Analysis
- max time kernel
148s - max time network
98s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer_91473f.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer_91473f.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Installer_91473f.msi
- Size 13.2MB
- Sample260822-pellfayvb1
- SHA256 2783dbc396d12e6d7a480e9e2739cd8ff8d5018d610fb707452f75380afa7603
- MD5 4170a4ce056b6c469ddbb8e3428619dc
- SHA1 9ddcbf52fb7f0d1eeaa4d7516cc89ecad0823577
- SHA512 4ee5c378875a1f74d7660e9defe2cffa9b621a37fdb91c107eee3786814b681325065a6612ddcdfe096c61e9fd73f73072ddfe448148d70ca5df5e3192614c5a
- SSDEEP 393216:YiUNI6isalHZ9m/NjZI/i6ZB2LpgU7fpxiv24L:Y5NAINCZB2LPfip
- TLSH T164E63365F96F1B28F7183779457589824D23BC0DB748DA3271AA73E417F6AF8A2F0060
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5644 indexer_edc0.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5644 indexer_edc0.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59484a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF2AF2E4BB21DFBF12.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3AE5B294CA40F1B1.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF6F899634E5D6585B.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{521C15A2-01EA-4983-8A58-5ACB0A1396E8} msiexec.exe File created C:\Windows\SystemTemp\~DFB671FD452517CFA2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4E84.tmp msiexec.exe File created C:\Windows\Installer\e59484c.msi msiexec.exe File created C:\Windows\Installer\e59484a.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2868 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4740 msiexec.exe 4740 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 4740 msiexec.exe Token: SeCreateTokenPrivilege 2868 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2868 msiexec.exe Token: SeLockMemoryPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeMachineAccountPrivilege 2868 msiexec.exe Token: SeTcbPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 2868 msiexec.exe Token: SeTakeOwnershipPrivilege 2868 msiexec.exe Token: SeLoadDriverPrivilege 2868 msiexec.exe Token: SeSystemProfilePrivilege 2868 msiexec.exe Token: SeSystemtimePrivilege 2868 msiexec.exe Token: SeProfSingleProcessPrivilege 2868 msiexec.exe Token: SeIncBasePriorityPrivilege 2868 msiexec.exe Token: SeCreatePagefilePrivilege 2868 msiexec.exe Token: SeCreatePermanentPrivilege 2868 msiexec.exe Token: SeBackupPrivilege 2868 msiexec.exe Token: SeRestorePrivilege 2868 msiexec.exe Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeDebugPrivilege 2868 msiexec.exe Token: SeAuditPrivilege 2868 msiexec.exe Token: SeSystemEnvironmentPrivilege 2868 msiexec.exe Token: SeChangeNotifyPrivilege 2868 msiexec.exe Token: SeRemoteShutdownPrivilege 2868 msiexec.exe Token: SeUndockPrivilege 2868 msiexec.exe Token: SeSyncAgentPrivilege 2868 msiexec.exe Token: SeEnableDelegationPrivilege 2868 msiexec.exe Token: SeManageVolumePrivilege 2868 msiexec.exe Token: SeImpersonatePrivilege 2868 msiexec.exe Token: SeCreateGlobalPrivilege 2868 msiexec.exe Token: SeBackupPrivilege 4692 vssvc.exe Token: SeRestorePrivilege 4692 vssvc.exe Token: SeAuditPrivilege 4692 vssvc.exe Token: SeBackupPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2868 msiexec.exe 2868 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2868 msiexec.exe 4740 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4740 wrote to memory of 1956 4740 msiexec.exe 94 PID 4740 wrote to memory of 5644 4740 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer_91473f.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2868
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Qualcomm\Wireless Toolkit\indexer_edc0.exe"C:\Users\Admin\AppData\Local\Qualcomm\Wireless Toolkit\indexer_edc0.exe" /nologo "C:\Users\Admin\AppData\Local\Qualcomm\Wireless Toolkit\indexer_edc0.csproj" /nr:false2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5644
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59484b.rbs
- Size 9KB
- SHA256 7e94acbe0d739c18bca9656cb1b8dd592521d2c1cdb08cf152c58f8a8df0a68e
- MD5 d0595e1b8526064ba816e54dbea7442f
- SHA1 11559ae312b13da132a31143107d45bc5cd8b840
- SHA512 f578bcb2953a3b76cb322ad9e32ea3f7d3d5828bbf9aa2033f1c8a4eb598b164773ef5ca28858f5c1bb459336286a96e37581dcbdbd6fbbff1ea6a288e0632cd
- SSDEEP 192:E9ErvC8apMQwjINQwj8/DYZ6l10I8/UEpf2k2XePy8W:E9EBa2QwEQwg/EZ6l10I8Mm2k2XePy8W
- TLSH T109126351BA90C9F3D4962737CA6387253BB6E3E8D342335F14CD91780B13B699E4928B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Qualcomm\Wireless Toolkit\NodaTime.dll
- Size 17.6MB
- SHA256 4c806f7c25917c8975e949ba1b6b28046520077147c2ed8cb820f624f4c56616
- MD5 75a59c4df47372d06aaabca095f25b2b
- SHA1 7d8a1cb548d80b229e0f924d3b32fed1d8540ae8
- SHA512 afce5a56b3427c452e9aeac101a9319529bf3abb2d45393810f8c9f2adfc58a65a58e6382678f56ff34126ee5a7bd933f7ad1f3ba2b60135a6a454bf0412541b
- SSDEEP 196608:Addsk7OLdVb3fCMWM8C85DAJDy+Jh7QZ4i7HJQL3DrL:AdN7OLd96MWMUqJmqdalrJQLTrL
- TLSH T10307898130182D22DD62A52B1CFAB71167D4AC0FFBD6EF099159EF3B3D1B98E1E02519
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Qualcomm\Wireless Toolkit\indexer_edc0.csproj
- Size 545B
- SHA256 d8779fcee2ec848c91c7f640b1bc4813c7352655d9ddfecb7ff52d1397488473
- MD5 6363032b87959c3a0cf4efa1392ba7c2
- SHA1 680209315c8d30f3122a31858f157722b37e82d0
- SHA512 9dd9264cbca98468e602d8b5d962af8d3e92cf2d4b9b18cd1dbd5191c42e977cc2b0d09ec78c131ba07d7a7f4e929e3c5ef2ed50942dc613a3908abd5aa39460
- TLSH T1D2F02B0470C0ACA2A6F00A6BE9744559FAF597F764744CB8FA92B10E53A945405133B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Qualcomm\Wireless Toolkit\indexer_edc0.exe
- Size 246KB
- SHA256 3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33
- MD5 2d6ebd59b568586a8f1683b07de897e1
- SHA1 ca4af6cd9ebdcf9d29481be1a1229697cb56d54c
- SHA512 67d24d8b5bda715c6bc6c77d2dfa193d6bfca7480c2b46750d9e5b5171de5341fa64e0b02d797eca3839d1bd646d84f002ac654c8f5c0040469e8feb5d6c46d6
- SSDEEP 3072:6DEKKwBWmSEoRoocfZO8gQYiY35ePw2XpFU4rwOe1ZbZEFf02RFiZWr5MAh6i:UHK2W0u1EO80+RXf1102bio62j
- TLSH T17E345901A7EC0615F6FF0AB8B8B055158B76F867E866D75E388C61AC1F73740EA60363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59484a.msi
- Size 13.2MB
- SHA256 2783dbc396d12e6d7a480e9e2739cd8ff8d5018d610fb707452f75380afa7603
- MD5 4170a4ce056b6c469ddbb8e3428619dc
- SHA1 9ddcbf52fb7f0d1eeaa4d7516cc89ecad0823577
- SHA512 4ee5c378875a1f74d7660e9defe2cffa9b621a37fdb91c107eee3786814b681325065a6612ddcdfe096c61e9fd73f73072ddfe448148d70ca5df5e3192614c5a
- SSDEEP 393216:YiUNI6isalHZ9m/NjZI/i6ZB2LpgU7fpxiv24L:Y5NAINCZB2LPfip
- TLSH T164E63365F96F1B28F7183779457589824D23BC0DB748DA3271AA73E417F6AF8A2F0060
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 71a9be6a3e9093cad7e7a80be2f27b19b8febf6e2fb9872f039f983a09f17f91
- MD5 e99b9008397a3a7836085371c5376b54
- SHA1 869ef4073da54f7223b5c02b8867867a3a306390
- SHA512 71a9f43a733d5f82397dc40ec45664062fb5f90714756058cca1daaa5a5e9bcb31fe99bbb5e7d2ee0698ccf2f0f6117f0c58ec66656aec760a127990eb83e1a4
- SSDEEP 24576:IFo3DMPRdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:oH0
- TLSH T1BB57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{20d80e38-bad0-4b22-bd6e-6d6bbe18b795}_OnDiskSnapshotProp
- Size 6KB
- SHA256 10d4a29c637e8121416aa77388ab0797fda0496f7387e1e50625ddcaca2b67af
- MD5 a02a56758baec21126119a19efa1c62e
- SHA1 b4c0b2b88dcd859f0c6cb0d583c1044970dd945c
- SHA512 f5ab2396e05c48769cef37ba2f03da70df7175d0608f4614801dcd876f479f362f78a91e4d857efd77e0fa0cbcad77d25a074cbdd78a46c661836d907644804a
- SSDEEP 96:F0AeW5m1lDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:eAh8l/b++uVmN
- TLSH T125D189085AF54711E2F3AB3229F14557A837B911EF33CB8E0198238E6671A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH