Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer_c2cea6.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer_c2cea6.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Installer_c2cea6.msi
- Size 11.9MB
- Sample260817-pl5mwszemb
- SHA256 44da9c84a1c69a63a661485db45ac537532e9426772c4c8415bfe50dfbae0f10
- MD5 f412882f01c17ccdb4f3c0ddf4716bb8
- SHA1 1930cb9b8f79863fe4e1b81e2b0c5985c8bbb012
- SHA512 d8329f93ce4d2760db5f7c10f75c027e1c74974472d66dc2ed29d1d71924d48bfe8b498575aa74e4ccdf1044235d24c542817ae4c1feb5bb353b23693d9ba3db
- SSDEEP 196608:gRboKh/qElhPA4WeNE/xxUC4swU6xGJ8xZvdjwUy2MJ/FWMZMXXVi2DZAu:gRh9LifJ/xx/4swfGa/vqMMGXlv7
- TLSH T1A2C633B1DD23A776DC9E8EB2899ACFD7983A0C551327D16AE26475CDB533B22731C200
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4992 analytics_c441.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4992 analytics_c441.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{0CEDD526-84C4-4918-8BD8-AE58BF19EE10} msiexec.exe File created C:\Windows\Installer\e58e29d.msi msiexec.exe File created C:\Windows\Installer\e58e29b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIE3E3.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58e29b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1724 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2708 msiexec.exe 2708 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1724 msiexec.exe Token: SeIncreaseQuotaPrivilege 1724 msiexec.exe Token: SeSecurityPrivilege 2708 msiexec.exe Token: SeCreateTokenPrivilege 1724 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1724 msiexec.exe Token: SeLockMemoryPrivilege 1724 msiexec.exe Token: SeIncreaseQuotaPrivilege 1724 msiexec.exe Token: SeMachineAccountPrivilege 1724 msiexec.exe Token: SeTcbPrivilege 1724 msiexec.exe Token: SeSecurityPrivilege 1724 msiexec.exe Token: SeTakeOwnershipPrivilege 1724 msiexec.exe Token: SeLoadDriverPrivilege 1724 msiexec.exe Token: SeSystemProfilePrivilege 1724 msiexec.exe Token: SeSystemtimePrivilege 1724 msiexec.exe Token: SeProfSingleProcessPrivilege 1724 msiexec.exe Token: SeIncBasePriorityPrivilege 1724 msiexec.exe Token: SeCreatePagefilePrivilege 1724 msiexec.exe Token: SeCreatePermanentPrivilege 1724 msiexec.exe Token: SeBackupPrivilege 1724 msiexec.exe Token: SeRestorePrivilege 1724 msiexec.exe Token: SeShutdownPrivilege 1724 msiexec.exe Token: SeDebugPrivilege 1724 msiexec.exe Token: SeAuditPrivilege 1724 msiexec.exe Token: SeSystemEnvironmentPrivilege 1724 msiexec.exe Token: SeChangeNotifyPrivilege 1724 msiexec.exe Token: SeRemoteShutdownPrivilege 1724 msiexec.exe Token: SeUndockPrivilege 1724 msiexec.exe Token: SeSyncAgentPrivilege 1724 msiexec.exe Token: SeEnableDelegationPrivilege 1724 msiexec.exe Token: SeManageVolumePrivilege 1724 msiexec.exe Token: SeImpersonatePrivilege 1724 msiexec.exe Token: SeCreateGlobalPrivilege 1724 msiexec.exe Token: SeBackupPrivilege 4532 vssvc.exe Token: SeRestorePrivilege 4532 vssvc.exe Token: SeAuditPrivilege 4532 vssvc.exe Token: SeBackupPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1724 msiexec.exe 1724 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2708 wrote to memory of 4624 2708 msiexec.exe 101 PID 2708 wrote to memory of 4992 2708 msiexec.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer_c2cea6.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1724
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4624
-
-
C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.exe"C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.exe" /nologo "C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.csproj" /nr:false2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4992
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58e29c.rbs
- Size 9KB
- SHA256 54d9c113829f4383f89f7c494f90f0404a183956f98a9826494f5e39f29b7d26
- MD5 d24aa0c4a8dd22502a54fdae283c5706
- SHA1 3c372a64c2635c17970ecc615b8bef35a1eae5a3
- SHA512 c5ee512cb437b102fe55f126aeda5042e1b420dd088934d24e1aa0663c6d2e073bc84e3225cac9e33485d87dbff7fbb2123518be0794968b5ce00e94e2cecf4b
- SSDEEP 96:3EUrFYC7vP333Majukexmfm0WU/oKCsThqBU/oKC6jbmSmH/ThqBH6PUrm81ccFI:39LqkeKJQZI5QZdQhVSpf
- TLSH T1FF122041B70085E3F9662776DB1213253BB7C2C5E255378B088EA5740F0338CEA9AB9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\Nancy.dll
- Size 15.7MB
- SHA256 eb62bd2ce4de4d0902d4bf14b5de2aa7a384501234d2aaa8378460eb26499b13
- MD5 5f2ea2334aecd2d0bb7e8f5ce475e8ac
- SHA1 b1ccd47d30d5db06750c0c6a3a2e41fcf6b4293b
- SHA512 ebfb4d0a5e71a6f65ae2e999e71a27e7346c7068105bb26aaa282be815b4b6ae1f02e51211d86948e39cb8bddb0ec3b98a77f66bf3194143e6b6aa98f9cbbe92
- SSDEEP 196608:CbN7bCcQuj+hRqe6piX5Jn56UWk0A9MAhp5derf5bMYY6G4k4JQUf21:CbZ9eR74o99lh1er5bTTk45f21
- TLSH T1FAF6CE01F9489F9D923BFB1737B3D42946D09ADE5736C70DAC2067F2A6662011E2FB18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.csproj
- Size 367B
- SHA256 9e070fcdd49691d0547f79563e38a24909605ef31f34d9bd95c9afe1738db2d3
- MD5 5984fa1e47abf9f29871156c21107a92
- SHA1 0b90a85714eba98873793c9aa36df00f13da89eb
- SHA512 1dd995288f257723af4f394dd260230f9d97e97170dc2e6f9b47d16eba9fe8ffef504f74b222a7227ebdbb5ea010e6576a3ed7a2ef498cc07ca39cd7c1515de9
- TLSH T120E02A0061819C9617600733BD64D795B7B5F7F718740C5CF84B705F93174D44497693
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.exe
- Size 246KB
- SHA256 3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33
- MD5 2d6ebd59b568586a8f1683b07de897e1
- SHA1 ca4af6cd9ebdcf9d29481be1a1229697cb56d54c
- SHA512 67d24d8b5bda715c6bc6c77d2dfa193d6bfca7480c2b46750d9e5b5171de5341fa64e0b02d797eca3839d1bd646d84f002ac654c8f5c0040469e8feb5d6c46d6
- SSDEEP 3072:6DEKKwBWmSEoRoocfZO8gQYiY35ePw2XpFU4rwOe1ZbZEFf02RFiZWr5MAh6i:UHK2W0u1EO80+RXf1102bio62j
- TLSH T17E345901A7EC0615F6FF0AB8B8B055158B76F867E866D75E388C61AC1F73740EA60363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58e29b.msi
- Size 11.9MB
- SHA256 44da9c84a1c69a63a661485db45ac537532e9426772c4c8415bfe50dfbae0f10
- MD5 f412882f01c17ccdb4f3c0ddf4716bb8
- SHA1 1930cb9b8f79863fe4e1b81e2b0c5985c8bbb012
- SHA512 d8329f93ce4d2760db5f7c10f75c027e1c74974472d66dc2ed29d1d71924d48bfe8b498575aa74e4ccdf1044235d24c542817ae4c1feb5bb353b23693d9ba3db
- SSDEEP 196608:gRboKh/qElhPA4WeNE/xxUC4swU6xGJ8xZvdjwUy2MJ/FWMZMXXVi2DZAu:gRh9LifJ/xx/4swfGa/vqMMGXlv7
- TLSH T1A2C633B1DD23A776DC9E8EB2899ACFD7983A0C551327D16AE26475CDB533B22731C200
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 e21781b883f7b82a3e0d710e928dd5f1faa407c73a4d02b7d5b1625411dffc75
- MD5 19001493df9f5fab39e636acbc4e9dd1
- SHA1 6694a639dc68510ab9ff01d3df65d56a3fd07079
- SHA512 94df0f3e3d322f28bbfdb46f1a49f33bc11558d01061b932c50f8f016e58c1b51e61b5f380b9a6057f84fe8399a87162496d572416e1d1a26ee5263d21c36ef7
- SSDEEP 24576:su8m+1z7doO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:I
- TLSH T13247A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{550d5863-9a71-44ff-9b0e-59b49d92047c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 36ac6270140ab92046dcd524cc4323378912db3370ff36e2cf2f713631c5c8c3
- MD5 eb9836880b504c810838cb7880bd3f6f
- SHA1 b71aec5536dcef359a6c66e2a66cd358ba5e4a95
- SHA512 b6c9affee13ea01901cf60b3c4203b715006daa1f5e45b0ca052ef49beddd6812a6dbf8b27970777276fe2938b9772eef79f137c96af589574217490f8d723e4
- SSDEEP 96:F+mT7MSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:kmJb++ZVmN
- TLSH T1B6D178185AF54311E2B3AB3129F14557A877B912EF33CB8E0198238E6670910F976F5F
- MD5 SHA1 SHA512 SSDEEP TLSH