Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 18:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
v1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
v1.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target v1.msi
- Size 30KB
- Sample260824-wzsntaxzb1
- SHA256 857ddc808cdaa3827dfdc4a9228dc592ced79b68401508cf22cbf05ba55e84de
- MD5 f26a4d1729240981db30392eae51a6f7
- SHA1 bc6ed033ae2c2ffd8dd7ca4024648fb267c1b404
- SHA512 77e81ffee29776fbbb0d274ddd57608673ab4affe9e2ebbaed4a802660065213bd5d0cfe0e9bba27af2dda05af3a19e073df2519c709d2826dc8343e7bb26036
- SSDEEP 768:bKwCqjrDIuzEqPn6y2hyatkeWMbCdwGFN/nq:VlTB2ka+obiw3
- TLSH T1CBD26D46FA409336C5860B36450BEBE58F79AD19CF532102769AF35C3E71AD122F79D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 11 6016 powershell.exe 14 6016 powershell.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHost = "\"C:\\Users\\Admin\\AppData\\Local\\kksMt3Ij86Uy\\pmx4R1\\node.exe\" \"C:\\Users\\Admin\\AppData\\Local\\kksMt3Ij86Uy\\UOtxDp2zaW.bin\"" msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF028A6DE1765D783F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF052.tmp msiexec.exe File created C:\Windows\Installer\e59e9cc.msi msiexec.exe File created C:\Windows\SystemTemp\~DF7E043C568913AD3D.TMP msiexec.exe File created C:\Windows\Installer\e59e9ca.msi msiexec.exe File opened for modification C:\Windows\Installer\e59e9ca.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A1305645-903A-4676-81C4-4760F82B3BE2} msiexec.exe File created C:\Windows\SystemTemp\~DF8A21189244BB20C7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD4BA3052C6D9DB2E.TMP msiexec.exe -
pid Process 6016 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4684 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5448 msiexec.exe 5448 msiexec.exe 6016 powershell.exe 6016 powershell.exe 6016 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4684 msiexec.exe Token: SeIncreaseQuotaPrivilege 4684 msiexec.exe Token: SeSecurityPrivilege 5448 msiexec.exe Token: SeCreateTokenPrivilege 4684 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4684 msiexec.exe Token: SeLockMemoryPrivilege 4684 msiexec.exe Token: SeIncreaseQuotaPrivilege 4684 msiexec.exe Token: SeMachineAccountPrivilege 4684 msiexec.exe Token: SeTcbPrivilege 4684 msiexec.exe Token: SeSecurityPrivilege 4684 msiexec.exe Token: SeTakeOwnershipPrivilege 4684 msiexec.exe Token: SeLoadDriverPrivilege 4684 msiexec.exe Token: SeSystemProfilePrivilege 4684 msiexec.exe Token: SeSystemtimePrivilege 4684 msiexec.exe Token: SeProfSingleProcessPrivilege 4684 msiexec.exe Token: SeIncBasePriorityPrivilege 4684 msiexec.exe Token: SeCreatePagefilePrivilege 4684 msiexec.exe Token: SeCreatePermanentPrivilege 4684 msiexec.exe Token: SeBackupPrivilege 4684 msiexec.exe Token: SeRestorePrivilege 4684 msiexec.exe Token: SeShutdownPrivilege 4684 msiexec.exe Token: SeDebugPrivilege 4684 msiexec.exe Token: SeAuditPrivilege 4684 msiexec.exe Token: SeSystemEnvironmentPrivilege 4684 msiexec.exe Token: SeChangeNotifyPrivilege 4684 msiexec.exe Token: SeRemoteShutdownPrivilege 4684 msiexec.exe Token: SeUndockPrivilege 4684 msiexec.exe Token: SeSyncAgentPrivilege 4684 msiexec.exe Token: SeEnableDelegationPrivilege 4684 msiexec.exe Token: SeManageVolumePrivilege 4684 msiexec.exe Token: SeImpersonatePrivilege 4684 msiexec.exe Token: SeCreateGlobalPrivilege 4684 msiexec.exe Token: SeBackupPrivilege 4308 vssvc.exe Token: SeRestorePrivilege 4308 vssvc.exe Token: SeAuditPrivilege 4308 vssvc.exe Token: SeBackupPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe Token: SeTakeOwnershipPrivilege 5448 msiexec.exe Token: SeRestorePrivilege 5448 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4684 msiexec.exe 4684 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4684 msiexec.exe 5448 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5448 wrote to memory of 6028 5448 msiexec.exe 95 PID 5448 wrote to memory of 2856 5448 msiexec.exe 97 PID 2856 wrote to memory of 6016 2856 conhost.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\v1.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:6028
-
-
C:\Windows\system32\conhost.execonhost.exe --headless powershell.exe -NoProfile -ExecutionPolicy Bypass -File "NNEqFY2m.ps1" -TDhwpz jmwn2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -File NNEqFY2m.ps1 -TDhwpz jmwn3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6016
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4308
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e9cb.rbs
- Size 9KB
- SHA256 a81a6bb14a88aa40b42c27d705b8a3833f6f457fe9adb710e0badc716554b328
- MD5 b51c106e7066de27d771de7ee537ab2c
- SHA1 2856b6984febc19d8bf6762c5c78c812d1271554
- SHA512 5aa0aa4eddf6fc03bf7598a14c1b7848dc7c6dce78d3126e3ddd853b8d7c0435eee752aa5aab0e9121fba1a988c3c8ffe0e5ecd419ddafd12409b18ef21e64a7
- SSDEEP 192:tNqwZzh7iaB/lLC0geVi7I7i7wkqhivjelS71xjIpfKLrG9w97Z:tIwZzh7ic/lhgUi+i8kIiv6lS71x+KL3
- TLSH T1871240517594CAE3E4992738CA532B263BF2D3D5E350B70F45CDA0680F42768DE8A587
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\kksMt3Ij86Uy\NNEqFY2m.ps1
- Size 3KB
- SHA256 8e9ad9e2c1722241211742bdebfc83107e0f485f4861a9d4f5ec67d8e7ae35c0
- MD5 3b1a728851c7bbb6e8873d00e61d6cee
- SHA1 e12f4f5f1bb78f1918a173e13fe2f426b5c48f78
- SHA512 3d7377de22e15d5e43de248e9a21fd6ae8d40a1ee6f286dd7ec378cb1307f34400c636cf1f8cd572140cc2dd030bdd488ce3eaca08d95ab065ad1a5f72b5d8c4
- TLSH T13F81F7D3F78F2BD6F0CD1BC8285A578615C9382D1097430406BDDA83CA2B2CB5768E19
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59e9ca.msi
- Size 30KB
- SHA256 857ddc808cdaa3827dfdc4a9228dc592ced79b68401508cf22cbf05ba55e84de
- MD5 f26a4d1729240981db30392eae51a6f7
- SHA1 bc6ed033ae2c2ffd8dd7ca4024648fb267c1b404
- SHA512 77e81ffee29776fbbb0d274ddd57608673ab4affe9e2ebbaed4a802660065213bd5d0cfe0e9bba27af2dda05af3a19e073df2519c709d2826dc8343e7bb26036
- SSDEEP 768:bKwCqjrDIuzEqPn6y2hyatkeWMbCdwGFN/nq:VlTB2ka+obiw3
- TLSH T1CBD26D46FA409336C5860B36450BEBE58F79AD19CF532102769AF35C3E71AD122F79D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 1bdd8a056511cae71b0c9dd09dc93fa1e248dd18d681efcea6658c5239878f70
- MD5 dfcbc629be4fa4e486b76edc8b8d979d
- SHA1 f5fff10b49ea209998666d193d06a8c93f2431de
- SHA512 72857f964602fe8816ffc0e47a6660a95adf07236c88fc06d0e6598e6c793a3a0981686189c6cbb4e2e848884e42a9cf17f2d6087f055ab8e67cad5ca55e2c7f
- SSDEEP 24576:1Fo3DMP8doO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:sH0
- TLSH T15557B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ec3a0f19-2881-4e0c-9957-3f659a1e8ea4}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c0f19c8a14c4e1bbbbe9ef9a82d06208615604e12f25e8b01643c1ab41ecb323
- MD5 1839d02bc067089d638d34a438913dd8
- SHA1 d1ff5522a50dad95b93c93b1f62afecc8a12d38e
- SHA512 f1d95b7eb22f36132fb8b3cbc00743831b053093c3629f8d1aaec965dffac0c9793703c49605b40a59695be96c6d078ee18ed13604e1fe8c20a51026e3be286c
- SSDEEP 96:FTtW5mHlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:pgOl/b++uVm
- TLSH T181D1890C1AE54311E2F3AB3229F14557A877B911EF33CB8E0198238E6671910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH