Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Set-up.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Set-up.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Set-up.msi
- Size 3.7MB
- Sample260909-ns449swtcs
- SHA256 1b4a8a0ca01f4cd307f3379fed68de5680f125c8ba7530311430dfa403193e8b
- MD5 b7ff750f65aa03253b16cdc2a6dfc8c0
- SHA1 1693de6abb91306f0ac4df6bd53f4f59ffa8cdd1
- SHA512 65ab346d873a8379211c97fb3589a63e1420ae16dacfab75f3f322c2e22d81e9a989c1e28e7ccb27f34886765875580185462bbc60890412b5da01ee14e1fdc4
- SSDEEP 98304:+HVnXP7pRXNpOx+I3NlkPPSOnzFN7tIeMwX5eCpY:+HVnXP7dpOYI3NAnzIwX5eO
- TLSH T180062357B39412F9E1B38239C4560684FB723C150760AAAF07E077796E73BD06D3AB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3260 MSIC658.tmp 4548 MSIFAB8.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58c60a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e58c60a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC658.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFAB8.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{FFD807C1-4311-4062-96C3-7F57830B4B1C} msiexec.exe File opened for modification C:\Windows\Installer\MSIFBC2.tmp msiexec.exe File created C:\Windows\Installer\e58c60c.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1812 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSIC658.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSIC658.tmp - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 3260 MSIC658.tmp 1388 chrome.exe 3772 msedge.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3260 MSIC658.tmp 3260 MSIC658.tmp 3260 MSIC658.tmp 3260 MSIC658.tmp 3260 MSIC658.tmp 3260 MSIC658.tmp 3260 MSIC658.tmp 3260 MSIC658.tmp 4264 msiexec.exe 4264 msiexec.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 1388 chrome.exe 1388 chrome.exe 1388 chrome.exe 1388 chrome.exe 1388 chrome.exe 1388 chrome.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3260 MSIC658.tmp 3260 MSIC658.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 4264 msiexec.exe Token: SeCreateTokenPrivilege 1812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1812 msiexec.exe Token: SeLockMemoryPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeMachineAccountPrivilege 1812 msiexec.exe Token: SeTcbPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeLoadDriverPrivilege 1812 msiexec.exe Token: SeSystemProfilePrivilege 1812 msiexec.exe Token: SeSystemtimePrivilege 1812 msiexec.exe Token: SeProfSingleProcessPrivilege 1812 msiexec.exe Token: SeIncBasePriorityPrivilege 1812 msiexec.exe Token: SeCreatePagefilePrivilege 1812 msiexec.exe Token: SeCreatePermanentPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeDebugPrivilege 1812 msiexec.exe Token: SeAuditPrivilege 1812 msiexec.exe Token: SeSystemEnvironmentPrivilege 1812 msiexec.exe Token: SeChangeNotifyPrivilege 1812 msiexec.exe Token: SeRemoteShutdownPrivilege 1812 msiexec.exe Token: SeUndockPrivilege 1812 msiexec.exe Token: SeSyncAgentPrivilege 1812 msiexec.exe Token: SeEnableDelegationPrivilege 1812 msiexec.exe Token: SeManageVolumePrivilege 1812 msiexec.exe Token: SeImpersonatePrivilege 1812 msiexec.exe Token: SeCreateGlobalPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 3288 vssvc.exe Token: SeRestorePrivilege 3288 vssvc.exe Token: SeAuditPrivilege 3288 vssvc.exe Token: SeBackupPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeBackupPrivilege 4308 srtasks.exe Token: SeRestorePrivilege 4308 srtasks.exe Token: SeSecurityPrivilege 4308 srtasks.exe Token: SeTakeOwnershipPrivilege 4308 srtasks.exe Token: SeBackupPrivilege 4308 srtasks.exe Token: SeRestorePrivilege 4308 srtasks.exe Token: SeSecurityPrivilege 4308 srtasks.exe Token: SeTakeOwnershipPrivilege 4308 srtasks.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe Token: SeTakeOwnershipPrivilege 4264 msiexec.exe Token: SeRestorePrivilege 4264 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1812 msiexec.exe 1812 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4264 wrote to memory of 4308 4264 msiexec.exe 102 PID 4264 wrote to memory of 3260 4264 msiexec.exe 104 PID 3260 wrote to memory of 1388 3260 MSIC658.tmp 106 PID 3260 wrote to memory of 1388 3260 MSIC658.tmp 106 PID 3260 wrote to memory of 3772 3260 MSIC658.tmp 107 PID 3260 wrote to memory of 3772 3260 MSIC658.tmp 107 PID 4264 wrote to memory of 4548 4264 msiexec.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Set-up.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\Installer\MSIC658.tmp"C:\Windows\Installer\MSIC658.tmp"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:3772
-
-
-
C:\Windows\Installer\MSIFAB8.tmp"C:\Windows\Installer\MSIFAB8.tmp"2⤵
- Executes dropped EXE
PID:4548
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2444
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c60b.rbs
- Size 7KB
- SHA256 308930a2a56a093495762c67f685a61c7ea98a2be3c6b18f1be3bee3967320d1
- MD5 6255dc906ed511f90470cfaa0325de52
- SHA1 865e8a46fbacb4ab270121472e7bd62736d268bd
- SHA512 6d6ef2564c86c5e78f11e16fc815f23cf606a69a4c86d8553fc5296d8f8650db050b9d55636419ee48ac00bbf4f1ab60b8f790418aaef50a166cb5e2f58ee299
- SSDEEP 96:mmot1WSQuRe6JnuUXMdCsTlQ0UXMdC6jGGO2Tlm4OA3/igBy1JlC5pEBf5caZz8p:f8legBcAIOcAMp95pJ
- TLSH T106F1F1407310CAE2E8AA6332D71707503BE2D2EED651236785CC86695F17BA9EF4F1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC658.tmp
- Size 3.3MB
- SHA256 feb07f356c234e05bce0e2516f45fb2c8f30d630448a719e4d62306172249e78
- MD5 27457f49aa2fa33551e35ad1b3c948ec
- SHA1 e01ac62f9202de7263941200bfb3a7e8f31823c3
- SHA512 41000acd48469302f09f74b99ebe46e7b1503692b1fa85f21fcd353699b9a45f52b4ce8507a1f789fd15b941f472b000a45a04337fc9185421877bbed823b1dd
- SSDEEP 98304:cnXP7pRXNpOx+I3NlkPPSOnzFN7tIeMwX5eCpY:cnXP7dpOYI3NAnzIwX5eO
- TLSH T149F53396B3A561F8F6B2C13CC0910884FBB13A111B50BAFF46F016797DA7BC16D29B46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIFAB8.tmp
- Size 322KB
- SHA256 e2e34ef566fd9dbc612bb2e180b0c06435254a064a87d77cd5bc18c84760989a
- MD5 a64ccaa3c82ffa1c86b783a9abb0f78d
- SHA1 f4775e93a0c409a38d12b3d8d51dbafdeb2804d7
- SHA512 2c9355d8086c720adcb8311860d1952b570eae731c05438757b5c573518ad01a9bf45466d4e9e069657bfef7d1b21613f5052b24660b4db340f805eac77ce4b0
- SSDEEP 6144:F8U4EEV98+CWBN9P+sbz/yq5Hp2DIuzZrVBiCSM8KnOqW1:Fd43VJCWBNrbzb5HpHuzZrXDSM3nO
- TLSH T1FF64D157B3E410F9E1B78139C8611502FB7278260750AB9F07E147B6AF27AC09D3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 b0ca288511e50c8f4ecf741236469e7d9cca8b241c4f14efd927cea807efa4bb
- MD5 bc84bc37b444e310be49387401d85395
- SHA1 39b219ce6066630125998fba124c1109407715fd
- SHA512 fe6045f33f2d893a1d5d4708fca2865ce039f137c5c0c60ebc3ef38a5fa3506ef3835794ce5d2ed1a40ecc13bc01c0f0519bc5d4dec037a677f5722fa668ba79
- SSDEEP 24576:Iu8m+1zodoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:L
- TLSH T18A47D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{05933268-37dd-4ff1-a4db-0ab8b03f83f9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 b68f3262130216754f893e824f6c4d43e19c141d1dbff0c1ee7397121549d329
- MD5 8bd9cd0669b0e71b9fb259176215c83b
- SHA1 ecbf822291c4d6e4eb145ef40587e471f5d27896
- SHA512 63335cbd480cfb472a4dabe9651b68b7ec174d6b9fa057703020a6b4c0dc22b35e80fabbacf16e52feb6dd89ba85c551f7375017ba93dc8a6f75f362a709c5e8
- SSDEEP 96:FDS0VRvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:5Jb++ZVmN
- TLSH T13BD189185AF54311E2B3AB7228F54557A477B911EF33CB8E0198238E6670A10F876F6F
- MD5 SHA1 SHA512 SSDEEP TLSH