4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
598s
max time network
559s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi
Size 1.1MB
Sample260806-ear8baff46
SHA256 4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da
MD5 ef4be631848738f8a19b9c83aedb2fe0
SHA1 f8a546309e2cc86900654788c01a2344b4f6e4f3
SHA512 93fcdca28c2f19ac21fce976812b9baabc1c6cf239540bc28d5aafd160838f68d026f2ba235a9b548e29018ad070387810c43f2caa492b087e8e80f693484912
SSDEEP 6144:OE1fJEHMOJABJJ2+Rinnnnnnnnnnnnnnnnnnnnnr:OEfE4Unnnnnnnnnnnnnnnnnnnnnr
TLSH
T1B135F1E0E829FE57F326D43CA025F658C6D91CE1E706D07AB02AF6A455B3390245DB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Checks QEMU agent state file 2 TTPs 1 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	MSI8A4A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4984	MSI8A4A.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4984	MSI8A4A.tmp

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8A4A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5888a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5888a3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI899D.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2952	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI8A4A.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1052	msiexec.exe
1052	msiexec.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2952	msiexec.exe
Token: SeSecurityPrivilege	1052	msiexec.exe
Token: SeCreateTokenPrivilege	2952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2952	msiexec.exe
Token: SeLockMemoryPrivilege	2952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2952	msiexec.exe
Token: SeMachineAccountPrivilege	2952	msiexec.exe
Token: SeTcbPrivilege	2952	msiexec.exe
Token: SeSecurityPrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeLoadDriverPrivilege	2952	msiexec.exe
Token: SeSystemProfilePrivilege	2952	msiexec.exe
Token: SeSystemtimePrivilege	2952	msiexec.exe
Token: SeProfSingleProcessPrivilege	2952	msiexec.exe
Token: SeIncBasePriorityPrivilege	2952	msiexec.exe
Token: SeCreatePagefilePrivilege	2952	msiexec.exe
Token: SeCreatePermanentPrivilege	2952	msiexec.exe
Token: SeBackupPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeShutdownPrivilege	2952	msiexec.exe
Token: SeDebugPrivilege	2952	msiexec.exe
Token: SeAuditPrivilege	2952	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2952	msiexec.exe
Token: SeChangeNotifyPrivilege	2952	msiexec.exe
Token: SeRemoteShutdownPrivilege	2952	msiexec.exe
Token: SeUndockPrivilege	2952	msiexec.exe
Token: SeSyncAgentPrivilege	2952	msiexec.exe
Token: SeEnableDelegationPrivilege	2952	msiexec.exe
Token: SeManageVolumePrivilege	2952	msiexec.exe
Token: SeImpersonatePrivilege	2952	msiexec.exe
Token: SeCreateGlobalPrivilege	2952	msiexec.exe
Token: SeBackupPrivilege	3232	vssvc.exe
Token: SeRestorePrivilege	3232	vssvc.exe
Token: SeAuditPrivilege	3232	vssvc.exe
Token: SeBackupPrivilege	1052	msiexec.exe
Token: SeRestorePrivilege	1052	msiexec.exe
Token: SeRestorePrivilege	1052	msiexec.exe
Token: SeTakeOwnershipPrivilege	1052	msiexec.exe
Token: SeRestorePrivilege	1052	msiexec.exe
Token: SeTakeOwnershipPrivilege	1052	msiexec.exe
Token: SeRestorePrivilege	1052	msiexec.exe
Token: SeTakeOwnershipPrivilege	1052	msiexec.exe
Token: SeBackupPrivilege	4792	srtasks.exe
Token: SeRestorePrivilege	4792	srtasks.exe
Token: SeSecurityPrivilege	4792	srtasks.exe
Token: SeTakeOwnershipPrivilege	4792	srtasks.exe
Token: SeBackupPrivilege	4792	srtasks.exe
Token: SeRestorePrivilege	4792	srtasks.exe
Token: SeSecurityPrivilege	4792	srtasks.exe
Token: SeTakeOwnershipPrivilege	4792	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	MSI8A4A.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4792	1052	msiexec.exe	91
PID 1052 wrote to memory of 4984	1052	msiexec.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2952

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\Installer\MSI8A4A.tmp
  "C:\Windows\Installer\MSI8A4A.tmp"
  2⤵
  - Checks QEMU agent state file
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSI8A4A.tmp

Path C:\Windows\Installer\MSI8A4A.tmp
Size 1.1MB
SHA256 636b74df9b26f51ec33c81f648d5bfb6da7cc7092c59d9c4922e0a9f0d3c947c
MD5 7ecb9626b6083fa31c6f94053f4c75e4
SHA1 0ea0bef18e6125cce2bfd2dc6efa251039e26a14
SHA512 fdeb836330f23da263dc0fb47ae2d51ce6160bd94db50fed2bc5a70535954cd4143be52c528e18dac7ea5d5814825f8b12dfacefe481cef62e187f47f130bb59
SSDEEP 6144:GfJEHMOJABJJ2+Rinnnnnnnnnnnnnnnnnnnnnr:mE4Unnnnnnnnnnnnnnnnnnnnnr
TLSH
T16C35F1E0F829FE57F326D43CA025F658C6D918E1E706D07AB02AF6A455B3390245DB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 4eaa9ffc5f2a002e97a1b01d3e725b70a4c233263247426c972bb6dcdcc57cd7
MD5 a7d857a736a76a96984d3b5e7c4fe7bf
SHA1 3e1064940bfb058e2b628d971b5785060154839f
SHA512 18010605cee3d0db7030993065cf9425b8bd484c76c9c062f2143c2ec3a80fc94e753caa7b240248d372cca024297993209fa483cd24e278b26d539cc84055c3
SSDEEP 24576:wu8m+1zUdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:D
TLSH
T17547C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5f5275b4-b80b-48ea-a307-76698fb23f76}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5f5275b4-b80b-48ea-a307-76698fb23f76}_OnDiskSnapshotProp
Size 6KB
SHA256 1544f05cc08b21e7a2afa6f4b438e2d87a15801c483ba2566d9b1161780a82b6
MD5 5cdac2796aeceecd756930fa2feeb04f
SHA1 3feba0d6b60269a7a0b326230036c97ab09103d6
SHA512 b1b87f2703af395ef23893291685623e50597d76f2c5e0806578165cf0fa88ab4268144ab6d76059bb725376d31ba8dcd461b60b666e3a2d192257db65610243
SSDEEP 96:F+mBASvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:sCb++ZVmN
TLSH
T124D1AA084AF54711E2B3AB3129F54557A877B911EF33CB8E0198238E2670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download