Analysis
- max time kernel
149s - max time network
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer_3c36ff.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer_3c36ff.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Installer_3c36ff.msi
- Size 11.8MB
- Sample260807-a5s1wavbme
- SHA256 ee53179ed05384cb254d8156f67b49f20c1ee2a4560103eb426e3ec8e5646302
- MD5 53fa85671f208fc4fe65e7e8f00a44dc
- SHA1 ba9343ae43d6f87372b9ad3c115bcec9176bdc4b
- SHA512 27967367543dc837f81c3eb8348c4b50bdf35ae44ec8d1139a030605a761fa50f8316cd2528e29b9702bbcc236d5bb42d158d79f22098307909b65d421ebd33d
- SSDEEP 196608:eXQAjHBZKJ1wASILbNibF/2kZkVBdHD7+VTuKgfvcRQnnPkCACJ9ElQYiorq:eXQ2jK0JqNippIHHD7+BuKgfvcSPy2sF
- TLSH T156C6330B53630F0AC777D331429EBBF9A8E9BE4B7351049A9F4EB5A43532A789074391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 504 prefetch_e37a.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 504 prefetch_e37a.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF60B5C6BBC53EE5C4.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{48B5D62B-5FB0-4497-827D-4F69F2CCC2BF} msiexec.exe File created C:\Windows\Installer\e5a10dc.msi msiexec.exe File created C:\Windows\SystemTemp\~DF98CCA4ECD48ED3F7.TMP msiexec.exe File created C:\Windows\Installer\e5a10da.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD87DDF1B10F91FCB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI1907.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF6FB8358AC51FF5CB.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a10da.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4864 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3960 msiexec.exe 3960 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4864 msiexec.exe Token: SeIncreaseQuotaPrivilege 4864 msiexec.exe Token: SeSecurityPrivilege 3960 msiexec.exe Token: SeCreateTokenPrivilege 4864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4864 msiexec.exe Token: SeLockMemoryPrivilege 4864 msiexec.exe Token: SeIncreaseQuotaPrivilege 4864 msiexec.exe Token: SeMachineAccountPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 4864 msiexec.exe Token: SeSecurityPrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeLoadDriverPrivilege 4864 msiexec.exe Token: SeSystemProfilePrivilege 4864 msiexec.exe Token: SeSystemtimePrivilege 4864 msiexec.exe Token: SeProfSingleProcessPrivilege 4864 msiexec.exe Token: SeIncBasePriorityPrivilege 4864 msiexec.exe Token: SeCreatePagefilePrivilege 4864 msiexec.exe Token: SeCreatePermanentPrivilege 4864 msiexec.exe Token: SeBackupPrivilege 4864 msiexec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeShutdownPrivilege 4864 msiexec.exe Token: SeDebugPrivilege 4864 msiexec.exe Token: SeAuditPrivilege 4864 msiexec.exe Token: SeSystemEnvironmentPrivilege 4864 msiexec.exe Token: SeChangeNotifyPrivilege 4864 msiexec.exe Token: SeRemoteShutdownPrivilege 4864 msiexec.exe Token: SeUndockPrivilege 4864 msiexec.exe Token: SeSyncAgentPrivilege 4864 msiexec.exe Token: SeEnableDelegationPrivilege 4864 msiexec.exe Token: SeManageVolumePrivilege 4864 msiexec.exe Token: SeImpersonatePrivilege 4864 msiexec.exe Token: SeCreateGlobalPrivilege 4864 msiexec.exe Token: SeBackupPrivilege 5232 vssvc.exe Token: SeRestorePrivilege 5232 vssvc.exe Token: SeAuditPrivilege 5232 vssvc.exe Token: SeBackupPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe Token: SeTakeOwnershipPrivilege 3960 msiexec.exe Token: SeRestorePrivilege 3960 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4864 msiexec.exe 4864 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4864 msiexec.exe 3960 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3960 wrote to memory of 4472 3960 msiexec.exe 93 PID 3960 wrote to memory of 504 3960 msiexec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer_3c36ff.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4864
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4472
-
-
C:\Users\Admin\AppData\Local\Creative\Sound Blaster Connect\prefetch_e37a.exe"C:\Users\Admin\AppData\Local\Creative\Sound Blaster Connect\prefetch_e37a.exe" /nologo "C:\Users\Admin\AppData\Local\Creative\Sound Blaster Connect\prefetch_e37a.csproj" /nr:false2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:504
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a10db.rbs
- Size 9KB
- SHA256 1681eb11b5891945c28ebac31e40c07792f196cd7236111b77a23db1c8f9a7db
- MD5 cac19ad79d3b64f43dd5a7d08f12023c
- SHA1 dd5028af36200be5fe71d38d9e8ed5c4001003a9
- SHA512 fbe50eb73c0775621f62fb883ea5b51351c9e64ad9ce3aef591364ec188c8b7471ec15e79bc821c2510a0eaf1b6ba3dc2227d94afbf27b29b7238393508da46b
- SSDEEP 96:lT9tqRvPFAXbBfi2oCIhmuqhm1wNUxPtPQCsThqmNUxPtPQC6jMshmLhmw5Thqu2:lTnqVdpCoZJBdXIABdXvXYhRJ8p81
- TLSH T1671224417640C5D2E8653B3696636BA073B2C3DD8B12725F8E5CC8285E53788DE5938B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Creative\Sound Blaster Connect\Lucene.Net.dll
- Size 15.5MB
- SHA256 4519694e8f463f20bad5fd3741047a832733b509fbb4ab07a28a2f174cf985e1
- MD5 5a40bb934e8a78c382fc42c0abef249a
- SHA1 c13107190b6dc57e14b03a9089f2a5d60895fd28
- SHA512 2c6b257cd0312ca8b403826a58d54db1098ac860cdb71663b42723c2f2e50d88053f080512c086a10672da5b2dbaf82503108ae7dd2a24dd2e7d6e89941c2c4f
- SSDEEP 196608:hBxUBLv/4UFxDT+tGjz4Yhqw1wrObRMMCoy9nLvBWmX1:9UxnBBT+tGn4YMrNoAnjBFX
- TLSH T12EF6BC22F9D8AC8A882AF3635372CD1A01BB9CBDC795DB4E054866F3F0D17916C1DD92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Creative\Sound Blaster Connect\prefetch_e37a.csproj
- Size 441B
- SHA256 e1f501be911ae6f5cd97b9b52c976d3335fedaafa34bdd2bc1185ea885e1b1df
- MD5 16f527ec312d85d9c7fa503da37a5bd8
- SHA1 95fd30b65e7fbc7e1b8761967c85f7880078638a
- SHA512 f72e7cd51a411754d94fc8b965abff9c95e07b07cd6cea8bbefa67bc3844687f616c81c2b0cffca489fd9a1244f959b79991f882ddab0825fd19a3e5dd351130
- TLSH T100F0EC11B440ACA162F00662E5796A54E7B0D6D304754C6EF9C5740F57B3058101B3E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Creative\Sound Blaster Connect\prefetch_e37a.exe
- Size 246KB
- SHA256 3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33
- MD5 2d6ebd59b568586a8f1683b07de897e1
- SHA1 ca4af6cd9ebdcf9d29481be1a1229697cb56d54c
- SHA512 67d24d8b5bda715c6bc6c77d2dfa193d6bfca7480c2b46750d9e5b5171de5341fa64e0b02d797eca3839d1bd646d84f002ac654c8f5c0040469e8feb5d6c46d6
- SSDEEP 3072:6DEKKwBWmSEoRoocfZO8gQYiY35ePw2XpFU4rwOe1ZbZEFf02RFiZWr5MAh6i:UHK2W0u1EO80+RXf1102bio62j
- TLSH T17E345901A7EC0615F6FF0AB8B8B055158B76F867E866D75E388C61AC1F73740EA60363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a10da.msi
- Size 11.8MB
- SHA256 ee53179ed05384cb254d8156f67b49f20c1ee2a4560103eb426e3ec8e5646302
- MD5 53fa85671f208fc4fe65e7e8f00a44dc
- SHA1 ba9343ae43d6f87372b9ad3c115bcec9176bdc4b
- SHA512 27967367543dc837f81c3eb8348c4b50bdf35ae44ec8d1139a030605a761fa50f8316cd2528e29b9702bbcc236d5bb42d158d79f22098307909b65d421ebd33d
- SSDEEP 196608:eXQAjHBZKJ1wASILbNibF/2kZkVBdHD7+VTuKgfvcRQnnPkCACJ9ElQYiorq:eXQ2jK0JqNippIHHD7+BuKgfvcSPy2sF
- TLSH T156C6330B53630F0AC777D331429EBBF9A8E9BE4B7351049A9F4EB5A43532A789074391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 a3e1a9790260979cfb1f7aa9dc498feb9d39e4a21eb396dbb0560f070fecf189
- MD5 e5b8fd77ed3a360f7ab53e3d8d4c1407
- SHA1 f9cc0d9e54cb80e7883492bbad4e52bf4a437c60
- SHA512 0add7b1ebc1201e5a51b45d34bd1430f88ccf08feb72d9d047c1208cf2d36c5f86c40cc8bf7b00f940691bbb94d9d2be6a478a9d818e7ff132f702288aa53a6a
- SSDEEP 24576:ZFo3DMPAdoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfURed:kHw
- TLSH T1B757162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{adc75191-28a7-45bb-8f54-df4fd8daa0ec}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c456f7c6b5bdffbcc652eb8379e2bbfc277c009a53d526cb77acdff8c957a37a
- MD5 3582ae3718d11facdf08c1fc8c086653
- SHA1 9794b2c9e78276653280339fed8c8406eed7e57d
- SHA512 cdcc9ff7cad70f03f2a1c920e9c91a532d54bd58e7e33731174463fd266e5739dba01c65b75e5f5ef9fde3819db13ba4216649cd8ce7673076cec71534073773
- SSDEEP 96:FJnh9vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:n/b++uVmN
- TLSH T1FBD198184AF54711E2B3AB7228F54557A837B911EF33CB8E0198638E2631A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH