Analysis
- max time kernel
150s - max time network
182s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target Setup.msi
- Size 715.0MB
- Sample260816-bexrtaxalb
- SHA256 cb6552ec9a7c6839c58f14d094360885f4793ebdccc1b4b652b55616aafb9e9a
- MD5 74503f7a8a0b49bd5884245ea119c227
- SHA1 fca21579661cacc5d85b898f448d696d7dad64df
- SHA512 ca0adc2f557a92eea3d91f48370545bce0e2971c28a4c66181e1d3fe87fcccf7baa47567eff58ec9f8c860c83a8f163769c8d41f5aa3c4013e33eaadade7f9c9
- SSDEEP 12582912:aeYu5xkF9tN6fcEQusbazOlzllM9YYXbGtOAP54Mv9c2prj8EJG048aWZHbv6k1T:asO97MQFZl6bXbPABPmen8puv625
- TLSH T1A079335134375E97D1877637A3560346BF603C61A701CE22EA31BA9F1EBE2D42AB94C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 5708 MsiExec.exe 5708 MsiExec.exe 5708 MsiExec.exe 5708 MsiExec.exe 5708 MsiExec.exe 3608 MsiExec.exe 3608 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 3884 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5b244d.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF657C87270B9B350.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI86D1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE8E7.tmp msiexec.exe File created C:\Windows\Installer\e5b244d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFB2E865EACCE60782.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7E73.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{A972C6E1-D2C8-45B2-BE49-DF94AB3004CF} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3884 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1996 msiexec.exe 1996 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 1996 msiexec.exe Token: SeCreateTokenPrivilege 3884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3884 msiexec.exe Token: SeLockMemoryPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeMachineAccountPrivilege 3884 msiexec.exe Token: SeTcbPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 3884 msiexec.exe Token: SeTakeOwnershipPrivilege 3884 msiexec.exe Token: SeLoadDriverPrivilege 3884 msiexec.exe Token: SeSystemProfilePrivilege 3884 msiexec.exe Token: SeSystemtimePrivilege 3884 msiexec.exe Token: SeProfSingleProcessPrivilege 3884 msiexec.exe Token: SeIncBasePriorityPrivilege 3884 msiexec.exe Token: SeCreatePagefilePrivilege 3884 msiexec.exe Token: SeCreatePermanentPrivilege 3884 msiexec.exe Token: SeBackupPrivilege 3884 msiexec.exe Token: SeRestorePrivilege 3884 msiexec.exe Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeDebugPrivilege 3884 msiexec.exe Token: SeAuditPrivilege 3884 msiexec.exe Token: SeSystemEnvironmentPrivilege 3884 msiexec.exe Token: SeChangeNotifyPrivilege 3884 msiexec.exe Token: SeRemoteShutdownPrivilege 3884 msiexec.exe Token: SeUndockPrivilege 3884 msiexec.exe Token: SeSyncAgentPrivilege 3884 msiexec.exe Token: SeEnableDelegationPrivilege 3884 msiexec.exe Token: SeManageVolumePrivilege 3884 msiexec.exe Token: SeImpersonatePrivilege 3884 msiexec.exe Token: SeCreateGlobalPrivilege 3884 msiexec.exe Token: SeCreateTokenPrivilege 3884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3884 msiexec.exe Token: SeLockMemoryPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeMachineAccountPrivilege 3884 msiexec.exe Token: SeTcbPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 3884 msiexec.exe Token: SeTakeOwnershipPrivilege 3884 msiexec.exe Token: SeLoadDriverPrivilege 3884 msiexec.exe Token: SeSystemProfilePrivilege 3884 msiexec.exe Token: SeSystemtimePrivilege 3884 msiexec.exe Token: SeProfSingleProcessPrivilege 3884 msiexec.exe Token: SeIncBasePriorityPrivilege 3884 msiexec.exe Token: SeCreatePagefilePrivilege 3884 msiexec.exe Token: SeCreatePermanentPrivilege 3884 msiexec.exe Token: SeBackupPrivilege 3884 msiexec.exe Token: SeRestorePrivilege 3884 msiexec.exe Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeDebugPrivilege 3884 msiexec.exe Token: SeAuditPrivilege 3884 msiexec.exe Token: SeSystemEnvironmentPrivilege 3884 msiexec.exe Token: SeChangeNotifyPrivilege 3884 msiexec.exe Token: SeRemoteShutdownPrivilege 3884 msiexec.exe Token: SeUndockPrivilege 3884 msiexec.exe Token: SeSyncAgentPrivilege 3884 msiexec.exe Token: SeEnableDelegationPrivilege 3884 msiexec.exe Token: SeManageVolumePrivilege 3884 msiexec.exe Token: SeImpersonatePrivilege 3884 msiexec.exe Token: SeCreateGlobalPrivilege 3884 msiexec.exe Token: SeCreateTokenPrivilege 3884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3884 msiexec.exe Token: SeLockMemoryPrivilege 3884 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3884 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3884 msiexec.exe 1996 msiexec.exe 5708 MsiExec.exe 3608 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1996 wrote to memory of 5708 1996 msiexec.exe 89 PID 1996 wrote to memory of 2836 1996 msiexec.exe 95 PID 1996 wrote to memory of 3608 1996 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3884
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A8BFC100EFC4A8B87E535D5E277F5B9C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5708
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2836
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD549EA0BE621BC9DE812C182DB62E162⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3608
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Ableton\Live 9 Trial\Resources\Builtin Lessons\7-Operator Category\OP4-Lead Sounds Lessons\LeadInfoView.png
- Size 19KB
- SHA256 7317e4843996f1ae7400d1f77d10eae01f00bcc2b88538a503473540d4d73b88
- MD5 58373473f268edd59fdf2c4b1d069bee
- SHA1 1885428a4aba0f56b2acfe8c483875a4c2d82f76
- SHA512 3be312834b24de5b6cfa083800aaf5d7b4ab1244f81ba7c166b316cebbf5a0e1f96c13b2947d27ea13599024f8c7a5ffb1d13cd4c35fdcede9691a054a49488f
- SSDEEP 384:3LVES+DybGpwfSQXmZthPVOL73NJr9LUTWJ5DRuV+31YowYKm:b92ybGWvohPIf3NJCTmu5pm
- TLSH T18692E1739E9560D54CAD7183206D22A1A973228BA22B4B90D0FDBED7C943CEF01B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Ableton\Live 9 Trial\Resources\Core Library\Swing and Groove\Latin Percussion\Bomba Congas-199bpm.agr
- Size 8KB
- SHA256 7e0259aa6d8b50a7275383cfc5d4eef0af04b251ef522b07b7767e58e083028b
- MD5 ebd0c449a250a8021259e76c6e2bf221
- SHA1 5eee48123c1266e13ad46da24bbfaf71f921e4c3
- SHA512 0fc178a78a250a073396438a2fdea7fa7905c1326c698c7e7c86f402fde508302f6a4b262c4faa817ff70001a65178a11c58dd0f0168b1f7ac58bd087371f36f
- SSDEEP 96:w/ta754mVM+txkMjBSNZCu1yGZt6qW+lT6+qPtBBtrIc0Epd25sQtbUt4nzuKnln:w/Id//tCRt6f+RaBgcB2O0/JlQO
- TLSH T1C802FD0357FD3607E1B79B322979007981377D7A0971EA7F00551A2E1E38A88CE2DBA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Ableton\Live 9 Trial\Resources\Core Library\Swing and Groove\Swing\Swing 8-99.agr
- Size 6KB
- SHA256 2753c75cdb2ded091019b2f77f982d8e113fd0303f3758a593b65542c77651e6
- MD5 c347c3b19f5f3e4a44ac560607293c9f
- SHA1 c2b4bd15e6fa7905c1d529cfc908bc95dfee3f47
- SHA512 d6309638fc1c3be920fbe90d33414fa640627cfa4bcdba6ef2c9d0700b47a052eba08fd53127b37f51c5afebcd1f65a31d5efc600ffe71f133d92f8e368a593a
- SSDEEP 96:Ya754vM+txkMjBSNZCu1yGZt6qW+lT64rGYKUOtH1mwpFr9d69jSfocmCJ9jSf:pdutCRt6f+RxrGKYRcM
- TLSH T1CDE1CD479BFC370AF1F797722971007A827A7DAA4561E57E0054252F1E38B88CE18BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Ableton\Live 9 Trial\Resources\Extensions\Updater\third_party\site-packages\nose-1.1.2-py2.5.egg\EGG-INFO\not-zip-safe
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\ProgramData\Ableton\Live 9 Trial\Resources\Skins\02Clay.ask
- Size 7KB
- SHA256 873e404cdf8b00d5e74180097bd9a9b7a5223537a5e44fcd416f815954473564
- MD5 7784bbe42981f715d8cd5c43acf71e8f
- SHA1 0c3f14d5159f470d72f2ed5f0d9a166b6fa03740
- SHA512 e3a67d68008ba56995c76022abc81b13e1703e84c8d2ab29ed5784e4c21d29f54d5533374085d93cc43dc586ea9c1822cdb418e2705279d4109da5bc420d121f
- SSDEEP 96:H///khX2+ixUjNCkiOohGwhOVGdG8GmC2bemhnACAxzDwpmuUGkqs9p2lusnroOA:/w2V4qeSACAvupPJz32YbK/B8BKG0
- TLSH T15DF124A213FC3E44F17B9FBE69F964B48867BB57141EAA6D10D0066F4B3890DC508B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB279.tmp
- Size 38KB
- SHA256 263c6ccd40e6e0f14a98d8b3ac9f7ebb5c537c2ae8de182fd6374ff1c1b1129b
- MD5 3154e548d576f110fcbcf2e09e483d4b
- SHA1 4748b46a0e8d4858c350052872a57a34f6c2e7fe
- SHA512 d006798d4b4fae3d73082a04d3bf9386a64c1ad7f7808fcf56b0c42970bf74ebe4c270c0468a8dfc8c107f3fc7b95031c9bcd973ad98b1cef0502cd260b86a2a
- SSDEEP 768:cwp+wLPPXVpPxgeF80+mZdZ3IaN1jTa1AgnZOtkUkB2dyAJ:Swz3m5bmZdZlj8AgnZOt2QdyAJ
- TLSH T1EF036C127706C5F2CA8933F0B59A936D4BBDB8412BE012E7E3639BAF0FA41C91573152
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSICBDF.tmp
- Size 67KB
- SHA256 3b727a1a70641abae30bf2d0b3ba1edfcc44b2873364942b9ecd69bf57defb40
- MD5 d54dda22bb374be5ac6862ea757cad82
- SHA1 ff2a6710991145c039915869b3887536376b3b83
- SHA512 018fff3bd7f613f8546037c0b7bacb3a0abd35f51f6bdd33f913341196900da350d824a598616147784f01aba1a2ec0d7e6de2bd05964328028d5420361a5151
- SSDEEP 1536:U0bOkVGVspAwPhVq9othBh65GwDcTJfR1nAj:h6kVG6pAgMcTJ51nA
- TLSH T152636C217350C67AC196283AA465C7722E7E75301BF585CBBB5707BE9E312C0B77A30A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 851829d5c692e91f8b533cb5532cadb984dcb834c8462132b1ac828fd5ea542d
- MD5 43c8f0f5a32ecaf5c3d686af0cf22d2f
- SHA1 46302bfbcb045de0cb034e2cffef30a3f0508ca2
- SHA512 939cf4a2d48caa16e7ad82542762722e8bbc24fa0077c053e42d1e891e361443608ac8bfa23e033b040852abc3b89dc2cedc45bf3a14e1c515e5c656159bc1b9
- SSDEEP 24576:OFo3DMPXdoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfURep:4H0
- TLSH T16957162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{91ee42e8-ce62-486d-9cd6-dc629d590685}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e866c6c922b2815b739c7ef4a2761bf6d3a902256ea099cc795a5df2e13eeca1
- MD5 2b9a08f84031d9ecb2518ef90849a3c5
- SHA1 1d0651b7cf57b7dacfcd794fc05a121bc354c38a
- SHA512 82de2622181b06f479dd43481d9f33e1b42be1a3295516c59c16b0c3a60459ec394625990fb2435fa7f01d2e5ae8f6c364326c282e022882a844dd69481dd742
- SSDEEP 96:FTqEehtvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:AEGb++uVmN
- TLSH T19DD189184AF54711E2B3AB3228F58557A877B911EF33CB8E0198638E2671910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH