Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mixing-station-pc-windows-3.1.3_763.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
mixing-station-pc-windows-3.1.3_763.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target mixing-station-pc-windows-3.1.3_763.exe
- Size 81.4MB
- Sample260818-27ls5atzcs
- SHA256 86f5404c3334ed6266c3f67bcd5df334b8621a5715af1003aa0c1a8c0466adeb
- MD5 d59bb0e54be1d72883d7573372368830
- SHA1 fa4f4da353a2cc1ae61e715230e3468387eafbae
- SHA512 9aa233e20365b975d6a6a096818507a92403e1c9a1cd42b6e57418fb03502fdfcec267761f1111115eb2a33d153dbacaf5ff74c7fb59959346803a3ab3bcb23f
- SSDEEP 1572864:LIDyi9kBoKBhNqCE6nB1bAPkO/XKK09mKEVjJygZdjQxLzJs7eN:LIX+BoChBE4B12XKrtEZJRZdjQk7G
- TLSH T17918333E6C59CA2FD36259344491512E97713CE34627F6A3A28CB67D1A32EBC672C730
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 924 MsiExec.exe 4164 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFFDAFDB8505F7E61D.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF89AE46331AE50F6F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI801.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF11EB084E036BC617.TMP msiexec.exe File created C:\Windows\Installer\e59f91c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{177B8CA4-B53B-44C0-BD57-A0E0132B3DD7} msiexec.exe File created C:\Windows\Installer\e59f91e.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE19FFF71A184987C.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59f91c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3948 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\URL Protocol msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\DefaultIcon msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\shell\open msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\ = "URL:Mixing Station" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\DefaultIcon\ = "mixing-station-pc.exe" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\shell msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\mixing-station-pc\\mixing-station-pc.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\mixingstation msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4064 msiexec.exe 4064 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3948 msiexec.exe Token: SeIncreaseQuotaPrivilege 3948 msiexec.exe Token: SeSecurityPrivilege 4064 msiexec.exe Token: SeCreateTokenPrivilege 3948 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3948 msiexec.exe Token: SeLockMemoryPrivilege 3948 msiexec.exe Token: SeIncreaseQuotaPrivilege 3948 msiexec.exe Token: SeMachineAccountPrivilege 3948 msiexec.exe Token: SeTcbPrivilege 3948 msiexec.exe Token: SeSecurityPrivilege 3948 msiexec.exe Token: SeTakeOwnershipPrivilege 3948 msiexec.exe Token: SeLoadDriverPrivilege 3948 msiexec.exe Token: SeSystemProfilePrivilege 3948 msiexec.exe Token: SeSystemtimePrivilege 3948 msiexec.exe Token: SeProfSingleProcessPrivilege 3948 msiexec.exe Token: SeIncBasePriorityPrivilege 3948 msiexec.exe Token: SeCreatePagefilePrivilege 3948 msiexec.exe Token: SeCreatePermanentPrivilege 3948 msiexec.exe Token: SeBackupPrivilege 3948 msiexec.exe Token: SeRestorePrivilege 3948 msiexec.exe Token: SeShutdownPrivilege 3948 msiexec.exe Token: SeDebugPrivilege 3948 msiexec.exe Token: SeAuditPrivilege 3948 msiexec.exe Token: SeSystemEnvironmentPrivilege 3948 msiexec.exe Token: SeChangeNotifyPrivilege 3948 msiexec.exe Token: SeRemoteShutdownPrivilege 3948 msiexec.exe Token: SeUndockPrivilege 3948 msiexec.exe Token: SeSyncAgentPrivilege 3948 msiexec.exe Token: SeEnableDelegationPrivilege 3948 msiexec.exe Token: SeManageVolumePrivilege 3948 msiexec.exe Token: SeImpersonatePrivilege 3948 msiexec.exe Token: SeCreateGlobalPrivilege 3948 msiexec.exe Token: SeCreateTokenPrivilege 3948 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3948 msiexec.exe Token: SeLockMemoryPrivilege 3948 msiexec.exe Token: SeIncreaseQuotaPrivilege 3948 msiexec.exe Token: SeMachineAccountPrivilege 3948 msiexec.exe Token: SeTcbPrivilege 3948 msiexec.exe Token: SeSecurityPrivilege 3948 msiexec.exe Token: SeTakeOwnershipPrivilege 3948 msiexec.exe Token: SeLoadDriverPrivilege 3948 msiexec.exe Token: SeSystemProfilePrivilege 3948 msiexec.exe Token: SeSystemtimePrivilege 3948 msiexec.exe Token: SeProfSingleProcessPrivilege 3948 msiexec.exe Token: SeIncBasePriorityPrivilege 3948 msiexec.exe Token: SeCreatePagefilePrivilege 3948 msiexec.exe Token: SeCreatePermanentPrivilege 3948 msiexec.exe Token: SeBackupPrivilege 3948 msiexec.exe Token: SeRestorePrivilege 3948 msiexec.exe Token: SeShutdownPrivilege 3948 msiexec.exe Token: SeDebugPrivilege 3948 msiexec.exe Token: SeAuditPrivilege 3948 msiexec.exe Token: SeSystemEnvironmentPrivilege 3948 msiexec.exe Token: SeChangeNotifyPrivilege 3948 msiexec.exe Token: SeRemoteShutdownPrivilege 3948 msiexec.exe Token: SeUndockPrivilege 3948 msiexec.exe Token: SeSyncAgentPrivilege 3948 msiexec.exe Token: SeEnableDelegationPrivilege 3948 msiexec.exe Token: SeManageVolumePrivilege 3948 msiexec.exe Token: SeImpersonatePrivilege 3948 msiexec.exe Token: SeCreateGlobalPrivilege 3948 msiexec.exe Token: SeCreateTokenPrivilege 3948 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3948 msiexec.exe Token: SeLockMemoryPrivilege 3948 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3948 msiexec.exe 3948 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3948 msiexec.exe 4064 msiexec.exe 924 MsiExec.exe 4164 MsiExec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5072 wrote to memory of 3948 5072 mixing-station-pc-windows-3.1.3_763.exe 89 PID 4064 wrote to memory of 924 4064 msiexec.exe 91 PID 4064 wrote to memory of 3380 4064 msiexec.exe 97 PID 4064 wrote to memory of 4164 4064 msiexec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixing-station-pc-windows-3.1.3_763.exe"C:\Users\Admin\AppData\Local\Temp\mixing-station-pc-windows-3.1.3_763.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\240738125.tmp\main.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3948
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B74A4E12C65F12326CCE047EEC6D28D C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:924
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3380
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8039BD5985E40CD30601F1A2C76070CF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4164
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f91d.rbs
- Size 70KB
- SHA256 192b08cebc0e03cf4f453c1881542388349cba9ac4a6a0a2d39a426f82ef7cc9
- MD5 33532a9b854e0529b510af2e6d66ded5
- SHA1 3385979e5f9eb040108ebdb61fb7c44f623a7e99
- SHA512 99f8c35d67914ab7a4f5d1de04d9690e2c0f9af61fb7b28dea1dfa0740b810f3c92773f79f09b538d891aa9a67d1a58d65eb1028418b135926393c5d535ba4e4
- SSDEEP 1536:j9X43oW5KDg8kvXzJ96p7qMoB/dn6OO66oILmm90sqb7YDpV+XGqN3eUwLJXb6QW:jG0p03
- TLSH T1E363CF99ED43C6C9D80009A343A25A5DF434AEA56EB9E05C2F4B45A70DFA14EDFC708F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI981F.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\mixing-station-pc\runtime\legal\java.datatransfer\LICENSE
- Size 33B
- SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
- MD5 16989bab922811e28b64ac30449a5d05
- SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
- SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\mixing-station-pc\runtime\legal\java.security.sasl\ADDITIONAL_LICENSE_INFO
- Size 49B
- SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
- MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
- SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
- SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\mixing-station-pc\runtime\legal\jdk.unsupported\ASSEMBLY_EXCEPTION
- Size 44B
- SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
- MD5 7caf4cdbb99569deb047c20f1aad47c4
- SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
- SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI3F9.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 75aaa47b1e29ef7ecea02bd59d775b4b4aa55f8dbb01b07d6a2613d9ee1e201e
- MD5 2b9388c4ccdf0580ffcdcf2e42e14de4
- SHA1 40b1340f4e412f707202172429de1b889ae7f50a
- SHA512 e2789cd34c480dda67d0b13f370583a770d738ff07b486c1a3cccc398acc1f65c37d771cb0ae26a87f68509f6886974e622aa0819374a4759ae1d593dbe1c8a8
- SSDEEP 24576:LFo3DMP2doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+n:UHk
- TLSH T13957B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5bcc4e33-ff12-459c-9314-3a9eb2240514}_OnDiskSnapshotProp
- Size 6KB
- SHA256 2133af83a39c7e915a512e2136f5f18766903354d7c8b89056173331d264cd4b
- MD5 547396d77bd65560c8c4dc52f379412f
- SHA1 84c2627679c6e67da7a76c649924317ccba02041
- SHA512 885b90a432768749511fce96540c2a85cd47f72db9645bf7c9390d0703454e39a3a624c61d88828f48cef5ebcfa3e6eeb26dd848e3c7aac69476477839cc9143
- SSDEEP 96:FiBIJGb4vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:kBIJlb++uVmN
- TLSH T160D188085AF54711E2B3AB3168F14557A877B911EF33CB8E0198238E6671A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH