Analysis
- user interaction
yes - max time kernel
1205s - max time network
1125s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/08/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
900 seconds
General
- Target 03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d.msi
- Size 5.8MB
- Sample260808-txggnavtbv
- SHA256 03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d
- MD5 ccd171619f39bc72ea80336320cff5f7
- SHA1 bd50e55f2ac749f2250759b641fa663b3369a3b0
- SHA512 e4bfc20ecc247005720d2a400213c7f1ca5b48c5ad1bf29415503c6772edf38545cfd7663b58b8e1b4a18194a31b3addd27e2d95c9e055bdeb24592e20dc0882
- SSDEEP 98304:lNq4L6KU5auvV4sZM5ZaJlUFl0zsC0xP0SzuRDGB2iVQ0tM6hxWXwLaJkY/tkjkp:fqG6KeVvVpAanUD0zsC0xsSyFtKVMm0h
- TLSH T1055633C6B8CD3770C08BC7728292669E703E7FC17E3A9D5776D87A091EB16149A7A340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4648 MsiExec.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4648 MsiExec.exe 3 4648 MsiExec.exe 4 4648 MsiExec.exe 5 4648 MsiExec.exe 6 4648 MsiExec.exe 7 4648 MsiExec.exe 8 4648 MsiExec.exe 9 4648 MsiExec.exe 10 4648 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F342AD810E2573BA008691E7C64C1A7F MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F342AD810E2573BA008691E7C64C1A7F MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF53A358A52BDDB92A.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File created C:\Windows\SystemTemp\~DFF410FAD32B7B1B56.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI54D3.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5436.tmp msiexec.exe File created C:\Windows\Installer\e5852fd.msi msiexec.exe File opened for modification C:\Windows\Installer\e5852fd.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4436 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000643a9eb9192046c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000643a9eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900643a9eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a643a9eb9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d643a9eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3032 POWERPNT.EXE - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2428 msiexec.exe 2428 msiexec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeSecurityPrivilege 2428 msiexec.exe Token: SeCreateTokenPrivilege 4436 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4436 msiexec.exe Token: SeLockMemoryPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeMachineAccountPrivilege 4436 msiexec.exe Token: SeTcbPrivilege 4436 msiexec.exe Token: SeSecurityPrivilege 4436 msiexec.exe Token: SeTakeOwnershipPrivilege 4436 msiexec.exe Token: SeLoadDriverPrivilege 4436 msiexec.exe Token: SeSystemProfilePrivilege 4436 msiexec.exe Token: SeSystemtimePrivilege 4436 msiexec.exe Token: SeProfSingleProcessPrivilege 4436 msiexec.exe Token: SeIncBasePriorityPrivilege 4436 msiexec.exe Token: SeCreatePagefilePrivilege 4436 msiexec.exe Token: SeCreatePermanentPrivilege 4436 msiexec.exe Token: SeBackupPrivilege 4436 msiexec.exe Token: SeRestorePrivilege 4436 msiexec.exe Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeDebugPrivilege 4436 msiexec.exe Token: SeAuditPrivilege 4436 msiexec.exe Token: SeSystemEnvironmentPrivilege 4436 msiexec.exe Token: SeChangeNotifyPrivilege 4436 msiexec.exe Token: SeRemoteShutdownPrivilege 4436 msiexec.exe Token: SeUndockPrivilege 4436 msiexec.exe Token: SeSyncAgentPrivilege 4436 msiexec.exe Token: SeEnableDelegationPrivilege 4436 msiexec.exe Token: SeManageVolumePrivilege 4436 msiexec.exe Token: SeImpersonatePrivilege 4436 msiexec.exe Token: SeCreateGlobalPrivilege 4436 msiexec.exe Token: SeBackupPrivilege 4136 vssvc.exe Token: SeRestorePrivilege 4136 vssvc.exe Token: SeAuditPrivilege 4136 vssvc.exe Token: SeBackupPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeRestorePrivilege 2428 msiexec.exe Token: SeTakeOwnershipPrivilege 2428 msiexec.exe Token: SeBackupPrivilege 4400 srtasks.exe Token: SeRestorePrivilege 4400 srtasks.exe Token: SeSecurityPrivilege 4400 srtasks.exe Token: SeTakeOwnershipPrivilege 4400 srtasks.exe Token: SeBackupPrivilege 4400 srtasks.exe Token: SeRestorePrivilege 4400 srtasks.exe Token: SeSecurityPrivilege 4400 srtasks.exe Token: SeTakeOwnershipPrivilege 4400 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4436 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3032 POWERPNT.EXE 3032 POWERPNT.EXE 3032 POWERPNT.EXE 3032 POWERPNT.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2428 wrote to memory of 4400 2428 msiexec.exe 84 PID 2428 wrote to memory of 4648 2428 msiexec.exe 86 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4436
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9292216B1F849CDA82C95B3F6B7EC535 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\PushWait.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI54D3.tmp
- Size 5.8MB
- SHA256 1a16b4e5e452e6b31a9ae332869ff1b7c174cd08f1e1ab94c11c8b3e4a252b3a
- MD5 5878219d8810099e7457b7e897c29326
- SHA1 460d209365dfaa9abea88e1b4b622dd08a2bf3e8
- SHA512 8a98660fcc1ef0dcea5e4575c8ad472b7af3fb9f409f3bf0be2c75799c2b2831b983f01f9b38c6479bd8e096154ffbcd13d7b2f19820149e816ba90e8313d940
- SSDEEP 98304:KNq4L6KU5auvV4sZM5ZaJlUFl0zsC0xP0SzuRDGB2iVQ0tM6hxWXwLaJkY/tkjki:qqG6KeVvVpAanUD0zsC0xsSyFtKVM606
- TLSH T1D25633C7B89D3770C08BCB7282926AAE703E7BC17D3A5D5776D87A051EB16059A7E300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 a577af89ad7f221b02c90757833cbad8ebd47153e485e29a29058f3fa5e872c1
- MD5 e1536665b5dd392f321c4f4bec4d0153
- SHA1 43c572184daae848b36ee67b69c4e2c8306b390e
- SHA512 9bf2e2e0efa2b7b219a79598f9dcc59f5f5b0259b125d8c58bd4f91fff17d0c712c8438a557cdd0135c115a8d7420018d1563e186b68b47113cc5f12d989d82a
- SSDEEP 24576:C2gmSp1qdoO/vvTLaWxOBk3afqpaA4Fr22CN3JEBYK6YktF046AWrMr2x:R
- TLSH T1BD47C22436F92210E7F79E3CA8F06A234A3E7D5B9C15DE8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{b99e3a64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fcb1460c-4629-4a0e-9d91-c748593cb398}_OnDiskSnapshotProp
- Size 6KB
- SHA256 25d25c9d9694dcb84ca5fd1b4559701cf738ef8178cbd68cf9e8b13635731aa4
- MD5 ad696154aef153b8b20d556cb5d78582
- SHA1 5c92cf6f86aa9eb7403e5336625de11b0f9e998f
- SHA512 1f721712e11c52001b98a6ffd19f2745dadb01f6ac15eb201895a8adcdd046a0f7fe6b67b2db6a170066975af672a2e88e1608ca797fb1e66e8b2ee2dc4e3437
- SSDEEP 96:F2DEtZ1vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Uo/b++ZVm
- TLSH T1F2D198085AF54311E2B3AB3129F58557A877B911EF33CB8E0298238E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH