4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
298s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi
Size 1.1MB
Sample260807-rn2ecsfm2v
SHA256 4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da
MD5 ef4be631848738f8a19b9c83aedb2fe0
SHA1 f8a546309e2cc86900654788c01a2344b4f6e4f3
SHA512 93fcdca28c2f19ac21fce976812b9baabc1c6cf239540bc28d5aafd160838f68d026f2ba235a9b548e29018ad070387810c43f2caa492b087e8e80f693484912
SSDEEP 6144:OE1fJEHMOJABJJ2+Rinnnnnnnnnnnnnnnnnnnnnr:OEfE4Unnnnnnnnnnnnnnnnnnnnnr
TLSH
T1B135F1E0E829FE57F326D43CA025F658C6D91CE1E706D07AB02AF6A455B3390245DB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Checks QEMU agent state file 2 TTPs 1 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	MSIA266.tmp

Executes dropped EXE 1 IoCs

pid	Process
4364	MSIA266.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4364	MSIA266.tmp

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA17B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA266.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a071.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a071.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4420	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA266.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	msiexec.exe
2704	msiexec.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4420	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4420	msiexec.exe
Token: SeSecurityPrivilege	2704	msiexec.exe
Token: SeCreateTokenPrivilege	4420	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4420	msiexec.exe
Token: SeLockMemoryPrivilege	4420	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4420	msiexec.exe
Token: SeMachineAccountPrivilege	4420	msiexec.exe
Token: SeTcbPrivilege	4420	msiexec.exe
Token: SeSecurityPrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeLoadDriverPrivilege	4420	msiexec.exe
Token: SeSystemProfilePrivilege	4420	msiexec.exe
Token: SeSystemtimePrivilege	4420	msiexec.exe
Token: SeProfSingleProcessPrivilege	4420	msiexec.exe
Token: SeIncBasePriorityPrivilege	4420	msiexec.exe
Token: SeCreatePagefilePrivilege	4420	msiexec.exe
Token: SeCreatePermanentPrivilege	4420	msiexec.exe
Token: SeBackupPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeShutdownPrivilege	4420	msiexec.exe
Token: SeDebugPrivilege	4420	msiexec.exe
Token: SeAuditPrivilege	4420	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4420	msiexec.exe
Token: SeChangeNotifyPrivilege	4420	msiexec.exe
Token: SeRemoteShutdownPrivilege	4420	msiexec.exe
Token: SeUndockPrivilege	4420	msiexec.exe
Token: SeSyncAgentPrivilege	4420	msiexec.exe
Token: SeEnableDelegationPrivilege	4420	msiexec.exe
Token: SeManageVolumePrivilege	4420	msiexec.exe
Token: SeImpersonatePrivilege	4420	msiexec.exe
Token: SeCreateGlobalPrivilege	4420	msiexec.exe
Token: SeBackupPrivilege	2296	vssvc.exe
Token: SeRestorePrivilege	2296	vssvc.exe
Token: SeAuditPrivilege	2296	vssvc.exe
Token: SeBackupPrivilege	2704	msiexec.exe
Token: SeRestorePrivilege	2704	msiexec.exe
Token: SeRestorePrivilege	2704	msiexec.exe
Token: SeTakeOwnershipPrivilege	2704	msiexec.exe
Token: SeRestorePrivilege	2704	msiexec.exe
Token: SeTakeOwnershipPrivilege	2704	msiexec.exe
Token: SeRestorePrivilege	2704	msiexec.exe
Token: SeTakeOwnershipPrivilege	2704	msiexec.exe
Token: SeBackupPrivilege	1424	srtasks.exe
Token: SeRestorePrivilege	1424	srtasks.exe
Token: SeSecurityPrivilege	1424	srtasks.exe
Token: SeTakeOwnershipPrivilege	1424	srtasks.exe
Token: SeBackupPrivilege	1424	srtasks.exe
Token: SeRestorePrivilege	1424	srtasks.exe
Token: SeSecurityPrivilege	1424	srtasks.exe
Token: SeTakeOwnershipPrivilege	1424	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4420	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	MSIA266.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1424	2704	msiexec.exe	99
PID 2704 wrote to memory of 4364	2704	msiexec.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4420

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\Installer\MSIA266.tmp
  "C:\Windows\Installer\MSIA266.tmp"
  2⤵
  - Checks QEMU agent state file
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4364

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSIA266.tmp

Path C:\Windows\Installer\MSIA266.tmp
Size 1.1MB
SHA256 636b74df9b26f51ec33c81f648d5bfb6da7cc7092c59d9c4922e0a9f0d3c947c
MD5 7ecb9626b6083fa31c6f94053f4c75e4
SHA1 0ea0bef18e6125cce2bfd2dc6efa251039e26a14
SHA512 fdeb836330f23da263dc0fb47ae2d51ce6160bd94db50fed2bc5a70535954cd4143be52c528e18dac7ea5d5814825f8b12dfacefe481cef62e187f47f130bb59
SSDEEP 6144:GfJEHMOJABJJ2+Rinnnnnnnnnnnnnnnnnnnnnr:mE4Unnnnnnnnnnnnnnnnnnnnnr
TLSH
T16C35F1E0F829FE57F326D43CA025F658C6D918E1E706D07AB02AF6A455B3390245DB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 ce3182f68baf9801ad23a4256ceecf4cb29ac97e4976dad9b9f701434d6d07d3
MD5 1057577a11dee02a06e87a0516cb1779
SHA1 8a849a48504d3a9790b9169aca0a696204682cc4
SHA512 9c6f268967eda3e81192647b1cc3d09ce9014412d21963b6a1df94504ca21e38ed730a4728405d4406c3cc8f6a4170195f55fa0d89fd64a2b89f9a2a1f119b74
SSDEEP 24576:5u8m+1zJdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:v
TLSH
T1FA47A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3f3ef96d-a47b-40d0-871e-42705ab5a6c3}_OnDiskSnapshotProp

Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3f3ef96d-a47b-40d0-871e-42705ab5a6c3}_OnDiskSnapshotProp
Size 6KB
SHA256 d188fd5edab59de72e310885fd8b0ac16cc1b5562a53c581e693a81680447568
MD5 2bc12e9f05945a78aaa29c518875e6f2
SHA1 0b9f908eb7c9aff979915908d7583e135a6ab018
SHA512 18576c99693c98b71f6bcd280e76a8fd6d560d8386d430c1b88d1307f8df10dd132ac6a36131062ebc7d34d1899a977e987b9df07e5a6ccbb903bc5e85904605
SSDEEP 96:F81mmM/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Smtb++ZVmN
TLSH
T1AFD178085AF54711E2B3AB3129F54557A877B911EF33CB8E0298238E2670910F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download