Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d500d26f09f5419ca83d0604defe1cc7b17b16530ee2667eff4cec07bdec2f99.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d500d26f09f5419ca83d0604defe1cc7b17b16530ee2667eff4cec07bdec2f99.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target d500d26f09f5419ca83d0604defe1cc7b17b16530ee2667eff4cec07bdec2f99.msi
- Size 2.3MB
- Sample260812-p9wpwsgr2w
- SHA256 d500d26f09f5419ca83d0604defe1cc7b17b16530ee2667eff4cec07bdec2f99
- MD5 a9abe7b0d625cb55adb1e9c3e7df498b
- SHA1 8fc950287aa5bd3db8449b9ebdeecf9cbd0a4d57
- SHA512 62c34bccb0f47c0f4a361dba51161353cdaae2fd8c850e707d981391f6e5e60f56f6181b53e8bc18806ca64863e06af1e09c62e70d87a8e57cd97a3a8797a538
- SSDEEP 49152:GBdTYBZKumZr7AC1su1uXZn8Ud9JCM5Rm5hfJYPYtwRXIhMRs:+YnK/AyuSyJN5RmjJvi4+
- TLSH T16DB502223386C737C95E0270352A929B1178FDAB8B7140C7A3C9391EADB44D16A7DFD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 5988 MsiExec.exe 5988 MsiExec.exe 5988 MsiExec.exe 5988 MsiExec.exe 1788 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5995ce.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI97D1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B2E.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{6526CBB4-D28A-4CBC-AF93-907FED1F0EB9} msiexec.exe File created C:\Windows\SystemTemp\~DF92A104CAE68A48AE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD2D90F30E061C235.TMP msiexec.exe File created C:\Windows\Installer\e5995ce.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9D80.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9DDF.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF79BBA173C78C00E1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9EDA.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFAB51C71E988031C1.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6080 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3304 msiexec.exe 3304 msiexec.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 6080 msiexec.exe Token: SeIncreaseQuotaPrivilege 6080 msiexec.exe Token: SeSecurityPrivilege 3304 msiexec.exe Token: SeCreateTokenPrivilege 6080 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6080 msiexec.exe Token: SeLockMemoryPrivilege 6080 msiexec.exe Token: SeIncreaseQuotaPrivilege 6080 msiexec.exe Token: SeMachineAccountPrivilege 6080 msiexec.exe Token: SeTcbPrivilege 6080 msiexec.exe Token: SeSecurityPrivilege 6080 msiexec.exe Token: SeTakeOwnershipPrivilege 6080 msiexec.exe Token: SeLoadDriverPrivilege 6080 msiexec.exe Token: SeSystemProfilePrivilege 6080 msiexec.exe Token: SeSystemtimePrivilege 6080 msiexec.exe Token: SeProfSingleProcessPrivilege 6080 msiexec.exe Token: SeIncBasePriorityPrivilege 6080 msiexec.exe Token: SeCreatePagefilePrivilege 6080 msiexec.exe Token: SeCreatePermanentPrivilege 6080 msiexec.exe Token: SeBackupPrivilege 6080 msiexec.exe Token: SeRestorePrivilege 6080 msiexec.exe Token: SeShutdownPrivilege 6080 msiexec.exe Token: SeDebugPrivilege 6080 msiexec.exe Token: SeAuditPrivilege 6080 msiexec.exe Token: SeSystemEnvironmentPrivilege 6080 msiexec.exe Token: SeChangeNotifyPrivilege 6080 msiexec.exe Token: SeRemoteShutdownPrivilege 6080 msiexec.exe Token: SeUndockPrivilege 6080 msiexec.exe Token: SeSyncAgentPrivilege 6080 msiexec.exe Token: SeEnableDelegationPrivilege 6080 msiexec.exe Token: SeManageVolumePrivilege 6080 msiexec.exe Token: SeImpersonatePrivilege 6080 msiexec.exe Token: SeCreateGlobalPrivilege 6080 msiexec.exe Token: SeBackupPrivilege 4092 vssvc.exe Token: SeRestorePrivilege 4092 vssvc.exe Token: SeAuditPrivilege 4092 vssvc.exe Token: SeBackupPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeRestorePrivilege 3304 msiexec.exe Token: SeTakeOwnershipPrivilege 3304 msiexec.exe Token: SeBackupPrivilege 2436 srtasks.exe Token: SeRestorePrivilege 2436 srtasks.exe Token: SeSecurityPrivilege 2436 srtasks.exe Token: SeTakeOwnershipPrivilege 2436 srtasks.exe Token: SeBackupPrivilege 2436 srtasks.exe Token: SeRestorePrivilege 2436 srtasks.exe Token: SeSecurityPrivilege 2436 srtasks.exe Token: SeTakeOwnershipPrivilege 2436 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 6080 msiexec.exe 6080 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6080 msiexec.exe 3304 msiexec.exe 5988 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3304 wrote to memory of 2436 3304 msiexec.exe 94 PID 3304 wrote to memory of 5988 3304 msiexec.exe 96 PID 3304 wrote to memory of 1788 3304 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d500d26f09f5419ca83d0604defe1cc7b17b16530ee2667eff4cec07bdec2f99.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6080
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F74B9499C69438D64824213CD48C19C12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5988
-
-
C:\Windows\System32\rundll32.exeC:/Windows/System32/rundll32.exe gpufault.dll, GfeXcodeFunc2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1788
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5995d1.rbs
- Size 1KB
- SHA256 c17f00ce16ce3349d50cce8f903b3a9cf72f98dac2cb5b826141249932013409
- MD5 5467333ff38d082d2f332180d0d3b836
- SHA1 7749dfbf06e6a44d2f39305e8ddb162c7aa29aa7
- SHA512 2148eab7dac3ac2aac53c87b00e74f90d4acc7b4058810329db86ef26e7cab32c49e20283a123feba589c8ccb5d058ed870fba938d1e1aeeb829c5c246d84c52
- TLSH T1F9314442AF8F8AEFCA4990731F6266080CBB9432E790501ECEA44F9D2F531CC4EA40D1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\gpuset\gpufault.dll
- Size 3.8MB
- SHA256 1bcf12604f49243fbb260f7e52b485fef7e215c5462e63ba2106bcbb7f68e3fa
- MD5 72462ae450bb675eae4ec1ba6bcb8305
- SHA1 c14355446cdc6786e9ef69180fc699d8cc17aecd
- SHA512 68fca442b0a19c46407f7863c92f6639f5954dc250aad9a6f1ce5c57d6d2bc14876c3160480ff8c0fd7149abd9cd3980b49a35dbd2726d8e8794434a29184b93
- SSDEEP 49152:uUhs9XR3wxZXRTZUcuVHleFPH1FBJtFfmHrgdvs+s9bj5ZDhN4q:SagbONF30blJ7B
- TLSH T19E069D5AF7A81048D17B917D8AAB4B4AEA72F40187315BCF019442EE1F63BE50D3E7B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI97D1.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- TLSH T1C5947C2032AAC437D97E09B0392DDA9F516D7EA54B7240DBA3C82D6E1DB18C25735F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 3ffe1fef549bbcb325ccc46caeb1253bf95fd39261ba671f2027cc80ee2ff3f9
- MD5 ba257b6f4c8691171c745243a20b265f
- SHA1 c43ef3e9cc6593adc15d93ecaa146ab83262bece
- SHA512 a9cdbba5db3ab8d060c593863aae24d280d77ab34aac9d72e81aa08c1e8cfcd41df14048b9acbc99eb4e346892fa3cf04ac7c07f5a6c38c378a31ad3b0f1fa21
- SSDEEP 24576:nFo3DMPLdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+a:RHc
- TLSH T1CA57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6f301a8b-2fa3-49ab-99e0-2198d871071c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 731a8bc21b07d640496a32d39f09709ff651b0a8aea623994718ae462e51338c
- MD5 e5abc75bcf8af82a6ab772659ba93722
- SHA1 b70eb211d1dcb57d63456b526ef0c1e5b6f83569
- SHA512 1bdfb7cd2af7c0112af139afc947403ee6ebea34b6141412b27d2fad4dbdbf58cc573c5e52627396a414e7306fc197c8206ad631c30290cf07a758641af09d8c
- SSDEEP 96:FaUzX57w0Cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:QEfeb++uVmN
- TLSH T19DD188085AE54711E2B3AB3229F14557A877B911FF33CB8E0198238E2631A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH