Analysis
- max time kernel
148s - max time network
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:21
Behavioral task
behavioral1
Sample
vmware-setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
vmware-setup.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target vmware-setup.msi
- Size 156KB
- Sample260810-wzg73seq4y
- SHA256 ccb05e8e1b680a6766c9cfffe71e5543f0b9b0432d2ea10d8f4661188ec5b951
- MD5 3634ca954e7861fd852b7c006da9b8c1
- SHA1 87529e33b41f0f7cdf313effb8dfa8761cd34781
- SHA512 84750cc39c8acc31a22ffa6cd588239da1779ab6b3facc0d2ef26dfa95d861adb9d3c47212fec4b8d9f901b1b68911c653140e361cd15083064c76e569294648
- SSDEEP 384:iHpe4ZvJXK7gzFM7WuuoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyuKDCUyWMDC
- TLSH T128F3C7373600A331C14607368A9FD3E58F6AAC5B4F67112731AAB35D2FB1D9056B7AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Signatures
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Executes dropped EXE 1 IoCs
pid Process 4648 MSIC7AC.tmp - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFE0E7741A95C7C84E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB0951E37F51669C7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC75D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC7AC.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF6D7DB2482CE5EF91.TMP msiexec.exe File created C:\Windows\Installer\e59c27b.msi msiexec.exe File opened for modification C:\Windows\Installer\e59c27b.msi msiexec.exe File created C:\Windows\Installer\SourceHash{705771E1-8028-4A2A-A93E-7DA02AB734CD} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF16EEF26000E6BAE1.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5800 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIC7AC.tmp - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4300 msiexec.exe 4300 msiexec.exe - Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 5800 msiexec.exe Token: SeIncreaseQuotaPrivilege 5800 msiexec.exe Token: SeSecurityPrivilege 4300 msiexec.exe Token: SeCreateTokenPrivilege 5800 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5800 msiexec.exe Token: SeLockMemoryPrivilege 5800 msiexec.exe Token: SeIncreaseQuotaPrivilege 5800 msiexec.exe Token: SeMachineAccountPrivilege 5800 msiexec.exe Token: SeTcbPrivilege 5800 msiexec.exe Token: SeSecurityPrivilege 5800 msiexec.exe Token: SeTakeOwnershipPrivilege 5800 msiexec.exe Token: SeLoadDriverPrivilege 5800 msiexec.exe Token: SeSystemProfilePrivilege 5800 msiexec.exe Token: SeSystemtimePrivilege 5800 msiexec.exe Token: SeProfSingleProcessPrivilege 5800 msiexec.exe Token: SeIncBasePriorityPrivilege 5800 msiexec.exe Token: SeCreatePagefilePrivilege 5800 msiexec.exe Token: SeCreatePermanentPrivilege 5800 msiexec.exe Token: SeBackupPrivilege 5800 msiexec.exe Token: SeRestorePrivilege 5800 msiexec.exe Token: SeShutdownPrivilege 5800 msiexec.exe Token: SeDebugPrivilege 5800 msiexec.exe Token: SeAuditPrivilege 5800 msiexec.exe Token: SeSystemEnvironmentPrivilege 5800 msiexec.exe Token: SeChangeNotifyPrivilege 5800 msiexec.exe Token: SeRemoteShutdownPrivilege 5800 msiexec.exe Token: SeUndockPrivilege 5800 msiexec.exe Token: SeSyncAgentPrivilege 5800 msiexec.exe Token: SeEnableDelegationPrivilege 5800 msiexec.exe Token: SeManageVolumePrivilege 5800 msiexec.exe Token: SeImpersonatePrivilege 5800 msiexec.exe Token: SeCreateGlobalPrivilege 5800 msiexec.exe Token: SeBackupPrivilege 4940 vssvc.exe Token: SeRestorePrivilege 4940 vssvc.exe Token: SeAuditPrivilege 4940 vssvc.exe Token: SeBackupPrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeTakeOwnershipPrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeTakeOwnershipPrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeTakeOwnershipPrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeTakeOwnershipPrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeTakeOwnershipPrivilege 4300 msiexec.exe Token: SeRestorePrivilege 4300 msiexec.exe Token: SeTakeOwnershipPrivilege 4300 msiexec.exe Token: SeBackupPrivilege 2892 srtasks.exe Token: SeRestorePrivilege 2892 srtasks.exe Token: SeSecurityPrivilege 2892 srtasks.exe Token: SeTakeOwnershipPrivilege 2892 srtasks.exe Token: SeBackupPrivilege 2892 srtasks.exe Token: SeRestorePrivilege 2892 srtasks.exe Token: SeSecurityPrivilege 2892 srtasks.exe Token: SeTakeOwnershipPrivilege 2892 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5800 msiexec.exe 5800 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5800 msiexec.exe 4300 msiexec.exe 5148 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4300 wrote to memory of 2892 4300 msiexec.exe 95 PID 4300 wrote to memory of 5148 4300 msiexec.exe 97 PID 4300 wrote to memory of 4648 4300 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\vmware-setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5800
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DE6BDAC6F6B0092637059020D195E7F62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5148
-
-
C:\Windows\Installer\MSIC7AC.tmp"C:\Windows\Installer\MSIC7AC.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4648
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSIC7AC.tmp
- Size 124KB
- SHA256 728f60d5f4ac83589270fbbb9f3248c957a7035b617930714ade80c80bdc4a39
- MD5 c82424dfafb0b1c732e9bcdbfaa3eb01
- SHA1 7f530372d7c48d65b447f0e2e7264de2cdc3b500
- SHA512 ebe997e5247fec428502ee65bf79a39cb50d313572bd480c52fd1cbfb6699c567020933e4348cc809257aa124d4370a2079e9ff239071a046cd50c2e3e936396
- SSDEEP 24:ev1GSkiiljEowqKMA1cMyF8XZh9h9ClfA/LDfBWPPJ+PxiqPp+:qkfj2rh1lySXZh9hMldPPgpiq4
- TLSH T11BC323E3E7374CF7F6291FBE41C3979220FFB63202B21E480E1824155480C4A7C6AB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0665ffbd81e424c5fd1177a87139755e48f356c824f72ad3bd20f8dae32c60fd
- MD5 bf77ce96b092a5ec3a4ee155bfcff04c
- SHA1 b379603ce14e37485d92d45663ce81c68906958c
- SHA512 41dddd44275642e1b0e9a68de3b93cf293f39f8bcc88e84c39c90ec03c3c47e5d7ef67f91ce13d905779a494fa273ef6777415f697fd4d5e470058af8173618f
- SSDEEP 24576:LFo3DMPkdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nu1:aH8
- TLSH T1C457F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{51c02a76-993a-4553-807c-692e0edde01e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 bf759bb96c5c2c246307cbf9b556131b2e714d2c7a9eed4bbb7ff1b3b2e93df5
- MD5 4bcea2e82d0cabc0f2f899c538561465
- SHA1 fbb2ebbd80e026ce1aac51f29ab1145a3edb29b8
- SHA512 c42d300831066c7b0eee9786b3da66e1a8f8a6dfae75b41fbf03223537b394ce30ef1ead23235837fd81bc00b65511d91a5a62c723b2d07df8c5fc1a7625287b
- SSDEEP 96:FDFbCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:V0b++uVm
- TLSH T10ED187081AF54711E2F3AB3129F18557A877B911EF33CB8E0298238E2660910F875F9B
- MD5 SHA1 SHA512 SSDEEP TLSH