Overview

overview

7

Static

static

1

7f30259d72...a0.msi

windows10-2004-x64

7

7f30259d72...a0.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0.msi
  • Size 108.8MB
  • Sample260805-xaeakaej2y
  • SHA256 7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5864
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4188
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A0200255E416BC924E0E95B6CF9995E2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3008
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BAF71F9BF42774A7492D9E067EFB724D E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5832
        • C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
          "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3612
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:3004
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1352
  • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
      "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      PID:1552
    • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
      "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      PID:5332
  • C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2900
  • C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2840
  • C:\Program Files (x86)\ITarian\Endpoint Manager\ItsmRsp.exe
    "C:\Program Files (x86)\ITarian\Endpoint Manager\ItsmRsp.exe" -service
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2784

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Installer Packages

        1
        T1546.016

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Installer Packages

        1
        T1546.016

        Defense Evasion

        Modify Registry

        1
        T1112

        System Binary Proxy Execution

        1
        T1218

        Msiexec

        1
        T1218.007

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e59c318.rbs
        • Path C:\Config.Msi\e59c318.rbs
        • Size 731KB
        • SHA256 78eb0bfc5f17e84f7302a0bd6dfea91f644c071d6024c3245fc93a98c209ec5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApplicationManagement.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ApplicationManagement.dll
        • Size 106KB
        • SHA256 d1275a073c050358df531f5befebde1a52c3c82085b166d047ce6888bf588816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ITSMAgent.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
        • Size 3.0MB
        • SHA256 e3f003a412f0a1912287d438438bb6a251e2249b92c2d0c930a283fbb02b3d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ITSMService.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
        • Size 10.4MB
        • SHA256 d3d8c52a6b7a036068fe88e0a1944010a4195bbdda651daa7fb6b62b5d65bfcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zip-safe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe
        • Size 2B
        • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
        • MD5 SHA1 SHA512
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Core.dll
        • Size 5.4MB
        • SHA256 50e613eecb07d7454576b96092707297c36229f79aa8a70423bba3e2a8065874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Gui.dll
        • Size 6.1MB
        • SHA256 a69d7ca6dbd00fbd68c2eda3d9d078ff1a8d39b2083d1ed15f1068f946368075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Network.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Network.dll
        • Size 1.0MB
        • SHA256 fae75f886351e17a8a1b2fef881b6c3a9c9dfdf63bb867e1ec311a37ecba9334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Sql.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Sql.dll
        • Size 178KB
        • SHA256 c45d93f5476c9b5f24ac7ae3c1f452d1957d46487073f002b1aed1aa5cab8526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Widgets.dll
        • Size 4.5MB
        • SHA256 ca6b376b88f93c8bd08ee3da6c6224d2df9ae68a4845387597108adacd33c55a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Xml.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Xml.dll
        • Size 179KB
        • SHA256 9fb3d9f0e231ad1d32a79db1211f3f478cdac2efbbc729c30cb65a68fe35c5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\libcrypto-1_1.dll
        • Size 2.5MB
        • SHA256 a03e71ce87054a7fe40b995d5ec892c3b970757cedb3eb9b858ac3134d3a45d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\libcurl.dll
        • Size 643KB
        • SHA256 519bbe3256ebd2da5631a7f74352562988f3a5124566f548e1e08a1b8bc9f58c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\libssl-1_1.dll
        • Size 543KB
        • SHA256 7d6638b7bd0c2f4d067eacfe34a090606301fb5a4453414ce101b6d6d8f09bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log4cplusU.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\log4cplusU.dll
        • Size 903KB
        • SHA256 3efffc4ee1586ef0b6489b0a73c83e97a77260b7ef0ca6a4650ab4011a9f4367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\msvcp140.dll
        • Size 427KB
        • SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\msvcp140_1.dll
        • Size 22KB
        • SHA256 f0fb70b0801432a89ebcc301f289c78ffb6d3f06bfb691a5782d7a309d1386c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\platforms\qwindows.dll
        • Size 1.2MB
        • SHA256 3933f5bb2147565f5f37bd54aa080a90d26f80b1b34b036ed9868411753e4cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python_x86_Lib.exe
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
        • Size 7.2MB
        • SHA256 11868ca3fcaf7c138ada700da02b0ca79d49a16579938a42bdde1147b27185a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qdjango-db0.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\qdjango-db0.dll
        • Size 155KB
        • SHA256 a62388619b489af27bd6dbb5b6f0ab184a565ccf9777527002135e7040a21752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmmproxy.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\rmmproxy.dll
        • Size 139KB
        • SHA256 3934cfb040e6e0887517be1df5730f5b05349f2816c837b299d1c9ae03088719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Program Files (x86)\ITarian\Endpoint Manager\vcruntime140.dll
        • Size 75KB
        • SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7ZSfx000.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
        • Size 228B
        • SHA256 e2cdd1993e117f75ecd7833a86becccc3ecee73d8afd7197971acac88408c4d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSID2F6.tmp
        • Path C:\Windows\Installer\MSID2F6.tmp
        • Size 302KB
        • SHA256 ab1015bd5f858cd5bcc97bf43ea47af0680878e8aadf9996cd87bcbfff4f8f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSID933.tmp
        • Path C:\Windows\Installer\MSID933.tmp
        • Size 203KB
        • SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 26.1MB
        • SHA256 44a125c9d81cfe34328344743c44333b8eb5ab673a55fd30c684635c4ced8d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {ab34fe1e-4492-4900-8706-7e1a34e0b607}_OnDiskSnapshotProp
        • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ab34fe1e-4492-4900-8706-7e1a34e0b607}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 7fbd7796cba12ef27d6970343f2e4d35b250d64d7640d7c77ee7a99cdd574c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download