Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Update_bde3c4.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Update_bde3c4.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Update_bde3c4.msi
- Size 12.1MB
- Sample260815-gx2rdaeb92
- SHA256 ba48ece9b2956fa3ae96b49b7ffed13ef42e0a51475aa78813e2a55640203560
- MD5 a84ceccf83bb2426433aa5bdb543a3cd
- SHA1 dde65145d4748e030d77e1c90a26122c8883dbdf
- SHA512 470f34f0405e8092c0070622748822bfa8b41b116d0139dae24e4190bf5a4e6fb8e0f47b050d200924c6ca399b2eaf55da5e2007aa41b809aa553ac2480f5bec
- SSDEEP 393216:1m5KMqg6VOTMSx7SD7GUXNoX7hN2iHrvNCqbwmMdC5Z5:1GKM+OQU2vGyNoXN1wm6E
- TLSH T10CD6339DDA9D4796C6BE4BFCC117D4E18C90BE83F686A0EC236B33411D3567895F2282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 704 sync_a952.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 704 sync_a952.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF8FC2284740758AF9.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC0B7B69853429897.TMP msiexec.exe File created C:\Windows\Installer\e597248.msi msiexec.exe File opened for modification C:\Windows\Installer\e597248.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{FA451866-1C5A-43CC-8110-4BFC3D0BA709} msiexec.exe File created C:\Windows\Installer\e59724a.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD42A093967F1403E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD70D75D22160CE61.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI78EF.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4352 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4872 msiexec.exe 4872 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4352 msiexec.exe Token: SeIncreaseQuotaPrivilege 4352 msiexec.exe Token: SeSecurityPrivilege 4872 msiexec.exe Token: SeCreateTokenPrivilege 4352 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4352 msiexec.exe Token: SeLockMemoryPrivilege 4352 msiexec.exe Token: SeIncreaseQuotaPrivilege 4352 msiexec.exe Token: SeMachineAccountPrivilege 4352 msiexec.exe Token: SeTcbPrivilege 4352 msiexec.exe Token: SeSecurityPrivilege 4352 msiexec.exe Token: SeTakeOwnershipPrivilege 4352 msiexec.exe Token: SeLoadDriverPrivilege 4352 msiexec.exe Token: SeSystemProfilePrivilege 4352 msiexec.exe Token: SeSystemtimePrivilege 4352 msiexec.exe Token: SeProfSingleProcessPrivilege 4352 msiexec.exe Token: SeIncBasePriorityPrivilege 4352 msiexec.exe Token: SeCreatePagefilePrivilege 4352 msiexec.exe Token: SeCreatePermanentPrivilege 4352 msiexec.exe Token: SeBackupPrivilege 4352 msiexec.exe Token: SeRestorePrivilege 4352 msiexec.exe Token: SeShutdownPrivilege 4352 msiexec.exe Token: SeDebugPrivilege 4352 msiexec.exe Token: SeAuditPrivilege 4352 msiexec.exe Token: SeSystemEnvironmentPrivilege 4352 msiexec.exe Token: SeChangeNotifyPrivilege 4352 msiexec.exe Token: SeRemoteShutdownPrivilege 4352 msiexec.exe Token: SeUndockPrivilege 4352 msiexec.exe Token: SeSyncAgentPrivilege 4352 msiexec.exe Token: SeEnableDelegationPrivilege 4352 msiexec.exe Token: SeManageVolumePrivilege 4352 msiexec.exe Token: SeImpersonatePrivilege 4352 msiexec.exe Token: SeCreateGlobalPrivilege 4352 msiexec.exe Token: SeBackupPrivilege 3080 vssvc.exe Token: SeRestorePrivilege 3080 vssvc.exe Token: SeAuditPrivilege 3080 vssvc.exe Token: SeBackupPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4352 msiexec.exe 4352 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4352 msiexec.exe 4872 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4872 wrote to memory of 5308 4872 msiexec.exe 94 PID 4872 wrote to memory of 704 4872 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Update_bde3c4.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4352
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5308
-
-
C:\Users\Admin\AppData\Local\Qualcomm\Atheros Bluetooth Suite\sync_a952.exe"C:\Users\Admin\AppData\Local\Qualcomm\Atheros Bluetooth Suite\sync_a952.exe" /nologo "C:\Users\Admin\AppData\Local\Qualcomm\Atheros Bluetooth Suite\sync_a952.csproj" /nr:false2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:704
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597249.rbs
- Size 9KB
- SHA256 d7be784fc91ac45a17c945e589daf22d1a2a7b291d520115631979b7624f6d63
- MD5 922dfce091514ce064740764a7d6d5a6
- SHA1 2d3382ffb7b78a5e0e0bdb32b438911188169c07
- SHA512 eb8b7937e36dca174921e5aaf180a88c4c9f731c419e630f369437db85e7dbd534504b56c3949809bfe30500bb51a677efe3855111e8c01ce8162c5ae751a2c3
- SSDEEP 192:/SLNDQZCc1hEUGINPUGbzmZdCl91Ay2A8Tpdxo57etmY2:/SLNDQoUDU4VJ
- TLSH T145122142A596C6E2E5BA2B3BDA531B5DF7A7D2DDC350370B088E55200E437CD8F8E086
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Qualcomm\Atheros Bluetooth Suite\Lucene.Net.dll
- Size 15.9MB
- SHA256 71e7af522f97461bc09a78ae49137de9a8205e4c2504d6ad44c81eb9c1834870
- MD5 8a4a158372aa4c1509aafb3a7afaf848
- SHA1 e784907846e6ba41b2b96c6cddd4e7b74ff1a05a
- SHA512 c7c5d893d5fb05a085ee941dfa4a5a533089104a2d9f567edf93af07158e3fbd12102169995d0ca94930fac30509d9f29dda663671b218431a506c1e377b2c36
- SSDEEP 393216:spitZvUwbsMvet+olgseQ0wiiVFg/gOTwCbQOJmqenL8iVGnrD:sCUwbs8e4DTJ2F2GCbQWFj
- TLSH T1E7F6CE02F5553D7592CB3D2332122589845C9F1E9BB3E31A3E729AB736BEB504EB3112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Qualcomm\Atheros Bluetooth Suite\sync_a952.csproj
- Size 374B
- SHA256 dc418cd0e4c98031a89013df55dab115dedc3faf70df938de06431a13bc3aadd
- MD5 f06b7cc1d772b79739700819574036fa
- SHA1 504eea3db00ed833963c355c8a3d861786c483b1
- SHA512 8f08a01fcb03ef60cc8d3764efc7190e32e84fdbc1bbcc1593934c6ce8255e28811b10cad0e774f0eafc0203c75ca8cb4fb5d68df95b448b6ba9ff4141411fd7
- TLSH T15AE06800B480ECA367F14B31A974A7E9B3B0E9EB00A008AEF890784FCB130981457B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Qualcomm\Atheros Bluetooth Suite\sync_a952.exe
- Size 246KB
- SHA256 3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33
- MD5 2d6ebd59b568586a8f1683b07de897e1
- SHA1 ca4af6cd9ebdcf9d29481be1a1229697cb56d54c
- SHA512 67d24d8b5bda715c6bc6c77d2dfa193d6bfca7480c2b46750d9e5b5171de5341fa64e0b02d797eca3839d1bd646d84f002ac654c8f5c0040469e8feb5d6c46d6
- SSDEEP 3072:6DEKKwBWmSEoRoocfZO8gQYiY35ePw2XpFU4rwOe1ZbZEFf02RFiZWr5MAh6i:UHK2W0u1EO80+RXf1102bio62j
- TLSH T17E345901A7EC0615F6FF0AB8B8B055158B76F867E866D75E388C61AC1F73740EA60363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e597248.msi
- Size 12.1MB
- SHA256 ba48ece9b2956fa3ae96b49b7ffed13ef42e0a51475aa78813e2a55640203560
- MD5 a84ceccf83bb2426433aa5bdb543a3cd
- SHA1 dde65145d4748e030d77e1c90a26122c8883dbdf
- SHA512 470f34f0405e8092c0070622748822bfa8b41b116d0139dae24e4190bf5a4e6fb8e0f47b050d200924c6ca399b2eaf55da5e2007aa41b809aa553ac2480f5bec
- SSDEEP 393216:1m5KMqg6VOTMSx7SD7GUXNoX7hN2iHrvNCqbwmMdC5Z5:1GKM+OQU2vGyNoXN1wm6E
- TLSH T10CD6339DDA9D4796C6BE4BFCC117D4E18C90BE83F686A0EC236B33411D3567895F2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ffb3e128921b65398dac3b67b3995cbe599f9fdd0a677469c2fcfe68384147f6
- MD5 a144f581bf6e7d6d4b88193cf66d4743
- SHA1 3b372ae6f0ea124c1223dbc5eca53c0b7f721fe7
- SHA512 88bdedc32409f2ae283ac25ce9821c31e5bbd918693024c284a9d140939f0304df8a3ca0ea78b58557d3063d136930dad0ae84f680e76ac6808b4eff1b0a61a8
- SSDEEP 24576:nFo3DMP7doO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+c:dHo
- TLSH T19057E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ae23d935-5709-461c-a5f5-71fa154c3071}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a08a96a4ad01257becd39ab200c5cf08b4e4f089b9aa689418d8d30d3711ab7c
- MD5 cf9062289dde6d0e3253f4a296155225
- SHA1 a631ba66ee4596ffc5829d25fd4e4d1d1f8d269c
- SHA512 5215006a2d3c0c4c7a17e8ed433ca77d3e48caa55a7acecdfe2851545a5fed479c2ac7fca47cdbf5c3b615f77aec5a0bea7d13ba92f13b1618a8e8b48aec93e6
- SSDEEP 96:FRFhe6QPOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:lheKb++uVm
- TLSH T1D1D187185AF54311E2B3AB312CF18557A877B912EF33CB8E0198238E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH