 96:qAquu1eOcaUUFt1CsThq/UFt1C6j4/xpThqjHqS56TWt8d71CKplj/RzIjByy:qAGeezDIIVDI36A9IKpFW
TLSH
T196F11001B31196D2F5911B75CB871B1637F2D3DA6320739B089E80285F5778C2EE67AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8IxMKU.exe

Path C:\Users\Public\sdslGp\8IxMKU.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\sdslGp\UxEnhance64.dll
Size 3.1MB
SHA256 b7c901a6b38174a868b44e3603204eab53d2997736dea1140dfafa361f4ec28b
MD5 4c0bc7b5ab5b7c11738f27e81d1d69c1
SHA1 2396d4c21cbe9bfc54b375d11896c6e71ab3a90c
SHA512 7c05dbffdf449f5fdd9b6665cb4cb174c552d39eaec77fb79026d783e1b8e21b4042d7428285c80a1c29bcf5d864c835669ce373f5dab07bda1e3bba52cf0f0f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+H:P9m29xx3Tiqt06ox6+z2rNNrKoH
TLSH
T1EEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\sdslGp\UxEnhance64.dll
Size 3.0MB
SHA256 880afbbea4c0d157330cdd8b3e02c91fb858eafa6be5cd8d37591c4b2f7f95df
MD5 531fd42b768f62cbf9bb5ce785e56a42
SHA1 42946d3efeacced7149da97e13e004211877f49d
SHA512 0d0a52db256e1350cfb6e9528d2a411ae7c42d35782af013157d266e7349322d7b5ffd2f171704a5aa6b97a6e6ea3903ee8ba50bbfa92920e29118750c822769
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKQ:P9m29xx3Tiqt06ox6+z2rNNQ
TLSH
T1B2E523A536D735F7E032CBE4DA62629D74383F515F636C5F3B8A28014E66278873A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\sdslGp\adoresd.dat
Size 2.5MB
SHA256 deba5b2fc89d632e29890f42d5d3968a1c67b8f4620bb3d1de44fed7b82fce2d
MD5 411275da56cb8eacc3ecd8991ef7863d
SHA1 8f3fce3e74e0a396de1a48a354dc90e2eacaf932
SHA512 444ce7b8c1e5f88aac902f79598d5a7f4dab6ea7d7da37c9c52609e595eb86cebb3c35828cec75874899836659e2435cdb1bd2f6e86920805f0049ac729f1c37
SSDEEP 49152:Rmu1QZDwODpRGWfRmp12d62UtQ8SZYe6rmSwSwCoTXzFppMk6ZGSSXwKK5:Rmu1SwODpRGIRdXEMZYe6rFLoTTpMk6V
TLSH
T18BC5337587EB5096D3DA3A45F26AC8F42AF0FB2E3C9C7685C2F51009A8351DF6016BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\sdslGp\msadox.tb
Size 8KB
SHA256 c6274a07a51091ff4fc3b26c668edca097c8c30ad601c96fdbc18c769674fdc8
MD5 2b8b97d12d2483c4a9ff7f7d8e7a4afc
SHA1 85ae5a41afdb260af290a588a37760a9264083b0
SHA512 a320e96270cfd1d8d90b727af66658f9ac223a2ad61e7e208e5182737f47505471bf251fe8c40564717b52f1307e2a1aad75150aeb494c6fd24e03f29ddb96f4
SSDEEP 192:PqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:PsZqZOXQ3uqvR2Kfzp
TLSH
T164029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1005.tmp

Path C:\Windows\Installer\MSI1005.tmp
Size 7.6MB
SHA256 1f6b8a0b0fb5bc11fa65065d8c056edf4a03f2f1cd7bd2d998dd3c9395d1e57f
MD5 ddf32194688ae13e6dac6ae875e98b0a
SHA1 d794f2fcbe866b36ddbdf4e90cc80930a495a370
SHA512 9a808d552b03f60ef74e0e91fdbea974d3885cfe1734af32799f20eb9266a365c652f84d9d2dabbab061ff6fb468d949d94e4a7988728fb7bf1933638d250438
SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKcMey+lr4ywwoKIMzkPV0EG/xPnSin/gy:IA8oKhweLwUSPVjqSwn
TLSH
T19E8633827E8F2670C05BCBF56A55B17F715E37C26F3A1C1639D93B485D3221600BB2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590e6d.msi

Path C:\Windows\Installer\e590e6d.msi
Size 7.7MB
SHA256 eed3bdaa7242a3585c86ea33f4d51ff1aeeb39340ba0dc7a09dc250792c05036
MD5 2730a082dde3db1ea502a947c2863d8b
SHA1 a7b387ff261f9a22b49f986c68165087b3280636
SHA512 2a20d5800060e6179a88849cea55c09c0e779f60b2d9cefa478da406c0a16cfb34d9f5937109381ead951b9db9f61bc22224f9c4f038fa1d17472057b1dfc062
SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gP:IA8oKhVeLwUSPVjqSwq
TLSH
T1498633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 dfb4b81146ce692dae0b4aad2b8a0c455a36df93b3f4d8869b0b2541fe1565a4
MD5 a3c9481531d61800260ad334c4e89c43
SHA1 94ba1da40ad12de2d622d10ea63647fac1b4d40b
SHA512 365b1b76482b833ed1ed957df7821518f0e8fb618ce69a9b421a30d90e2d2ab9527d758502bffc233b8fc4e450ea49bdb17ebef401026e6ee958700e49ae4135
SSDEEP 24576:Mu8m+1z9doO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:u
TLSH
T1A747C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c4cfc69c-35d1-48d1-b670-1d42640da4e3}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c4cfc69c-35d1-48d1-b670-1d42640da4e3}_OnDiskSnapshotProp
Size 6KB
SHA256 33445024ed6eb128f9d3d4cbfc1883359c39629a319117649d0323b5752aa3c4
MD5 d8154754174e2f31b5a2c54c4aac64eb
SHA1 12b5e1d8979795c4d974ccbe6f6b9db7ff179700
SHA512 4aaec699b147c80503e5950beef642d0af3b944d817a4a3ee07b49e4eb23c08f0c6b004c6fbc2603de5270d492874ecbffc6f33a977293e238b1906e643ee7a1
SSDEEP 96:FON6BAavc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:26b++ZVm
TLSH
T105D1A9084AE54711E2B3AB312CF18557A877B911EF33CB8E0298638E6671A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-13-0x00007FFDF14F0000-0x00007FFDF1B24000-memory.dmp

Download

memory/916-16-0x00007FFE00620000-0x00007FFE00630000-memory.dmp

Download

memory/916-42-0x00007FFE00620000-0x00007FFE00630000-memory.dmp

Download

memory/916-12-0x00007FFE0FDB0000-0x00007FFE0FDB2000-memory.dmp

Download

memory/4420-62-0x000001AEB9B10000-0x000001AEBA3A1000-memory.dmp

Download

memory/4420-57-0x00007FFDF2880000-0x00007FFDF2D9E000-memory.dmp

Download

memory/4420-56-0x00007FFE0FDB0000-0x00007FFE0FDB2000-memory.dmp

Download

memory/4420-65-0x000001AEB9B10000-0x000001AEBA3A1000-memory.dmp

Download

memory/4420-64-0x00007FFE0FDC0000-0x00007FFE0FDC2000-memory.dmp

Download

memory/4420-70-0x000001AEB9B10000-0x000001AEBA3A1000-memory.dmp

Download

memory/4420-69-0x000001AEB9B10000-0x000001AEBA3A1000-memory.dmp

Download

memory/4420-71-0x000001AEB9B10000-0x000001AEBA3A1000-memory.dmp

Download

memory/4420-72-0x000001AEB9B10000-0x000001AEBA3A1000-memory.dmp

Download