Analysis
- user interaction
yes - max time kernel
37s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 13:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XyronMacro_Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
XyronMacro_Setup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target XyronMacro_Setup.msi
- Size 872KB
- Sample260809-qje5wsfm21
- SHA256 c1bd1936b653e0a93f3f1561a7767f44a90852e1740e7cf7197f64300f5badf1
- MD5 0e8ed83169f7a1f57198dc958cfcebb7
- SHA1 c523460ad68ecde1ac8a4ce112230156dc1e16f5
- SHA512 e44d72e1a9be7c48f311bfcb6b6a977ccad94b568065977cde0ccf2823582516bbcb607bfa89a6f049e9dc86ee1f5d95a4df22972e4d1265a70c056463167502
- SSDEEP 12288:jzvMJdT2O5TeOttVOY4YZADoNQ9145Zjex5Vk5jIQd/4gZ:3vMJdT/NXlZTN6mw5cIiQ
- TLSH T1A015011B7E419532C46A0EBB483BC7B15B3D6C108E6A9647238A720ECFF51D09E65DE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 4964 XyronMacroPremium.exe 3004 XyronMacroPremium.exe 456 XyronMacroPremium.exe 4416 XyronMacroPremium.exe 2036 XyronMacroPremium.exe 2696 XyronMacroPremium.exe 4708 XyronMacroPremium.exe 3916 XyronMacroPremium.exe 4500 XyronMacroPremium.exe 3756 XyronMacroPremium.exe 3228 XyronMacroPremium.exe 1948 XyronMacroPremium.exe 4180 XyronMacroPremium.exe 3632 XyronMacroPremium.exe 3944 XyronMacroPremium.exe - Loads dropped DLL 16 IoCs
pid Process 3760 MsiExec.exe 4964 XyronMacroPremium.exe 3004 XyronMacroPremium.exe 456 XyronMacroPremium.exe 4416 XyronMacroPremium.exe 2036 XyronMacroPremium.exe 2696 XyronMacroPremium.exe 4708 XyronMacroPremium.exe 3916 XyronMacroPremium.exe 4500 XyronMacroPremium.exe 3756 XyronMacroPremium.exe 3228 XyronMacroPremium.exe 1948 XyronMacroPremium.exe 4180 XyronMacroPremium.exe 3632 XyronMacroPremium.exe 3944 XyronMacroPremium.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe msiexec.exe File created C:\Program Files\Xyron Premium Macro Pro\VMProtectSDK64.dll msiexec.exe File created C:\Program Files\Xyron Premium Macro Pro\discord_icon.jpg msiexec.exe File created C:\Program Files\Xyron Premium Macro Pro\logo_icon.png msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{2D717124-41D6-4B47-9C17-E13551F534C2} msiexec.exe File created C:\Windows\Installer\{2D717124-41D6-4B47-9C17-E13551F534C2}\AppIcon msiexec.exe File created C:\Windows\Installer\e586f5f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7059.tmp msiexec.exe File opened for modification C:\Windows\Installer\{2D717124-41D6-4B47-9C17-E13551F534C2}\AppIcon msiexec.exe File created C:\Windows\Installer\e586f61.msi msiexec.exe File opened for modification C:\Windows\Installer\e586f5f.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3908 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\Version = "33619968" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\PackageCode = "752E183F10A9F154FA2225C242F052D1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList\PackageName = "XyronMacro_Setup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\421717D26D1474B4C9711E53155F432C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\ProductName = "Xyron Premium Macro Pro" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\ProductIcon = "C:\\Windows\\Installer\\{2D717124-41D6-4B47-9C17-E13551F534C2}\\AppIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\421717D26D1474B4C9711E53155F432C\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6A5F4E8C8C7BE0D9F1A2B3C4D5E6F7B9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6A5F4E8C8C7BE0D9F1A2B3C4D5E6F7B9\421717D26D1474B4C9711E53155F432C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\421717D26D1474B4C9711E53155F432C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2424 msiexec.exe 2424 msiexec.exe 4964 XyronMacroPremium.exe 4964 XyronMacroPremium.exe 3004 XyronMacroPremium.exe 3004 XyronMacroPremium.exe 456 XyronMacroPremium.exe 456 XyronMacroPremium.exe 4416 XyronMacroPremium.exe 4416 XyronMacroPremium.exe 2036 XyronMacroPremium.exe 2036 XyronMacroPremium.exe 2696 XyronMacroPremium.exe 2696 XyronMacroPremium.exe 4708 XyronMacroPremium.exe 4708 XyronMacroPremium.exe 3916 XyronMacroPremium.exe 3916 XyronMacroPremium.exe 4500 XyronMacroPremium.exe 4500 XyronMacroPremium.exe 3756 XyronMacroPremium.exe 3756 XyronMacroPremium.exe 3228 XyronMacroPremium.exe 3228 XyronMacroPremium.exe 1948 XyronMacroPremium.exe 1948 XyronMacroPremium.exe 4180 XyronMacroPremium.exe 4180 XyronMacroPremium.exe 3632 XyronMacroPremium.exe 3632 XyronMacroPremium.exe 3944 XyronMacroPremium.exe 3944 XyronMacroPremium.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3908 msiexec.exe Token: SeIncreaseQuotaPrivilege 3908 msiexec.exe Token: SeSecurityPrivilege 2424 msiexec.exe Token: SeCreateTokenPrivilege 3908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3908 msiexec.exe Token: SeLockMemoryPrivilege 3908 msiexec.exe Token: SeIncreaseQuotaPrivilege 3908 msiexec.exe Token: SeMachineAccountPrivilege 3908 msiexec.exe Token: SeTcbPrivilege 3908 msiexec.exe Token: SeSecurityPrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeLoadDriverPrivilege 3908 msiexec.exe Token: SeSystemProfilePrivilege 3908 msiexec.exe Token: SeSystemtimePrivilege 3908 msiexec.exe Token: SeProfSingleProcessPrivilege 3908 msiexec.exe Token: SeIncBasePriorityPrivilege 3908 msiexec.exe Token: SeCreatePagefilePrivilege 3908 msiexec.exe Token: SeCreatePermanentPrivilege 3908 msiexec.exe Token: SeBackupPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeShutdownPrivilege 3908 msiexec.exe Token: SeDebugPrivilege 3908 msiexec.exe Token: SeAuditPrivilege 3908 msiexec.exe Token: SeSystemEnvironmentPrivilege 3908 msiexec.exe Token: SeChangeNotifyPrivilege 3908 msiexec.exe Token: SeRemoteShutdownPrivilege 3908 msiexec.exe Token: SeUndockPrivilege 3908 msiexec.exe Token: SeSyncAgentPrivilege 3908 msiexec.exe Token: SeEnableDelegationPrivilege 3908 msiexec.exe Token: SeManageVolumePrivilege 3908 msiexec.exe Token: SeImpersonatePrivilege 3908 msiexec.exe Token: SeCreateGlobalPrivilege 3908 msiexec.exe Token: SeCreateTokenPrivilege 3908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3908 msiexec.exe Token: SeLockMemoryPrivilege 3908 msiexec.exe Token: SeIncreaseQuotaPrivilege 3908 msiexec.exe Token: SeMachineAccountPrivilege 3908 msiexec.exe Token: SeTcbPrivilege 3908 msiexec.exe Token: SeSecurityPrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeLoadDriverPrivilege 3908 msiexec.exe Token: SeSystemProfilePrivilege 3908 msiexec.exe Token: SeSystemtimePrivilege 3908 msiexec.exe Token: SeProfSingleProcessPrivilege 3908 msiexec.exe Token: SeIncBasePriorityPrivilege 3908 msiexec.exe Token: SeCreatePagefilePrivilege 3908 msiexec.exe Token: SeCreatePermanentPrivilege 3908 msiexec.exe Token: SeBackupPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeShutdownPrivilege 3908 msiexec.exe Token: SeDebugPrivilege 3908 msiexec.exe Token: SeAuditPrivilege 3908 msiexec.exe Token: SeSystemEnvironmentPrivilege 3908 msiexec.exe Token: SeChangeNotifyPrivilege 3908 msiexec.exe Token: SeRemoteShutdownPrivilege 3908 msiexec.exe Token: SeUndockPrivilege 3908 msiexec.exe Token: SeSyncAgentPrivilege 3908 msiexec.exe Token: SeEnableDelegationPrivilege 3908 msiexec.exe Token: SeManageVolumePrivilege 3908 msiexec.exe Token: SeImpersonatePrivilege 3908 msiexec.exe Token: SeCreateGlobalPrivilege 3908 msiexec.exe Token: SeCreateTokenPrivilege 3908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3908 msiexec.exe Token: SeLockMemoryPrivilege 3908 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3908 msiexec.exe 3908 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2424 wrote to memory of 3760 2424 msiexec.exe 89 PID 2424 wrote to memory of 3736 2424 msiexec.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XyronMacro_Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3908
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 179A0118C99050B26862610E380C0038 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3760
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3736
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3752
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3004
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:456
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4708
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3756
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3228
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4180
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3632
-
C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e586f60.rbs
- Size 8KB
- SHA256 94e00df6769f2115004acc98f27566d5ead8923fc31f37cdb1807ab5a35beed5
- MD5 aa884587fee035da78e683887409b668
- SHA1 b8141dedfb0a0aea36ce25b690d9b18e40765435
- SHA512 a251c7b2832523861fb314ed6b67266457f6f38ce34fcec76b1196c532ec934969c2d6aff411f7d3f635c1342bac1d2628bf4057379748e60313c99b353fd56d
- SSDEEP 96:+mZ6WFF8dFrIFD7FqN/t8WeyQn2+UW8rCsTlH+UW8rC6jl6OPTlqHz53RWcFyrMW:3ZfY/aEXejkzWIPzW2I/UC0pp
- TLSH T1BC025389BA1049F3E5820BB8C35727123B53DFCA9314A25B04CD85748F5278A7FD86CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Xyron Premium Macro Pro\VMProtectSDK64.dll
- Size 115KB
- SHA256 ec3235136a4daee2a6f72c0f2994a8365ca8427c8068d068130b74c9fa64cd02
- MD5 c0ce8c981bda19d2be17aca0774d9df1
- SHA1 895052a42efa50043f473f072578bee69be8d2f8
- SHA512 1578948dba2492263c0b174816451218c70df89e6b4440981db9513c664d97f6253fc1c0dab4164c620b9cb7794f4789677a0c38e0a5ac9636aee1dbc3d16062
- SSDEEP 3072:0RcqYHq7Aiytzg2ScpvgJcLYsqYX6UDdyBo:K0Hq7AiyegZgJoZXBa
- TLSH T171C35B47B3E540BBD1B6C679CD234A56D3B678150B249BAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Xyron Premium Macro Pro\XyronMacroPremium.exe
- Size 584KB
- SHA256 6191d8d39c0bb2b28183301cf83d79563fb6475a0003f6fcf52aa6d2b7b3bf14
- MD5 818bff8336df106285ee3ea5bb1d2b97
- SHA1 a42729994352ee163e29119e769c786207828f43
- SHA512 47d7777d731f1f2897ebaabb8c8121933a78b22b52c8b76edad445fc82708cc2d6bb2e0a967ed973e00e2a8b658ad5a7b80adae27b0cb285fe36974becf4e036
- SSDEEP 6144:2v4DtBl84jJRiE0JTKObvb/ACCSnsRTP6f0UIru+yn5cn7eRtNUIFf7lmCHQdHaH:b7pn4JfbLjnsQM5lyBWqoWQ9/4gZ
- TLSH T1CDD4AE55A2E401FAE177E2B4CD675902F67278460730AADF0390DA771F336D49A3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2A38.tmp
- Size 113KB
- SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
- MD5 4fdd16752561cf585fed1506914d73e0
- SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
- SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
- SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
- TLSH T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e586f5f.msi
- Size 872KB
- SHA256 c1bd1936b653e0a93f3f1561a7767f44a90852e1740e7cf7197f64300f5badf1
- MD5 0e8ed83169f7a1f57198dc958cfcebb7
- SHA1 c523460ad68ecde1ac8a4ce112230156dc1e16f5
- SHA512 e44d72e1a9be7c48f311bfcb6b6a977ccad94b568065977cde0ccf2823582516bbcb607bfa89a6f049e9dc86ee1f5d95a4df22972e4d1265a70c056463167502
- SSDEEP 12288:jzvMJdT2O5TeOttVOY4YZADoNQ9145Zjex5Vk5jIQd/4gZ:3vMJdT/NXlZTN6mw5cIiQ
- TLSH T1A015011B7E419532C46A0EBB483BC7B15B3D6C108E6A9647238A720ECFF51D09E65DE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 408c08a877784003554531082ffc2be22b357770b6dedf5ac19bb524c81559f1
- MD5 b9784c884b24433482282801daaf0026
- SHA1 8983e5a5a7e7357092922f0db4d1ebc6c1aa614a
- SHA512 3a3b1673ce7ea70a9616738a9999ff2f9c98ce2a0a48f1a3036b157ad76b05800f43d7889e5708587487939fee47a3e35825ba93cfc63189713c444b97efb32e
- SSDEEP 24576:Ou8m+1zRdoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:8
- TLSH T13F47C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{50933112-59ed-456b-9f40-b483f584b91b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 468de04ecb37a9b448054d3df28378753d4743d00f9e2869d45e9f7925f534dc
- MD5 1dd41eb962f02ab643f903b90e36cd4a
- SHA1 5615d8e35ce2d42ba938896de8905ced2102945b
- SHA512 4762738f4dc4a758156428e187dce8d3296696d9758d576295af5784dacec9da028bf9f7bb691ccfa5d3cb1df6bf5750911afb8c2b8f839cabf409a5025a63f9
- SSDEEP 96:F+eDYcXsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:0eDgb++ZVm
- TLSH T1FAD18A085AF54711E2B3AB3229F54557A877B911EF33CB8E0298238E6670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH