ad7396d0efca6d14b654bc0ba10506e46a4839613fbc63a4628db57d1910d699

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_9x.exe
Size 6.1MB
Sample260804-eq7myavyat
SHA256 ad7396d0efca6d14b654bc0ba10506e46a4839613fbc63a4628db57d1910d699
MD5 5c659412d36802243ea2e63e930f2084
SHA1 361e6a3d4d29253d39596936e5afa026ff7b5690
SHA512 88ef47a0f0f36ea6fc4b91879f2be65d7ce9b2b15c362fcd2a5b7735f1b2efe9c8d7e226310a233e24846802444efbf36acf942cb78a60dac41cb6aecc74a689
SSDEEP 196608:fHqfGMkASVqV26hgDneS+lrHNQicHkRYa3MniY8I:iuMkqE5AtQiZ1m
TLSH
T16256CE30BD92ACDEC3A280B510D9276F40EDE5D639B06D6DB6BD36C112C68E3D1A6385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4636	IDriver.exe

Loads dropped DLL 12 IoCs

pid	Process
608	MsiExec.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe
4636	IDriver.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	1824	msiexec.exe
10	1824	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	IDriver.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	IDriver.exe
File opened (read-only)	\??\N:	IDriver.exe
File opened (read-only)	\??\U:	IDriver.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	IDriver.exe
File opened (read-only)	\??\V:	IDriver.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	IDriver.exe
File opened (read-only)	\??\Q:	IDriver.exe
File opened (read-only)	\??\S:	IDriver.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	IDriver.exe
File opened (read-only)	\??\X:	IDriver.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	IDriver.exe
File opened (read-only)	\??\K:	IDriver.exe
File opened (read-only)	\??\I:	IDriver.exe
File opened (read-only)	\??\O:	IDriver.exe
File opened (read-only)	\??\R:	IDriver.exe
File opened (read-only)	\??\T:	IDriver.exe
File opened (read-only)	\??\Y:	IDriver.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	IDriver.exe
File opened (read-only)	\??\H:	IDriver.exe
File opened (read-only)	\??\J:	IDriver.exe
File opened (read-only)	\??\W:	IDriver.exe
File opened (read-only)	\??\Z:	IDriver.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\iGdiCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IUserCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IScrCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\objpscnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver2.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ID	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58a38e.msi	msiexec.exe
File created	C:\Windows\Installer\e58a38f.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a38e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a38f.mst	msiexec.exe
File created	C:\Windows\Installer\SourceHash{790EC520-CCCC-4810-A0FE-061633204CE4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA92C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_9x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D354A092-4A8E-4077-A738-8314F6BA0DE6}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30350C57-F1F4-4ADC-9ECB-FA66FD8A3BE6}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11997148-EAEB-42A2-B3CC-B7C5A7199107}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1DE0B0AC-D65A-4B47-B4E4-37C8E065D9A1}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{46715E70-0B7D-45BA-A447-AA0951073C78}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44D68E56-4A11-4C14-806B-083FFA62767C}\ = "ISetupOpTypes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD549FD5-6590-4F67-B60E-E7422ADAF1B3}\ = "ISetupScriptError"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6FCE0140-F00D-4466-80E3-07992FEB65C9}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DAFAF854-1BF8-4DE1-8F96-752839422F73}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{28CD926D-C061-47FC-A3F2-6A9E11133F7C}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F31ADE0D-9319-4067-829A-107D25C1C131}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06FC2BEF-62EE-4724-8FEB-64C73B939BA3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8919C3B9-E8FF-43A7-86B3-FA09E0201947}\ = "ISetupSDMessage"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46715E70-0B7D-45BA-A447-AA0951073C78}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8E161B8-9B5A-4DD2-9B93-1F558A7FAD69}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8F814097-CE38-493E-BFCC-CB3599998D05}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ABC466D7-B7AD-4872-8C72-ED582EF279CE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566BECBB-A8DF-43EA-8D44-77BCC7B72F21}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A351BCFD-F07F-48CB-91A0-AF69317D9D6D}\NumMethods\ = "5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC892E93-C765-4E5B-AE0C-BA2476655532}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0AA8743E-3991-438C-8631-3C8C169399E6}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFB69D-57BB-4963-AFA8-09FA9614E1CB}\ = "ISetupShell"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5886B1FD-4C9E-41DF-9098-9A1AB8F02AA9}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD889BE8-F7D6-415F-84B6-B17CCCB29A6D}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FE20-27D3-4F38-8DF3-93659038C417}\ = "IInstallDriverStringTable"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D354A092-4A8E-4077-A738-8314F6BA0DE6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EDF81340-0BD9-40B7-825C-29AEE7A64D4E}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F814097-CE38-493E-BFCC-CB3599998D05}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AF21D406-D32C-4413-81CE-B9AF860E1361}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF21D406-D32C-4413-81CE-B9AF860E1361}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{293B98DF-5B92-42D2-A409-FA9A0C0E1E68}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B8E161B8-9B5A-4DD2-9B93-1F558A7FAD69}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F74B51C-963F-420E-90FA-FD96FA7712DC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E4FB44E-D416-4243-B811-8E116F9CE39A}\NumMethods\ = "6"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{06FC2BEF-62EE-4724-8FEB-64C73B939BA3}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FF9F015D-973A-47E9-8857-EFBD6C08A318}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BC859C55-34D2-43CE-A4B7-8AB67768B386}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{22E4EB97-C4B0-4EE7-88AE-5E3502EA7831}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92CF8A76-F5BE-4284-9F78-EC7E40508E74}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{96EDAA2C-E90A-4ABA-AC0D-9226B8B3AB79}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{44D68E56-4A11-4C14-806B-083FFA62767C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{184C53CC-8D6D-4A58-8108-90167678B84C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CD549FD5-6590-4F67-B60E-E7422ADAF1B3}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAD11E89-6394-4747-A64E-634E4FF7DDDA}\ = "ISetupWizardUI"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2057FC3B-B6A8-4669-B49B-393B0B0193A9}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F26F1EB5-850C-4AF9-BAFD-F388686C21B5}\ = "ISetupLogDB"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5CDB19F-95A7-4DFC-A65F-D01CB17BDAA2}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1E4FB44E-D416-4243-B811-8E116F9CE39A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99438BE3-EA31-4C13-85FD-FEB81A61AB34}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0624352B-E86A-48B9-B23D-D4BEDA6DF1D9}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE238E7E-00DB-4349-9949-2A10E52A6F68}\ = "ISetupShellLink2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FE238E7E-00DB-4349-9949-2A10E52A6F68}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39BB147B-55CC-424B-9B10-C5052E5939B9}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F45426-4ECC-4E2F-A2AD-3424A424B336}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DE0B0AC-D65A-4B47-B4E4-37C8E065D9A1}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE02E74A-C645-4C6E-BD1C-4099501A9F52}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52305DC4-1B79-41CE-90D0-0B84AF096018}\ = "ISetupTransfer"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FC892E93-C765-4E5B-AE0C-BA2476655532}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E30AE6C-8796-4207-968E-FAEFC5DD1818}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1F74B51C-963F-420E-90FA-FD96FA7712DC}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FA5380BC-76C8-4AD6-A4C4-6F6CB5F32CAE}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{96EDAA2C-E90A-4ABA-AC0D-9226B8B3AB79}\TypeLib	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1824	msiexec.exe
1824	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4112	setup_9x.exe
Token: SeIncreaseQuotaPrivilege	4112	setup_9x.exe
Token: SeSecurityPrivilege	1824	msiexec.exe
Token: SeCreateTokenPrivilege	4112	setup_9x.exe
Token: SeAssignPrimaryTokenPrivilege	4112	setup_9x.exe
Token: SeLockMemoryPrivilege	4112	setup_9x.exe
Token: SeIncreaseQuotaPrivilege	4112	setup_9x.exe
Token: SeMachineAccountPrivilege	4112	setup_9x.exe
Token: SeTcbPrivilege	4112	setup_9x.exe
Token: SeSecurityPrivilege	4112	setup_9x.exe
Token: SeTakeOwnershipPrivilege	4112	setup_9x.exe
Token: SeLoadDriverPrivilege	4112	setup_9x.exe
Token: SeSystemProfilePrivilege	4112	setup_9x.exe
Token: SeSystemtimePrivilege	4112	setup_9x.exe
Token: SeProfSingleProcessPrivilege	4112	setup_9x.exe
Token: SeIncBasePriorityPrivilege	4112	setup_9x.exe
Token: SeCreatePagefilePrivilege	4112	setup_9x.exe
Token: SeCreatePermanentPrivilege	4112	setup_9x.exe
Token: SeBackupPrivilege	4112	setup_9x.exe
Token: SeRestorePrivilege	4112	setup_9x.exe
Token: SeShutdownPrivilege	4112	setup_9x.exe
Token: SeDebugPrivilege	4112	setup_9x.exe
Token: SeAuditPrivilege	4112	setup_9x.exe
Token: SeSystemEnvironmentPrivilege	4112	setup_9x.exe
Token: SeChangeNotifyPrivilege	4112	setup_9x.exe
Token: SeRemoteShutdownPrivilege	4112	setup_9x.exe
Token: SeUndockPrivilege	4112	setup_9x.exe
Token: SeSyncAgentPrivilege	4112	setup_9x.exe
Token: SeEnableDelegationPrivilege	4112	setup_9x.exe
Token: SeManageVolumePrivilege	4112	setup_9x.exe
Token: SeImpersonatePrivilege	4112	setup_9x.exe
Token: SeCreateGlobalPrivilege	4112	setup_9x.exe
Token: SeRestorePrivilege	1824	msiexec.exe
Token: SeTakeOwnershipPrivilege	1824	msiexec.exe
Token: SeRestorePrivilege	1824	msiexec.exe
Token: SeTakeOwnershipPrivilege	1824	msiexec.exe
Token: SeRestorePrivilege	1824	msiexec.exe
Token: SeTakeOwnershipPrivilege	1824	msiexec.exe
Token: SeRestorePrivilege	1824	msiexec.exe
Token: SeTakeOwnershipPrivilege	1824	msiexec.exe
Token: SeCreateTokenPrivilege	4636	IDriver.exe
Token: SeAssignPrimaryTokenPrivilege	4636	IDriver.exe
Token: SeLockMemoryPrivilege	4636	IDriver.exe
Token: SeIncreaseQuotaPrivilege	4636	IDriver.exe
Token: SeMachineAccountPrivilege	4636	IDriver.exe
Token: SeTcbPrivilege	4636	IDriver.exe
Token: SeSecurityPrivilege	4636	IDriver.exe
Token: SeTakeOwnershipPrivilege	4636	IDriver.exe
Token: SeLoadDriverPrivilege	4636	IDriver.exe
Token: SeSystemProfilePrivilege	4636	IDriver.exe
Token: SeSystemtimePrivilege	4636	IDriver.exe
Token: SeProfSingleProcessPrivilege	4636	IDriver.exe
Token: SeIncBasePriorityPrivilege	4636	IDriver.exe
Token: SeCreatePagefilePrivilege	4636	IDriver.exe
Token: SeCreatePermanentPrivilege	4636	IDriver.exe
Token: SeBackupPrivilege	4636	IDriver.exe
Token: SeRestorePrivilege	4636	IDriver.exe
Token: SeShutdownPrivilege	4636	IDriver.exe
Token: SeDebugPrivilege	4636	IDriver.exe
Token: SeAuditPrivilege	4636	IDriver.exe
Token: SeSystemEnvironmentPrivilege	4636	IDriver.exe
Token: SeChangeNotifyPrivilege	4636	IDriver.exe
Token: SeRemoteShutdownPrivilege	4636	IDriver.exe
Token: SeUndockPrivilege	4636	IDriver.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 608	1824	msiexec.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\setup_9x.exe
"C:\Users\Admin\AppData\Local\Temp\setup_9x.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 72AF55811E4675BF1C79BE51FE49458D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:608

C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2704

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a392.rbs

Path C:\Config.Msi\e58a392.rbs
Size 51KB
SHA256 ba6af36248569a8c3a2f6c61581aef24a3394837cb3f1a0412cd5e1ec6438c14
MD5 b3f99f3a7042e259dfbe5d97cbc3fee2
SHA1 64fef6981f41a4c516fc8b9ec488f403074a1c5b
SHA512 1acde404436e6f020f0b4c2e6d98fbe797acbdcbce6c3fc5a10a433c9999357ca87651f6eaeef060e6cb2d8fcddfc92b70e89aeeb339316c35b342d4cd99bde7
SSDEEP 1536:c3cc5WWMmRJu/xtispnu/ZmAxq3A+ESAaYmAiBLH6slri97HkvvXRTisHBczayH4:IcGWWMmRJu/xtispnu/ZRxqw+E1aYRi/
TLSH
T1CD339F86684212EAE905033013637D686ADFB42E0DC6D60D052AE5EF5D7BBFDE841FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDriver.exe

Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
Size 744KB
SHA256 e398cb00486e49de8f3dfa278cce395fd4c02a4795fb61b2e73653cbcdb75eea
MD5 5e73b8fb3ddbba8565d9c4705c14ba3d
SHA1 ffce57f44298ebfea425f42696227054d5c5cd0b
SHA512 8bc0261c0a92d9caa76ec90583ea01a4ab743a084f0e4e0f6debdaf0bfdc252d95d6929e3ec66be5ad95ae593685fb50da2b9be0a1d457b8acb7c137e3cdab79
SSDEEP 12288:IpTvNjWfXBINq82NwfN2LdV98XErOKqfref8/2W:IpTvtqXBIw826fNOl8XECKqP
TLSH
T1FFF47C3A36A1C13AC61205319E69C7E4EEB9FD368D2305073B847B1D3E75996CD13A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IScrCnv.dll

Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IScrCnv.dll
Size 256KB
SHA256 02a761aa2c05fe1b3f95284557bd55ac9d6a82ab72a18de70dac1820c6f03751
MD5 926a5bfcf2173b178a4d080d47efbf2a
SHA1 c24a62c2b26e12879a9c013c3d0b8054828e8ac5
SHA512 4a5fe52827068e9852e65a5570c105b183fa35dba342e715850ada258cb440b033dcc47047b59eac83401d9690979f661c77200fae0ea69a9944558b5265b1b3
SSDEEP 3072:WkP5rmx6IWkNtEXrSHGWJil+2b4+gRCP726+681eunwb4NohWGFVbotBJuJ4mcB2:QNaocU/U26+6duI4qhpFVAT1DETzjf
TLSH
T15D447C123DA8C936C7DE0B31FEAA6F28E2F9E2119DE588431F584E1DDE37905C92151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iGdiCnv.dll

Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iGdiCnv.dll
Size 176KB
SHA256 aa86d6fa20a0be2d41aec48a47b5d94f316acb4c4b7d8c6054d9988b27d108d7
MD5 771bd5c8b8f219f5d9af0cb1a406a399
SHA1 1ded7e1eaeba25961aca784174f05755f6770a31
SHA512 5c843ddfee3a808bf4ba189243cda130557d7527416636a00586818ffa73b941fb0a34024966fb3316f6c913e73f2615927606258288dbb821736aeb645cfd39
SSDEEP 3072:pG+GfAt5bvgO8THIu7LU0P1UmaVHhXRuh8BZmBcbvcJMmcpLaSYE:pG+GJ7L1aVHCyA+HzYE
TLSH
T16904AE0475E0843BC39F0136BABB2F75F7FC65118F9909AB97084E5E1EB5986DA23207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iusercnv.dll

Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iusercnv.dll
Size 168KB
SHA256 820a03405d4a7a0ddc20f7be3c79266d1bbc6a7778c791c6de260ac9c51e77ec
MD5 07096e9f097b44b3c24c15a6724de866
SHA1 a4cd6828554e295d0758ef2e35e35b0569afd44a
SHA512 2f3e7ce2b0d51100b2a61b5b0d4a3b5434095a411f92360818a0e3926d6203e85ec2b54d4a5ac01405aeaf1a570dc1d5a088f1654210d7cdbacae5b566092e6e
SSDEEP 3072:GDB8FBASHiVRVwPs2DMaEJ39aHwJdMcnS:K84SCR8sMfExQub
TLSH
T160F3AF033EE1C87AD28A017F5D292F3AB3FBA127CEE058934B184A5DAE71951CD27156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISRT.DLL

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.DLL
Size 400KB
SHA256 dce057a7eeea266a1cbc630505d08eed458284b30e25dab4f7c7ae142835b660
MD5 22ee6fa7a604a5e7298acd95bc7c80f7
SHA1 31e6809bd9929b594d087b7cac8558b8117484c9
SHA512 3e13f7e2032228f1d6a84566b49cb5aa6845ee9bcc83d350eba382492db19c3cdeac8ab75ea285b1b1f285c373fc829a2c9571b0b64e22c216470875458a56a5
SSDEEP 6144:9IZCfF6pJASHMvaFs5voS7ClvGDwkfAZWl90gH1JOh3ImQyXqhDj7OnQ:9IZCfF3SHOaFs5voS6kIWl99Rmr0jcQ
TLSH
T177948D02F6F2C07BC29F0130FB696BE5A7FC57551C719887DF940A1E1B72986D226A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISRES1033.DLL

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.DLL
Size 528KB
SHA256 14d8231e716b79e66d2ef1a971f74ff6244af0c89717977e7131e7cf7de2072b
MD5 8f287079d126ad3b2487d704844ce497
SHA1 c42c7b96714750c497ae9bc2a4d4c64141ea7058
SHA512 f56e39852fb60ce94a7040644c5368cb15110b56e5b774edea14c4f2286d2087191276b4af860b320fe875f72f8df5214457ea12a7152e419b8848e578ffff54
SSDEEP 6144:yhs4dodcOaOdFGkdlbskkkkknffCp5CrRKluat+HLPKq:Is4dodfaOdIQxq4LH
TLSH
T1E2B48200E6E5804EF2FEAB749CB21BA54EA13C569B3486FFBA95711D1471AD09C31F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

objpscnv.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\objpscnv.dll
Size 32KB
SHA256 dbe6d61dbd15894aa2a304d36c2a6ec0e8e3e78438df35124ba2bd58df9e6e6a
MD5 3f84ebead9f9dbbaeb27bac67e585c17
SHA1 87ec9c20274e6b48e75fd0e3e12df0bdc263d1dd
SHA512 4a64a0d9fc37f96a045652c67f48fdc943ccd4b84c6c81dc9571ed20105ca7e8bbbe4a46c849d9fa6d9e27c04254de85a044e1a8e8be7ba1ac0bb4f2e6ed8fe9
SSDEEP 192:XnlX6cRWMxG4RMG180GoxMOSkF7qoMC7znk4Al:33B5MczZqoMqgB
TLSH
T14AE25412EEB699B1E68A40353C761577663D3C3148D9E073ABC2DD4E287D2E3856EB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB85E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB85E.tmp
Size 108KB
SHA256 48fde6fb1eb73eb9b4b5ee7ac964bb5400e6561876d1ff8ff332c9afa24ec8a3
MD5 da74dad4b2621fce038d858fa2e6d15d
SHA1 e07c21fde627943e18bee42ebabf0e39546e2221
SHA512 dadafcdb82467b458f1d9a88be02e441b544f5719bb4ab15c9492860ded4cff74a9d78625d1ce42685d65f36506f9a8c7ac40a0f4697f57f6d02a735b9aedecf
SSDEEP 1536:YiKtbjfNw4MMz6XEAWDooVSx1KMqATT7zh1XPNjAIbJeLcj5xzy:9QvNw4MMzxx2LHA4JeLcVxzy
TLSH
T175B38D06BAE1C0B3D3C9413E5966CB39E7BF6A709DA15CC3AB640B8E6D71940D637243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\_is7338\0x0409.ini
Size 5KB
SHA256 43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282
MD5 6c87581375d4e4789761b9833c2a1b4d
SHA1 310395fde36429b08b615831152399db7e4267a2
SHA512 ff499900dd9ae154825bb1b8a65f7c53367a4a75131ce1aa08ffbd0bbaae4d8e3a062455d74b8dce41fc89648bed33fb2ecd95e7ba57098caa7ca652f176dfd2
SSDEEP 96:VXoB2MQrl8/T3INLfRtMx76U0KOFWgVl2Uub0QAg80SbtEBapIx0KsLK3C0cTBAj:JFYT3wLfRA0viBAvCSEB9yC
TLSH
T1ADB1538F8B9A837E2951031AB15F2661F326926D5323D1B7B1EF00587283D18937B6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1033.MST

Path C:\Users\Admin\AppData\Local\Temp\_is7338\1033.MST
Size 3KB
SHA256 b8ad989084b14ee06240130a2190b9c383b06ba852a97f018b0117b4f384cc91
MD5 55b30b813b481db935f5931f668aee0a
SHA1 147acf134fdd9b14267bab6dc66f2d50dadeb6d6
SHA512 e5abddf66c0db895596d66924bbee7a8b2a5258a08aec0ef3d51c66e25f954552b063b53370a83723abd00960efd564ee51f56411c9021f87d2b0c45db7a2de0
TLSH
T106719C81BB61C66AE1444B714FA7C7544732FC94CDA1A30B75E5B70F9A311C82E52631
MD5 SHA1 SHA512 TLSH

Submit Download

CP2102_9xme.msi

Path C:\Users\Admin\AppData\Local\Temp\_is7338\CP2102_9xme.msi
Size 1.6MB
SHA256 4de39d38739b2d5d07d51d15c989f80dba7157b8e66b7448eaf3edec6942d36f
MD5 b72a0bf3495ffd454c84054a86214ca9
SHA1 3d754aaf13d4d3523093b01e5b4dddfbfef00eaf
SHA512 3fbdbecf012e5458499a7a49a344277908612c91a19d536ba3059cc4e064c66595d8adace3bbd9222fe4f31207e68b74dece2330968c39d4bf22449fa79ad503
SSDEEP 24576:tr3ZdDhX/rzwwBvfu9lUapeQmoL8QeZrlmReS:tr3LhnBvdZM
TLSH
T19275D611B7DA810EF2FEAB70DDB156A58FA27CD59A35C53E7694310D08B0A40DD22B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISScript10.Msi

Path C:\Users\Admin\AppData\Local\Temp\_is7338\ISScript10.Msi
Size 876KB
SHA256 76e1acaa795755548fccf95bf99590febb1474d70ef107c4ff589df77d65df4a
MD5 fad28d1e21acffd6f031e4e3c4a92b19
SHA1 9797fe366535cb3e32b7337cc5645496e8459a00
SHA512 39c0e19a059074f5a6ac659f4ff794c9c388b159c6952ecdd027eb0eab10784b9507f142a58782801439a1b36b625c300878f011e1c886b2eda7163454a22b71
SSDEEP 12288:L7T5Dy+j1Xla1usJQWmJMoOHfxuP2eZROQoYfe8B8b3flJH7jGPYUfAm68laciRd:L7l2+j1c1usJQWhfEP2AjyflJbYbdFa
TLSH
T1D315F11ABC82023BC687033516175B725FBB8C544F224A078779F39D2DB7AE872B65E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\_is7338\_ISMSIDEL.INI
Size 470B
SHA256 3db2bd4358bf3b49ec95f47df53c744093d59dd505e67494879860e6cc2314cd
MD5 4ac972233b89d953691ede9382169eb4
SHA1 0774cfedb527578b9b14fe2e9d4e3010d82e19b8
SHA512 b6a7e7e58bd103eb446f8540a571f7112924bdaa1db4aad4cbd7e110924158bed15a42478c646adb75c0f136bb023c921df4b47840646fa299fd3ae86352dd8f
TLSH
T1ABF09EE086C7CF2A1454A0676ABE665CC1A70C482F57AB50CB30D90919C5CA9FAD7276
MD5 SHA1 SHA512 TLSH

Submit Download

~7327.tmp

Path C:\Users\Admin\AppData\Local\Temp\~7327.tmp
Size 1KB
SHA256 fc827bcc7c5d809f18bf3f2066a56919e0ced85453edf11b438dffc4e5c780f9
MD5 37912a8e1f1b27c3b657147b16986742
SHA1 d6e29e85b4caa31f2f991e274e02499ae1df9523
SHA512 06324ca1acc0b9e9d80756af3d492e0e64f7521193428c828ab415626d37e8f622914b3eca32dd866a2baf640c57ce533a59de9cb39d6c8215184c37136e5cf8
TLSH
T13D41BB4536BB08ED931B71A76EF713C739D2216009167219E3484AE1CF9DA5B433F2B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4636-189-0x0000000003A30000-0x0000000003A5C000-memory.dmp

Download

memory/4636-198-0x0000000004650000-0x00000000046B6000-memory.dmp

Download

memory/4636-212-0x0000000005890000-0x00000000058BE000-memory.dmp

Download

memory/4636-206-0x0000000005800000-0x0000000005886000-memory.dmp

Download