Overview

overview

6

Static

static

3

Lapce-windows.msi

windows10-2004-x64

6

Lapce-windows.msi

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 00:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Lapce-windows.msi
  • Size 19.7MB
  • Sample260810-agz5aadb39
  • SHA256 e9616dcb6c39e2a73cc0336318055f1893a025383304ce5798a93ae29327eb8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 10 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Lapce-windows.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2168
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4624
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58e868.rbs
        • Path C:\Config.Msi\e58e868.rbs
        • Size 8KB
        • SHA256 cc8d66b5271a7c80d9da22981c33e519e4abe524c92efcc759567070800103f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8F46CEA70F8548E8E6B7FFCDB32F7867_20ED2C03287E1F28F95C79F99A036998
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8F46CEA70F8548E8E6B7FFCDB32F7867_20ED2C03287E1F28F95C79F99A036998
        • Size 353B
        • SHA256 73dd1689c1aeb7c61768dbc4734b7361c874c6e3f148f1de55e4f3df6b063629
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B71F24C221797DB92A5D48D124C45877_926E00FCB921BB3054733D033F5FF154
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B71F24C221797DB92A5D48D124C45877_926E00FCB921BB3054733D033F5FF154
        • Size 323B
        • SHA256 4cf4ec7d8b05d4de119abaaa896a2a7b0ee63edb4acb99f96da81ebd95ca337c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8F46CEA70F8548E8E6B7FFCDB32F7867_20ED2C03287E1F28F95C79F99A036998
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8F46CEA70F8548E8E6B7FFCDB32F7867_20ED2C03287E1F28F95C79F99A036998
        • Size 492B
        • SHA256 196e61d41efc16c91e85653187274b592d1641d3f1c29e7c3ca833e633be4bcb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B71F24C221797DB92A5D48D124C45877_926E00FCB921BB3054733D033F5FF154
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B71F24C221797DB92A5D48D124C45877_926E00FCB921BB3054733D033F5FF154
        • Size 484B
        • SHA256 e3fd6b8bc1f0b04ad594fdf4efe087f44fa872eb1834bf0645bd308e7caff7d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e58e867.msi
        • Path C:\Windows\Installer\e58e867.msi
        • Size 19.7MB
        • SHA256 e9616dcb6c39e2a73cc0336318055f1893a025383304ce5798a93ae29327eb8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 8b9e6ecb62ddd9b1a44ef16e474fdd45fa1abaf90f6fe70239e90ca23c6ded3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {a046ff22-ce1d-4ed4-894f-fc227e28ea63}_OnDiskSnapshotProp
        • Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a046ff22-ce1d-4ed4-894f-fc227e28ea63}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 1c67eae54680704390244c85c9b0e6bf231bf27ce94ac5237fe1d95d2bbb3463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download