Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_s0up015.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_s0up015.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target install_s0up015.msi
- Size 9.3MB
- Sample260802-mlsl8axybx
- SHA256 03d2a9729f87c153573ad73a24b2f2638a430f9c30030bea75b94cbe08bb0047
- MD5 97ddc958b116834ddab5e9ef161b8ee9
- SHA1 4aff7e4fab68aff12e3f92c694223eefbf79d17a
- SHA512 6f5f011cf9ab3c4f9a741abc9be57b3902df8d0b641b0f95742340af01d0644118639811aba3c1f7bece2472f5d10ffc1128f9cd6d21f0c571bb87919e8f1cab
- SSDEEP 196608:0lWgHgD0JWAKUyRjY/X1wO4p0tJCY6V4etvKV2JK4SKh3rebWqllvmr9:00HXALyyP1w9p0EOV2JK4S03qxvmr9
- TLSH T1C3A633D5ADC02770C09FDBB29053757EB1693FCA7E395E0B7A9EB6019E7220A54B2340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2484 C4S5dT.exe - Loads dropped DLL 2 IoCs
pid Process 2468 MsiExec.exe 2484 C4S5dT.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 2468 MsiExec.exe 13 2468 MsiExec.exe 14 2468 MsiExec.exe 15 2468 MsiExec.exe 16 2468 MsiExec.exe 17 2468 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F342AD810E2573BA008691E7C64C1A7F MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F342AD810E2573BA008691E7C64C1A7F MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF721DAC31BCA29437.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File created C:\Windows\SystemTemp\~DF908CB6F7A9CF8D20.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF18C6C13C28BFF4B4.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5941f1.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFA7831674C6DA032D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI478E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI48E7.tmp msiexec.exe File created C:\Windows\Installer\e5941f3.msi msiexec.exe File created C:\Windows\Installer\e5941f1.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4496 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_s0up015.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "6969F7A91175C904A8DCD806F2207E0F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3432 msiexec.exe 3432 msiexec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2468 MsiExec.exe 2484 C4S5dT.exe 2484 C4S5dT.exe 2484 C4S5dT.exe 2484 C4S5dT.exe 2484 C4S5dT.exe 2484 C4S5dT.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4496 msiexec.exe Token: SeIncreaseQuotaPrivilege 4496 msiexec.exe Token: SeSecurityPrivilege 3432 msiexec.exe Token: SeCreateTokenPrivilege 4496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4496 msiexec.exe Token: SeLockMemoryPrivilege 4496 msiexec.exe Token: SeIncreaseQuotaPrivilege 4496 msiexec.exe Token: SeMachineAccountPrivilege 4496 msiexec.exe Token: SeTcbPrivilege 4496 msiexec.exe Token: SeSecurityPrivilege 4496 msiexec.exe Token: SeTakeOwnershipPrivilege 4496 msiexec.exe Token: SeLoadDriverPrivilege 4496 msiexec.exe Token: SeSystemProfilePrivilege 4496 msiexec.exe Token: SeSystemtimePrivilege 4496 msiexec.exe Token: SeProfSingleProcessPrivilege 4496 msiexec.exe Token: SeIncBasePriorityPrivilege 4496 msiexec.exe Token: SeCreatePagefilePrivilege 4496 msiexec.exe Token: SeCreatePermanentPrivilege 4496 msiexec.exe Token: SeBackupPrivilege 4496 msiexec.exe Token: SeRestorePrivilege 4496 msiexec.exe Token: SeShutdownPrivilege 4496 msiexec.exe Token: SeDebugPrivilege 4496 msiexec.exe Token: SeAuditPrivilege 4496 msiexec.exe Token: SeSystemEnvironmentPrivilege 4496 msiexec.exe Token: SeChangeNotifyPrivilege 4496 msiexec.exe Token: SeRemoteShutdownPrivilege 4496 msiexec.exe Token: SeUndockPrivilege 4496 msiexec.exe Token: SeSyncAgentPrivilege 4496 msiexec.exe Token: SeEnableDelegationPrivilege 4496 msiexec.exe Token: SeManageVolumePrivilege 4496 msiexec.exe Token: SeImpersonatePrivilege 4496 msiexec.exe Token: SeCreateGlobalPrivilege 4496 msiexec.exe Token: SeBackupPrivilege 2268 vssvc.exe Token: SeRestorePrivilege 2268 vssvc.exe Token: SeAuditPrivilege 2268 vssvc.exe Token: SeBackupPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeBackupPrivilege 5052 srtasks.exe Token: SeRestorePrivilege 5052 srtasks.exe Token: SeSecurityPrivilege 5052 srtasks.exe Token: SeTakeOwnershipPrivilege 5052 srtasks.exe Token: SeBackupPrivilege 5052 srtasks.exe Token: SeRestorePrivilege 5052 srtasks.exe Token: SeSecurityPrivilege 5052 srtasks.exe Token: SeTakeOwnershipPrivilege 5052 srtasks.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4496 msiexec.exe 4496 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4496 msiexec.exe 3432 msiexec.exe 2468 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3432 wrote to memory of 5052 3432 msiexec.exe 94 PID 3432 wrote to memory of 2468 3432 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_s0up015.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4496
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 82323209FED6A438E05141401D128156 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
C:\Users\Public\JFn0ob\C4S5dT.exe"C:\Users\Public\JFn0ob\C4S5dT.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5941f2.rbs
- Size 7KB
- SHA256 4a8b3150c452c91e0cc4727c3dc76b64b0a5ef161645234cac62f94b2d90c87c
- MD5 21bac50e1b7201bc61ed3341fd638542
- SHA1 bda4e57c0e8bcecf6d81fd7c695593a6b0fea7c8
- SHA512 99787ab74a20fe8adf602f8340c9da8b611086640bdb8be19da0f3d5d2397d43255d832bd4148203df452f5e96a311d03dc250c9725f9bdfb6ccb0d674a2a0ad
- SSDEEP 96:5Rgu0CTbaUUFb1CsThq/UFb1C6j4/xpThqjHsS56TWt8dHCKpljqzIjByy:5KCyz5IIV5I3CAIKp9
- TLSH T1BAF12101B71196D2E9911B75CB831B1A37F2D3DAA320735B08DE80685F573883ED67AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JFn0ob\C4S5dT.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JFn0ob\UxEnhance64.dll
- Size 3.1MB
- SHA256 89086142d18d58c3a6aea997b097ffa20b9098def2d3d1a05f41023998e153b2
- MD5 eb9626a914c2bb9cd555b771f33c4ca0
- SHA1 d0d47dee4b181ff1c510884fb154a5530afa183c
- SHA512 b5c32da22c9d344a1429be3cadc600a020699963185a56367fdfa590d856c3c8adaa6f202d15ea7aadad09c6f58041d06c611475364b339879cb576b78d97ad1
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+N:P9m29xx3Tiqt06ox6+z2rNNrKoN
- TLSH T179E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JFn0ob\adoresd.dat
- Size 4.7MB
- SHA256 793e99e4d6bda7114bacb90782b3121d452397607cea6c72e52cb99a760ac271
- MD5 08aa4bf83594d025389f616b92d0162b
- SHA1 87ad0be8ee43ad3daf88e9bf205c2dc80da1f6d2
- SHA512 3236fc1997c35e423c77ecb26f7da880115291ae4ed59a2a9a9282161e4b58daff4a189ab0eb27b32f9ee7f963ab6662578d97acb455ec433a6563309b5018f9
- SSDEEP 98304:Mmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:fu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T15E3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JFn0ob\msadox.tb
- Size 8KB
- SHA256 6da079e81fb3af47bd408be490d9a2ba165ba7b6fc23f25fc181c4446f76346f
- MD5 1d9ddcfaa3c19687b39045bc18fa9d6d
- SHA1 53230018ab7611c5bc3c8f54b8d0f368d804751f
- SHA512 8293f6b17c744f446a317d74367d50b53bdb2b73ded4cb8d4fd5241d150cbceaed8e6619f2ec71bad3266dfc38e721891c0bc37238f20a270c9e5cdd536b831f
- SSDEEP 192:7qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:7sZqZOXQ3uqvR2Kfzp
- TLSH T110029E05D7A20CC3E2116C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI48E7.tmp
- Size 9.3MB
- SHA256 a0a2d03a00a35caf9668beb29c68ed411b0b3929bdef9a95ebc1a4a3905d7ae4
- MD5 d084e4fa124c1d92a4de3842bdbb5ee6
- SHA1 43f17e76405558fa91a4a66c5c18230c96ed5abe
- SHA512 48fa6a358e0f1c886ba5114cd7086015cc91db0a1f4a36ae3dc4f522a68abb5e5d32abbf8881084c6704001f22ec65e98d080bd0180a2107b8d3b68ec803f7ed
- SSDEEP 196608:8lWgHgD0JWAKUyRj2/X1wO4p0tJCY6V4etvKV2JK4SKh3r2bWqllvmrG:80HXALyUP1w9p0EOV2JK4S03axvmrG
- TLSH T1B2A633D5ADD02770C0DFDBB2A053357FB16937CB7D396E0ABA9EA5028E6220B54B5340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5941f1.msi
- Size 9.3MB
- SHA256 03d2a9729f87c153573ad73a24b2f2638a430f9c30030bea75b94cbe08bb0047
- MD5 97ddc958b116834ddab5e9ef161b8ee9
- SHA1 4aff7e4fab68aff12e3f92c694223eefbf79d17a
- SHA512 6f5f011cf9ab3c4f9a741abc9be57b3902df8d0b641b0f95742340af01d0644118639811aba3c1f7bece2472f5d10ffc1128f9cd6d21f0c571bb87919e8f1cab
- SSDEEP 196608:0lWgHgD0JWAKUyRjY/X1wO4p0tJCY6V4etvKV2JK4SKh3rebWqllvmr9:00HXALyyP1w9p0EOV2JK4S03qxvmr9
- TLSH T1C3A633D5ADC02770C09FDBB29053757EB1693FCA7E395E0B7A9EB6019E7220A54B2340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 86081edb91533e74aa37ba367feec215286db5b6d8984a786c9ee110864ef19d
- MD5 71de2229f556bdc00cf49a15b79f0914
- SHA1 10214e03e3cd14efd4621f0c80acc5de582ec552
- SHA512 0126a4bc6d04fe4affe19b8e1d0a1aa5fc98428890c6e47a5bd1500a74b0df7344f0b316fc235419393020a23aaca7046171396772d733f7d5ce2de2ab5c3e4c
- SSDEEP 24576:mFo3DMPFdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0uC:CHw
- TLSH T12457A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{209aaa11-c02c-48a2-b618-4b0aa24b5bf9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 593a69178415e49c1780bdf1e49e63b42bcfaa18d2d3c3c376749969a92f229f
- MD5 4753da1a121cd6dd2609bb57b66d712e
- SHA1 8b0015c08a3d3749ecf47fad9bdae838770728a8
- SHA512 5540c52b93bbe4b67b76b620b313aee720a7bd91b8e2bc853ff527e26ad05112850f50c37916bb1358551c137fa1a08252abd13580f5e87882860eee2a33c3da
- SSDEEP 96:FWTx0Tvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:csb++uVm
- TLSH T148D178085AE54711E2B3AB3129F14557A877B811EF33CB8E0198238F6671A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH