Overview

overview

7

Static

static

1

7f30259d72...a0.msi

windows10-2004-x64

7

7f30259d72...a0.msi

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/08/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0.msi
  • Size 108.8MB
  • Sample260805-xaeakaej2y
  • SHA256 7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4592
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2500
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 06A215FB3D047357BBCC9D11B32D3EA6
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1084
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0D0E3BA6EFD01C00C2BD4B6E703F9684 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1876
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
          "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:3656
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1540
  • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
      "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      PID:3960
    • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
      "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      PID:3108
  • C:\Program Files (x86)\ITarian\Endpoint Manager\ItsmRsp.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\ItsmRsp.exe" -service
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:332
  • C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2884
  • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4776

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Installer Packages

        1
        T1546.016

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Installer Packages

        1
        T1546.016

        Defense Evasion

        Modify Registry

        1
        T1112

        System Binary Proxy Execution

        1
        T1218

        Msiexec

        1
        T1218.007

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e588a4a.rbs
        • Path C:\Config.Msi\e588a4a.rbs
        • Size 731KB
        • SHA256 1c2f4321411fb0503ee61a91f780d00a1889b5b23aa8dbe18722968c2cf60285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApplicationManagement.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ApplicationManagement.dll
        • Size 106KB
        • SHA256 d1275a073c050358df531f5befebde1a52c3c82085b166d047ce6888bf588816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ITSMAgent.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
        • Size 3.0MB
        • SHA256 e3f003a412f0a1912287d438438bb6a251e2249b92c2d0c930a283fbb02b3d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ITSMService.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
        • Size 10.4MB
        • SHA256 d3d8c52a6b7a036068fe88e0a1944010a4195bbdda651daa7fb6b62b5d65bfcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ItsmRsp.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ItsmRsp.exe
        • Size 1.6MB
        • SHA256 a5c53842c372ed608bed23cf9a782675717a22b5bdbfba1feb2dc195202beb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zip-safe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe
        • Size 2B
        • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
        • MD5 SHA1 SHA512
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Core.dll
        • Size 5.4MB
        • SHA256 50e613eecb07d7454576b96092707297c36229f79aa8a70423bba3e2a8065874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Gui.dll
        • Size 6.1MB
        • SHA256 a69d7ca6dbd00fbd68c2eda3d9d078ff1a8d39b2083d1ed15f1068f946368075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Network.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Network.dll
        • Size 1.0MB
        • SHA256 fae75f886351e17a8a1b2fef881b6c3a9c9dfdf63bb867e1ec311a37ecba9334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Sql.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Sql.dll
        • Size 178KB
        • SHA256 c45d93f5476c9b5f24ac7ae3c1f452d1957d46487073f002b1aed1aa5cab8526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Widgets.dll
        • Size 4.5MB
        • SHA256 ca6b376b88f93c8bd08ee3da6c6224d2df9ae68a4845387597108adacd33c55a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Xml.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Xml.dll
        • Size 179KB
        • SHA256 9fb3d9f0e231ad1d32a79db1211f3f478cdac2efbbc729c30cb65a68fe35c5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RmmService.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
        • Size 4.4MB
        • SHA256 6f2ddf022aecfd75bbb8ea35c957360c0015e5b2792317288f0d15c686a5a441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\libcrypto-1_1.dll
        • Size 2.5MB
        • SHA256 a03e71ce87054a7fe40b995d5ec892c3b970757cedb3eb9b858ac3134d3a45d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\libcurl.dll
        • Size 643KB
        • SHA256 519bbe3256ebd2da5631a7f74352562988f3a5124566f548e1e08a1b8bc9f58c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\libssl-1_1.dll
        • Size 543KB
        • SHA256 7d6638b7bd0c2f4d067eacfe34a090606301fb5a4453414ce101b6d6d8f09bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log4cplusU.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\log4cplusU.dll
        • Size 903KB
        • SHA256 3efffc4ee1586ef0b6489b0a73c83e97a77260b7ef0ca6a4650ab4011a9f4367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\msvcp140.dll
        • Size 427KB
        • SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\msvcp140_1.dll
        • Size 22KB
        • SHA256 f0fb70b0801432a89ebcc301f289c78ffb6d3f06bfb691a5782d7a309d1386c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python_x86_Lib.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
        • Size 7.2MB
        • SHA256 11868ca3fcaf7c138ada700da02b0ca79d49a16579938a42bdde1147b27185a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qdjango-db0.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\qdjango-db0.dll
        • Size 155KB
        • SHA256 a62388619b489af27bd6dbb5b6f0ab184a565ccf9777527002135e7040a21752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmmproxy.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\rmmproxy.dll
        • Size 139KB
        • SHA256 3934cfb040e6e0887517be1df5730f5b05349f2816c837b299d1c9ae03088719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\vcruntime140.dll
        • Size 75KB
        • SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
        • Size 765B
        • SHA256 66ddaa2b874361baf0efa512ae3518b55d9ea6587e2468a079d09d1ec7f310b5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        3AA0DCD5A74331FBD6F344550EC48B87_C380AB527C27A2B33D5223FDA2D99FC3
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_C380AB527C27A2B33D5223FDA2D99FC3
        • Size 638B
        • SHA256 16f325390f6282c6a817cc8d5dafe1437f8b21645672eec62a25b18af3cfa3bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Size 1KB
        • SHA256 a0d6ce27684a757d37eab3719f249b191a0479b5e63a1ec2be4bd6779ff85ad4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
        • Size 484B
        • SHA256 6725e27c0bc1c9aae3a4596caded0e3e98df3b09ac21c28e2672a2158840cd92
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        3AA0DCD5A74331FBD6F344550EC48B87_C380AB527C27A2B33D5223FDA2D99FC3
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_C380AB527C27A2B33D5223FDA2D99FC3
        • Size 476B
        • SHA256 964951d07ce60ad817877720aee0744cbe3020e25df8af9041c52946ed8cdb73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Size 482B
        • SHA256 555c62bb7d1f80d1d42cbb2e9e4463bf66ea915d8a901be1dbbe01a2d3f512c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7ZSfx000.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
        • Size 228B
        • SHA256 e2cdd1993e117f75ecd7833a86becccc3ecee73d8afd7197971acac88408c4d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI8C9B.tmp
        • Path C:\Windows\Installer\MSI8C9B.tmp
        • Size 302KB
        • SHA256 ab1015bd5f858cd5bcc97bf43ea47af0680878e8aadf9996cd87bcbfff4f8f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI951A.tmp
        • Path C:\Windows\Installer\MSI951A.tmp
        • Size 203KB
        • SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 4e68744072e0bb61c9a907a6c30fc69901ebc45c6015134996921b1a03ff7cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {3d99f9ff-90ee-40d6-9a28-cc63ed01ceae}_OnDiskSnapshotProp
        • Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3d99f9ff-90ee-40d6-9a28-cc63ed01ceae}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 08b7518ca2d1203135d0fc9b349f816f0b676c40b38907cc334d89f4be4d72a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download