Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_b6j009.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_b6j009.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target install_b6j009.msi
- Size 7.3MB
- Sample260818-ernapawblf
- SHA256 f720b8b0971c2bc87d07363e7ffbbdb5da4210ce49a152dd464d33ba1651f20a
- MD5 4275c9375fb90a61ca512880be6a92f7
- SHA1 96fd1ae1a8a9d3a2cd6501f257bb7400746ec84b
- SHA512 c836e11885a98ad032c37a614e490495c4fa4a032629dc7c6ef5074eb678b79cc4977b6dc7ec11b92128f0bb15dba2b8ce80b9a03e6715a565ee0f970de3de7e
- SSDEEP 196608:QXt55xUprACGzmK3wQSmAglLRZdJ4hzj6nxCxD:oGrAhl3wQSmAgldeljyQxD
- TLSH T19976338ABE8167B5C09BC3785246358F7579BFC66E3E8C0632E87E482E327176071749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4536 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 4536 MsiExec.exe 13 4536 MsiExec.exe 15 4536 MsiExec.exe 17 4536 MsiExec.exe 18 4536 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF50265823C37965EF.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBB58.tmp msiexec.exe File created C:\Windows\Installer\e59b55c.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195} msiexec.exe File created C:\Windows\SystemTemp\~DF823A956441D73D9A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBACA.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59b55c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3012 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5968 msiexec.exe 5968 msiexec.exe 4536 MsiExec.exe 4536 MsiExec.exe 4536 MsiExec.exe 4536 MsiExec.exe 4536 MsiExec.exe 4536 MsiExec.exe 4536 MsiExec.exe 4536 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 3012 msiexec.exe Token: SeIncreaseQuotaPrivilege 3012 msiexec.exe Token: SeSecurityPrivilege 5968 msiexec.exe Token: SeCreateTokenPrivilege 3012 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3012 msiexec.exe Token: SeLockMemoryPrivilege 3012 msiexec.exe Token: SeIncreaseQuotaPrivilege 3012 msiexec.exe Token: SeMachineAccountPrivilege 3012 msiexec.exe Token: SeTcbPrivilege 3012 msiexec.exe Token: SeSecurityPrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeLoadDriverPrivilege 3012 msiexec.exe Token: SeSystemProfilePrivilege 3012 msiexec.exe Token: SeSystemtimePrivilege 3012 msiexec.exe Token: SeProfSingleProcessPrivilege 3012 msiexec.exe Token: SeIncBasePriorityPrivilege 3012 msiexec.exe Token: SeCreatePagefilePrivilege 3012 msiexec.exe Token: SeCreatePermanentPrivilege 3012 msiexec.exe Token: SeBackupPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeShutdownPrivilege 3012 msiexec.exe Token: SeDebugPrivilege 3012 msiexec.exe Token: SeAuditPrivilege 3012 msiexec.exe Token: SeSystemEnvironmentPrivilege 3012 msiexec.exe Token: SeChangeNotifyPrivilege 3012 msiexec.exe Token: SeRemoteShutdownPrivilege 3012 msiexec.exe Token: SeUndockPrivilege 3012 msiexec.exe Token: SeSyncAgentPrivilege 3012 msiexec.exe Token: SeEnableDelegationPrivilege 3012 msiexec.exe Token: SeManageVolumePrivilege 3012 msiexec.exe Token: SeImpersonatePrivilege 3012 msiexec.exe Token: SeCreateGlobalPrivilege 3012 msiexec.exe Token: SeBackupPrivilege 1512 vssvc.exe Token: SeRestorePrivilege 1512 vssvc.exe Token: SeAuditPrivilege 1512 vssvc.exe Token: SeBackupPrivilege 5968 msiexec.exe Token: SeRestorePrivilege 5968 msiexec.exe Token: SeRestorePrivilege 5968 msiexec.exe Token: SeTakeOwnershipPrivilege 5968 msiexec.exe Token: SeRestorePrivilege 5968 msiexec.exe Token: SeTakeOwnershipPrivilege 5968 msiexec.exe Token: SeRestorePrivilege 5968 msiexec.exe Token: SeTakeOwnershipPrivilege 5968 msiexec.exe Token: SeBackupPrivilege 1248 srtasks.exe Token: SeRestorePrivilege 1248 srtasks.exe Token: SeSecurityPrivilege 1248 srtasks.exe Token: SeTakeOwnershipPrivilege 1248 srtasks.exe Token: SeBackupPrivilege 1248 srtasks.exe Token: SeRestorePrivilege 1248 srtasks.exe Token: SeSecurityPrivilege 1248 srtasks.exe Token: SeTakeOwnershipPrivilege 1248 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3012 msiexec.exe 5968 msiexec.exe 4536 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5968 wrote to memory of 1248 5968 msiexec.exe 94 PID 5968 wrote to memory of 4536 5968 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_b6j009.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3012
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 42C54EE73E94EF52F9D5AC899ED3EBB5 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4536
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1512
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSIBB58.tmp
- Size 7.3MB
- SHA256 011fcae98dadfb143cb566922996c9c9c8c9fcc301644e3544eee8077243449f
- MD5 23a581e35eb371f5021248035f9a09a0
- SHA1 0033ef613a3ef4a33374869d5406ec033d1f9804
- SHA512 81206048712312d7f1f6b9b03993112b72493abeffb2afff32b32b296a44ca98ea08ecf39c8d248123fcf8c223575250d3e3e62e61a44b9a3f8ff1ecce212b9d
- SSDEEP 196608:NXt55xUprACGzmK3wQSzAglLRZdJ4hzj6nxCxd:pGrAhl3wQSzAgldeljyQxd
- TLSH T14276338ABE9263B4C09BC3BC5246359F7579BBC76D3E8C0636E86D482E727076070749
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 f55140bea1cd6321c91b0abad7343af47c38413481aacf7d0eb530c364501bd0
- MD5 8b3d3221fb7df8ef81c90fedcc998ce2
- SHA1 3712554aa1cdd6bf8817c675b6f9683fa1bdcb92
- SHA512 1ebc77c00dfdb0218f1ab25bd8fde234c6d88c7e1fe0bf5902b953d5467fe1a7dc8d1214668ac471702000b543b40ad6fec85ad58428f24e1fb40ea399f9b52a
- SSDEEP 24576:tFo3DMPKdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:CHI
- TLSH T16057B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{99826642-3135-4979-921f-004327c56c2b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 53a80aa5c0e1e6fc1bfaec9ae387dd264bd276f14f752228538dc1b9a348d3ab
- MD5 88838941ea0fcd05b608dbf898e613b3
- SHA1 3e3aa2f14aa3daccd2716385df62861051c9cb7f
- SHA512 ac7296d78c8b8ca8708d380cb9a959fc8b45bd7ee7a071f39093ba2af8c48f4215bc90159d9abf574b734d95e2e031d26115a0b99bc02d1a48bef33f34bd99a1
- SSDEEP 96:F1IMb6vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:rIZb++uVmN
- TLSH T151D188085AF54711E2B3AB3128F18557A837B951FF33CB8E0198238E2671A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH