Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_ehe008.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_ehe008.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target install_ehe008.msi
- Size 5.9MB
- Sample260803-drn2jsbm8s
- SHA256 afa3f8415f4d757d96d99385f0cc9b96469f0f29f14a8dcc15f22f665d053c78
- MD5 a33e46defc89a57d346e36383cbe4e7c
- SHA1 350d03d5fb8d862f43a254303ac171a63a3ee42e
- SHA512 f46dac405571f440f313feac4eebbeceabd9f69f87f85fd61d66e2a693bc27f8f0dcb755af3a04724bee3d634d4c12a6f7aa95c6567c8334127be00774ded680
- SSDEEP 98304:bb0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDz:bbWNxG2T2s3uvDkhGuyuYBvFrG7I/y3
- TLSH T1465633D17D852375C09FC3B14656319E722A3FC47E9B9C0B39E4B7142A33B2998B6389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 928 POizRZ.exe - Loads dropped DLL 2 IoCs
pid Process 4648 MsiExec.exe 928 POizRZ.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 4648 MsiExec.exe 16 4648 MsiExec.exe 18 4648 MsiExec.exe 19 4648 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b POizRZ.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File opened for modification C:\Windows\Installer\MSIBB97.tmp msiexec.exe File created C:\Windows\Installer\e59b4e1.msi msiexec.exe File created C:\Windows\SystemTemp\~DF888E83467F809BF5.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7BECA8AB3C487E9B.TMP msiexec.exe File created C:\Windows\Installer\e59b4df.msi msiexec.exe File opened for modification C:\Windows\Installer\e59b4df.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF5A76EA132E2D4468.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFAD61BCF1A8E7ADE8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBADA.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1136 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_ehe008.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "1E3076C7AF3F92F4E8FA282386C93407" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5904 msiexec.exe 5904 msiexec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe 928 POizRZ.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1136 msiexec.exe Token: SeIncreaseQuotaPrivilege 1136 msiexec.exe Token: SeSecurityPrivilege 5904 msiexec.exe Token: SeCreateTokenPrivilege 1136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1136 msiexec.exe Token: SeLockMemoryPrivilege 1136 msiexec.exe Token: SeIncreaseQuotaPrivilege 1136 msiexec.exe Token: SeMachineAccountPrivilege 1136 msiexec.exe Token: SeTcbPrivilege 1136 msiexec.exe Token: SeSecurityPrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeLoadDriverPrivilege 1136 msiexec.exe Token: SeSystemProfilePrivilege 1136 msiexec.exe Token: SeSystemtimePrivilege 1136 msiexec.exe Token: SeProfSingleProcessPrivilege 1136 msiexec.exe Token: SeIncBasePriorityPrivilege 1136 msiexec.exe Token: SeCreatePagefilePrivilege 1136 msiexec.exe Token: SeCreatePermanentPrivilege 1136 msiexec.exe Token: SeBackupPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeShutdownPrivilege 1136 msiexec.exe Token: SeDebugPrivilege 1136 msiexec.exe Token: SeAuditPrivilege 1136 msiexec.exe Token: SeSystemEnvironmentPrivilege 1136 msiexec.exe Token: SeChangeNotifyPrivilege 1136 msiexec.exe Token: SeRemoteShutdownPrivilege 1136 msiexec.exe Token: SeUndockPrivilege 1136 msiexec.exe Token: SeSyncAgentPrivilege 1136 msiexec.exe Token: SeEnableDelegationPrivilege 1136 msiexec.exe Token: SeManageVolumePrivilege 1136 msiexec.exe Token: SeImpersonatePrivilege 1136 msiexec.exe Token: SeCreateGlobalPrivilege 1136 msiexec.exe Token: SeBackupPrivilege 4424 vssvc.exe Token: SeRestorePrivilege 4424 vssvc.exe Token: SeAuditPrivilege 4424 vssvc.exe Token: SeBackupPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeBackupPrivilege 2148 srtasks.exe Token: SeRestorePrivilege 2148 srtasks.exe Token: SeSecurityPrivilege 2148 srtasks.exe Token: SeTakeOwnershipPrivilege 2148 srtasks.exe Token: SeBackupPrivilege 2148 srtasks.exe Token: SeRestorePrivilege 2148 srtasks.exe Token: SeSecurityPrivilege 2148 srtasks.exe Token: SeTakeOwnershipPrivilege 2148 srtasks.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe Token: SeTakeOwnershipPrivilege 5904 msiexec.exe Token: SeRestorePrivilege 5904 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1136 msiexec.exe 1136 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1136 msiexec.exe 5904 msiexec.exe 4648 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5904 wrote to memory of 2148 5904 msiexec.exe 94 PID 5904 wrote to memory of 4648 5904 msiexec.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_ehe008.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1136
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0F060D80AFA465D6DE84D4FB2D171DBF E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4648
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
C:\Users\Public\xxxBaG\POizRZ.exe"C:\Users\Public\xxxBaG\POizRZ.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59b4e0.rbs
- Size 7KB
- SHA256 8ba4903319884a4c8a928cfe27c192d22445cdd8e638dd0b23533647f2eaa1a3
- MD5 beb76ef0468930306ef1a5029f53107d
- SHA1 d8f28c01c5f78cd3a0d383c200f54b517daa8383
- SHA512 fe6e1d34486f0f8cc3716b1c2048fcfebb830e3a291dd8652967d9e5690c03567f9c495f110ed85f88b81b1cdbd2d59a6f36696f7a772b4bd255d3a9e8a67bfb
- SSDEEP 96:RRDgu0CfDaUU8U1CsThq/U8U1C6j4/xpThqjHsS56TWt8dWCKpljfzIjByy:RRACmzrIIVrI3CA3Kpa
- TLSH T108F13001B31196D2E9911B75CB831B1637F2D3DAA720735B089E80785F573883EE67AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\xxxBaG\POizRZ.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\xxxBaG\UxEnhance64.dll
- Size 3.1MB
- SHA256 83b042a0a24cd786a8a85a46fb7ce62c05e95dd50f46506a59841c2ece3aa6a9
- MD5 48f14cc688d0a5cebb9ef06a11c35271
- SHA1 8d01435a84afcfd6214ecf117f215f3f70bfb409
- SHA512 17b9af03ca85eaf9da882bf6829a75096bff8ffcd4ccc3f1943ad7ed9d10db12a6a727779c84325b2eeb4587987f8034070e8a20b4fd47112fa920cf34f63e47
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+p:P9m29xx3Tiqt06ox6+z2rNNrKop
- TLSH T107E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\xxxBaG\adoresd.dat
- Size 4.7MB
- SHA256 fd5a7a8242d0635f3673455a99b00cd67c47e64ca42734eaa2445ad9602b1b07
- MD5 63489569ea60016cb857588a1bceb037
- SHA1 fa58450f143455c90bcc3d732306b7f739fce3bf
- SHA512 4f6c81ae3162b804442dbf8f61e91c50bbd54a8603b5562aa7b78b0b75dcfefc63b22e5b7a3c8652ac54143c23e9675affe84eb4c1781deb97c128459f685c6c
- SSDEEP 98304:mmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:9u1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1633633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\xxxBaG\msadox.tb
- Size 8KB
- SHA256 4af0b5e7fd4ce63839d78267f2f37b99e3616b5a0fe397fd571329c24357a06d
- MD5 1a326b43224c566bbc03b321d816e539
- SHA1 dda28ef328b7f11c18abf6a243d7b39f6f34f756
- SHA512 b7264f0994cd476b27a913a9618b2eb2dd279af4fcc3d408c2a951fffc92e33214cf0aeb1993e955bfe45326336704241d48f4a79ec523383cf29099117892ed
- SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
- TLSH T15A029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBB97.tmp
- Size 5.9MB
- SHA256 2f8b6c5e032d4c5bd4b81da9657562e1d68a517cefe9cf9700f0a95289bdf1e9
- MD5 bc06b463a0903283607eea26f1f18f0e
- SHA1 88e0de56b0f4996e407723a83582e33d78802df9
- SHA512 3fa39a3dd5d4dc1b51a72dd70967d0c666e84c2011960f5577da15105dd82c8813ace1872c2a050a4aea4831fabeb397b5be540b5f3bf57d9bb3929f451f47ca
- SSDEEP 98304:Ob0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDH:ObWNxG2T2s3uvDkhGuyuYBvFrG7I/yT
- TLSH T13D5633D16D853375D0AFC3B0464631DE722A37C47E9B9C0B39E4A7146F23B2A9876389
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59b4df.msi
- Size 5.9MB
- SHA256 afa3f8415f4d757d96d99385f0cc9b96469f0f29f14a8dcc15f22f665d053c78
- MD5 a33e46defc89a57d346e36383cbe4e7c
- SHA1 350d03d5fb8d862f43a254303ac171a63a3ee42e
- SHA512 f46dac405571f440f313feac4eebbeceabd9f69f87f85fd61d66e2a693bc27f8f0dcb755af3a04724bee3d634d4c12a6f7aa95c6567c8334127be00774ded680
- SSDEEP 98304:bb0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDz:bbWNxG2T2s3uvDkhGuyuYBvFrG7I/y3
- TLSH T1465633D17D852375C09FC3B14656319E722A3FC47E9B9C0B39E4B7142A33B2998B6389
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 13c2f6d59bc9d03b7dc9e65f575af0d48be8db2d34ac63e34e91791e16048f17
- MD5 3ad8a7f626c8df778bbe31c7a94dd468
- SHA1 3717fee9e1b7b3b3d8c1af49a83e00d7378631e7
- SHA512 fc8880335a344c72bf488940235d7f4b61a19f6b3c31235d08bed57fc4e126b4ce9e8cea7ee520e6fe8416043849ee5dffc2b58646a48a4a712d21e1fa6fd5c6
- SSDEEP 24576:DFo3DMPHdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:JHU
- TLSH T1BC57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{13ad435e-ae1f-4d8a-8265-ab884bca0a13}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e9841abf8bf5d3940e6ead7244ec26f9130e7c15363db0b67615ed67f6cd6643
- MD5 f17bf7ce723c67017f738788b78f3843
- SHA1 c07f54c6820926ab321ea33d0189096d5f2274c5
- SHA512 eccf2e65d6e59843445507795418866b6bf33ad673a82d2975be5a626fac34557e1434319a83fab5e314f16ce38df96ba60f1e986f99252eb8f5cc0a72f1c732
- SSDEEP 96:F2tNx7FCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:YPjeb++uVm
- TLSH T1FDD1890C1AE54711E2B3AB3129F14557A877B811EF33CB8E0198238E2631A10F936F6F
- MD5 SHA1 SHA512 SSDEEP TLSH