Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_m3us019.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_m3us019.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target install_m3us019.msi
- Size 9.2MB
- Sample260804-w1xddsxcme
- SHA256 fcfc5b3561c05b96887295793decab5669348167aab7531ac21a27bbc2642eeb
- MD5 eb03fff9a76b1521daecd8f0ae7c686a
- SHA1 e7ca6f2d977b4bfde144e353b3b26ac5824fe37b
- SHA512 4305defa143527467777873c56a16d0fe2e35130c525261099805b4d1b7eb940048d2af178d1891364058516f329c0bc778aca474b0f40c84c7c3ac5099f6731
- SSDEEP 196608:LWkuipiG1B6A3AAuxYYDKDvyi2tHmXB4yKIG1UfreiaPxK8dSTMj2dD1:K9eB60nuxEq4XBZHXfrBW0/dp
- TLSH T10CA633D53E867B74C047C7B09443622C722D3FE6BA76AC162A897B016D3763E97B1348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2540 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 50 2540 MsiExec.exe 73 2540 MsiExec.exe 84 2540 MsiExec.exe 91 2540 MsiExec.exe 94 2540 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e585c15.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File opened for modification C:\Windows\Installer\MSI5D4E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5E49.tmp msiexec.exe File created C:\Windows\Installer\e585c15.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4748 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4740 msiexec.exe 4740 msiexec.exe 2540 MsiExec.exe 2540 MsiExec.exe 2540 MsiExec.exe 2540 MsiExec.exe 2540 MsiExec.exe 2540 MsiExec.exe 2540 MsiExec.exe 2540 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 4748 msiexec.exe Token: SeIncreaseQuotaPrivilege 4748 msiexec.exe Token: SeSecurityPrivilege 4740 msiexec.exe Token: SeCreateTokenPrivilege 4748 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4748 msiexec.exe Token: SeLockMemoryPrivilege 4748 msiexec.exe Token: SeIncreaseQuotaPrivilege 4748 msiexec.exe Token: SeMachineAccountPrivilege 4748 msiexec.exe Token: SeTcbPrivilege 4748 msiexec.exe Token: SeSecurityPrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeLoadDriverPrivilege 4748 msiexec.exe Token: SeSystemProfilePrivilege 4748 msiexec.exe Token: SeSystemtimePrivilege 4748 msiexec.exe Token: SeProfSingleProcessPrivilege 4748 msiexec.exe Token: SeIncBasePriorityPrivilege 4748 msiexec.exe Token: SeCreatePagefilePrivilege 4748 msiexec.exe Token: SeCreatePermanentPrivilege 4748 msiexec.exe Token: SeBackupPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeShutdownPrivilege 4748 msiexec.exe Token: SeDebugPrivilege 4748 msiexec.exe Token: SeAuditPrivilege 4748 msiexec.exe Token: SeSystemEnvironmentPrivilege 4748 msiexec.exe Token: SeChangeNotifyPrivilege 4748 msiexec.exe Token: SeRemoteShutdownPrivilege 4748 msiexec.exe Token: SeUndockPrivilege 4748 msiexec.exe Token: SeSyncAgentPrivilege 4748 msiexec.exe Token: SeEnableDelegationPrivilege 4748 msiexec.exe Token: SeManageVolumePrivilege 4748 msiexec.exe Token: SeImpersonatePrivilege 4748 msiexec.exe Token: SeCreateGlobalPrivilege 4748 msiexec.exe Token: SeBackupPrivilege 4964 vssvc.exe Token: SeRestorePrivilege 4964 vssvc.exe Token: SeAuditPrivilege 4964 vssvc.exe Token: SeBackupPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeBackupPrivilege 3968 srtasks.exe Token: SeRestorePrivilege 3968 srtasks.exe Token: SeSecurityPrivilege 3968 srtasks.exe Token: SeTakeOwnershipPrivilege 3968 srtasks.exe Token: SeBackupPrivilege 3968 srtasks.exe Token: SeRestorePrivilege 3968 srtasks.exe Token: SeSecurityPrivilege 3968 srtasks.exe Token: SeTakeOwnershipPrivilege 3968 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4748 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4740 wrote to memory of 3968 4740 msiexec.exe 102 PID 4740 wrote to memory of 2540 4740 msiexec.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_m3us019.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4748
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 19F0F18F7EE530DDD1B766CA2E9D17DC E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2540
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI5E49.tmp
- Size 9.2MB
- SHA256 c9517eee0ef16e6f519d779057361ad664ed7f2c7419b1b270ff3d545be82bb8
- MD5 d5f4ad8289d1a49df00595fc12035679
- SHA1 db5a99f089c5314952c47bbd463e10a88dc58ec2
- SHA512 9c18734dae75b371f5aad3259e8b49d5a44cf8fb1592bacc33e7c4608dd64ec2ad65136c357b6e5c691e6aeeb5767b058288d51b89ec287177cffbcec9731525
- SSDEEP 196608:SWkuipiG1B6A3AAuxYYDKDv8i2tHmXB4yKIG1UfreiaPxK8dSTM82dDp:Z9eB60nuxE04XBZHXfrBW0MdV
- TLSH T131A633D52E867778C047C7B0A483712C723D3BE6BA76AC167A8C5B019D3762E97B1348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 20a4ad551f4c6bc41e488052cd08ceec9f5825a578c5ae80610ca32db5bdd346
- MD5 7fd7e3e857c6296cc921f6084686ced5
- SHA1 58c4501d0b9866e3a021b1f3830a3a2235824d47
- SHA512 1963765544844efdfa8ba11c33df3882da79ce6806304fc9ec6a6cea42fd89884e36248ebb87cd10eadefc6faea81fe2b9b1dd362c5013948e27f40afa550592
- SSDEEP 24576:bu8m+1zvdoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:/
- TLSH T12447C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{00367c7a-404b-494e-9025-e5d298faaa3b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1bef291e6f1163118918ebdaa257b5805e7af6883be19364640a7aa44a3d9799
- MD5 b8aff47241da1c368080def31070c96e
- SHA1 dcfce7e983bf460786325d31d2a0079afda56a28
- SHA512 32f278078846643d9846c6045ab10fbf7a5b1acce446aa10c38507f5992bcbb3126145533389648d31e7ad2715df52d495ff38f90a6b939025071d3210e4ff0e
- SSDEEP 96:FfD6c1snvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:JD8b++ZVm
- TLSH T195D199084AE54711E2B3AB3229F54557A877B911EF33CB8E0298238E6670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH