Analysis
- max time kernel
149s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer_c2cea6.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer_c2cea6.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Installer_c2cea6.msi
- Size 11.9MB
- Sample260817-pl5mwszemb
- SHA256 44da9c84a1c69a63a661485db45ac537532e9426772c4c8415bfe50dfbae0f10
- MD5 f412882f01c17ccdb4f3c0ddf4716bb8
- SHA1 1930cb9b8f79863fe4e1b81e2b0c5985c8bbb012
- SHA512 d8329f93ce4d2760db5f7c10f75c027e1c74974472d66dc2ed29d1d71924d48bfe8b498575aa74e4ccdf1044235d24c542817ae4c1feb5bb353b23693d9ba3db
- SSDEEP 196608:gRboKh/qElhPA4WeNE/xxUC4swU6xGJ8xZvdjwUy2MJ/FWMZMXXVi2DZAu:gRh9LifJ/xx/4swfGa/vqMMGXlv7
- TLSH T1A2C633B1DD23A776DC9E8EB2899ACFD7983A0C551327D16AE26475CDB533B22731C200
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2432 analytics_c441.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2432 analytics_c441.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFD669D02CFCF2ADCD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA5FA.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFD625695D75A89AD6.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3D2691E43EA199D9.TMP msiexec.exe File created C:\Windows\Installer\e599e98.msi msiexec.exe File opened for modification C:\Windows\Installer\e599e98.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0CEDD526-84C4-4918-8BD8-AE58BF19EE10} msiexec.exe File created C:\Windows\SystemTemp\~DF9245E70C04B966E2.TMP msiexec.exe File created C:\Windows\Installer\e599e9a.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4644 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5228 msiexec.exe 5228 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4644 msiexec.exe Token: SeIncreaseQuotaPrivilege 4644 msiexec.exe Token: SeSecurityPrivilege 5228 msiexec.exe Token: SeCreateTokenPrivilege 4644 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4644 msiexec.exe Token: SeLockMemoryPrivilege 4644 msiexec.exe Token: SeIncreaseQuotaPrivilege 4644 msiexec.exe Token: SeMachineAccountPrivilege 4644 msiexec.exe Token: SeTcbPrivilege 4644 msiexec.exe Token: SeSecurityPrivilege 4644 msiexec.exe Token: SeTakeOwnershipPrivilege 4644 msiexec.exe Token: SeLoadDriverPrivilege 4644 msiexec.exe Token: SeSystemProfilePrivilege 4644 msiexec.exe Token: SeSystemtimePrivilege 4644 msiexec.exe Token: SeProfSingleProcessPrivilege 4644 msiexec.exe Token: SeIncBasePriorityPrivilege 4644 msiexec.exe Token: SeCreatePagefilePrivilege 4644 msiexec.exe Token: SeCreatePermanentPrivilege 4644 msiexec.exe Token: SeBackupPrivilege 4644 msiexec.exe Token: SeRestorePrivilege 4644 msiexec.exe Token: SeShutdownPrivilege 4644 msiexec.exe Token: SeDebugPrivilege 4644 msiexec.exe Token: SeAuditPrivilege 4644 msiexec.exe Token: SeSystemEnvironmentPrivilege 4644 msiexec.exe Token: SeChangeNotifyPrivilege 4644 msiexec.exe Token: SeRemoteShutdownPrivilege 4644 msiexec.exe Token: SeUndockPrivilege 4644 msiexec.exe Token: SeSyncAgentPrivilege 4644 msiexec.exe Token: SeEnableDelegationPrivilege 4644 msiexec.exe Token: SeManageVolumePrivilege 4644 msiexec.exe Token: SeImpersonatePrivilege 4644 msiexec.exe Token: SeCreateGlobalPrivilege 4644 msiexec.exe Token: SeBackupPrivilege 3316 vssvc.exe Token: SeRestorePrivilege 3316 vssvc.exe Token: SeAuditPrivilege 3316 vssvc.exe Token: SeBackupPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe Token: SeTakeOwnershipPrivilege 5228 msiexec.exe Token: SeRestorePrivilege 5228 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4644 msiexec.exe 4644 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 msiexec.exe 5228 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5228 wrote to memory of 5176 5228 msiexec.exe 95 PID 5228 wrote to memory of 2432 5228 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer_c2cea6.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4644
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5176
-
-
C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.exe"C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.exe" /nologo "C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.csproj" /nr:false2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2432
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e599e99.rbs
- Size 9KB
- SHA256 84bdafc10a57e3f915ec03e479e07646829223a143429eb7a543b4d6242437ae
- MD5 67b9aef47e43cf4a7ad4a6fbf2557f6c
- SHA1 f146aa3ed1d3f663832861b75445e7cf9bfe0b88
- SHA512 eb1b60ab3cf211ea8dd6dce2e86b2b89863d83d48448603e3f8055657e017f7e5c9e91ce1749be9c07682bc7f41adb8558876940b0a9fa9c9d38e2fd453c4862
- SSDEEP 96:0ERrFYCVFP333MajulCwIirWU/oKCsThqBU/oKC6jI6i/ThqBH8/2T1cci01+Q1a:0IrqlCgJQZI5QZzahGSps
- TLSH T1C4123F02B608C5D2F9B62732D36317197BB7D3C6E205234B0C8D94651F527ECEA9758B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\Nancy.dll
- Size 15.7MB
- SHA256 eb62bd2ce4de4d0902d4bf14b5de2aa7a384501234d2aaa8378460eb26499b13
- MD5 5f2ea2334aecd2d0bb7e8f5ce475e8ac
- SHA1 b1ccd47d30d5db06750c0c6a3a2e41fcf6b4293b
- SHA512 ebfb4d0a5e71a6f65ae2e999e71a27e7346c7068105bb26aaa282be815b4b6ae1f02e51211d86948e39cb8bddb0ec3b98a77f66bf3194143e6b6aa98f9cbbe92
- SSDEEP 196608:CbN7bCcQuj+hRqe6piX5Jn56UWk0A9MAhp5derf5bMYY6G4k4JQUf21:CbZ9eR74o99lh1er5bTTk45f21
- TLSH T1FAF6CE01F9489F9D923BFB1737B3D42946D09ADE5736C70DAC2067F2A6662011E2FB18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.csproj
- Size 367B
- SHA256 9e070fcdd49691d0547f79563e38a24909605ef31f34d9bd95c9afe1738db2d3
- MD5 5984fa1e47abf9f29871156c21107a92
- SHA1 0b90a85714eba98873793c9aa36df00f13da89eb
- SHA512 1dd995288f257723af4f394dd260230f9d97e97170dc2e6f9b47d16eba9fe8ffef504f74b222a7227ebdbb5ea010e6576a3ed7a2ef498cc07ca39cd7c1515de9
- TLSH T120E02A0061819C9617600733BD64D795B7B5F7F718740C5CF84B705F93174D44497693
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Realtek\HD Audio Manager\analytics_c441.exe
- Size 246KB
- SHA256 3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33
- MD5 2d6ebd59b568586a8f1683b07de897e1
- SHA1 ca4af6cd9ebdcf9d29481be1a1229697cb56d54c
- SHA512 67d24d8b5bda715c6bc6c77d2dfa193d6bfca7480c2b46750d9e5b5171de5341fa64e0b02d797eca3839d1bd646d84f002ac654c8f5c0040469e8feb5d6c46d6
- SSDEEP 3072:6DEKKwBWmSEoRoocfZO8gQYiY35ePw2XpFU4rwOe1ZbZEFf02RFiZWr5MAh6i:UHK2W0u1EO80+RXf1102bio62j
- TLSH T17E345901A7EC0615F6FF0AB8B8B055158B76F867E866D75E388C61AC1F73740EA60363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e599e98.msi
- Size 11.9MB
- SHA256 44da9c84a1c69a63a661485db45ac537532e9426772c4c8415bfe50dfbae0f10
- MD5 f412882f01c17ccdb4f3c0ddf4716bb8
- SHA1 1930cb9b8f79863fe4e1b81e2b0c5985c8bbb012
- SHA512 d8329f93ce4d2760db5f7c10f75c027e1c74974472d66dc2ed29d1d71924d48bfe8b498575aa74e4ccdf1044235d24c542817ae4c1feb5bb353b23693d9ba3db
- SSDEEP 196608:gRboKh/qElhPA4WeNE/xxUC4swU6xGJ8xZvdjwUy2MJ/FWMZMXXVi2DZAu:gRh9LifJ/xx/4swfGa/vqMMGXlv7
- TLSH T1A2C633B1DD23A776DC9E8EB2899ACFD7983A0C551327D16AE26475CDB533B22731C200
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e607ad049e6567d1c46a401ae93e03662c9f70bed861c76961d44cd19a8f6511
- MD5 1f5fa62f7e9fc508cefaa9c6190a3d52
- SHA1 bffbe995027c4e040e6d4b888aaf8cd859ef2f96
- SHA512 8dfee0110d3d68069d01f1a1b8843f4bd9800d882216bf67c4fcc1d486f3dcd6022a0f825310120391ebc5f0925e1a02c8d1a5dbc34975fcc4a69d6c9c721ad7
- SSDEEP 24576:8Fo3DMPldoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+n:oHk
- TLSH T1F357B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{53552a13-b75f-4104-b05a-9c3ccf78a23a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e22524a8c775f0b2677e3cd9f1d05c091521aa2a2275ae23bf11b0b2484d43f5
- MD5 71e16f5f644c75e54f0030ffb0c07ae7
- SHA1 81d04c13cf30bf63089e2d89fd9374738cef89e8
- SHA512 54205950ae8501211151b67dfae9b16814ca1bd7b244a3604c04c1bb757e181a0de2533a45a8a7971193e8c84b7f21654310fc1abb2a37722dcc944e2d28be50
- SSDEEP 96:FLeIg7bDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:IIcb++uVmN
- TLSH T1FBD178185AF54711E2B3AB3128F18557A877B911FF33CB8E0198238E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH