Overview

overview

6

Static

static

1

Setup_Mult....0.exe

windows10-ltsc_2021-x64

6

Setup_Mult....0.exe

windows11-21h2-x64

6

Setup_Mult....0.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/09/2026, 14:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Setup_MultiNAI_1.3.0.0.exe
  • Size 19.9MB
  • Sample260910-rh1wmsytbz
  • SHA256 85aeb477c42a28320bee0253eac8f954a0bbed0919cac062c16e6411114814fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryransomwarespywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 64 IoCs
  • Loads dropped DLL 15 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_MultiNAI_1.3.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_MultiNAI_1.3.0.0.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5148
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Ametek & Marschelke Messtechnik\MultiNAI 1.3.0.0\install\MultiNAI.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Setup_MultiNAI_1.3.0.0.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1788808907 "
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:4456
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 55F2DCAFD5CDB26DD4A96BFE2E21E2BB C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:340
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 73D3D176D974A736537E3BF75BAB94DD C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4524
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3904
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DC4942A0430E678FBED01CB9ABF433C5
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5340
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:568

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MultiNai.exe
          • Path C:\Program Files (x86)\MultiNAI\MultiNai.exe
          • Size 188KB
          • SHA256 6d205632f7c1acb74928f52dc4ea4c5ee8b24f41366dc0fbdb53d7b97b0564bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MultiNaiSim.exe
          • Path C:\Program Files (x86)\MultiNAI\MultiNaiSim.exe
          • Size 137KB
          • SHA256 e2d561e218c79c490ac257620165456a83fff4b047f9eb8535bfeb47fb85cf5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Size 4KB
          • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
          • Size 1KB
          • SHA256 b1108304eb010243e5ee9b62821efe845c6e3adcb703c35bac9a69001a9459a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          A1D627669EFC8CD4F21BCF387D97F9B5_D8B191C45FFEC31D6C663DA22AE4352E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_D8B191C45FFEC31D6C663DA22AE4352E
          • Size 1KB
          • SHA256 921d1cbddf89a5e5b60b8864182cae361be51d885a477d2814ec9b43619a5474
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Size 342B
          • SHA256 1e0b48a1b6071951fc542ff17a6a464c7fab742f8bf161b466b8aeb41b300f9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
          • Size 532B
          • SHA256 5210336bb3eabafdd407c6169950f08b809c3cc0f8caa7515fc3f2b957c1fdf5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          A1D627669EFC8CD4F21BCF387D97F9B5_D8B191C45FFEC31D6C663DA22AE4352E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_D8B191C45FFEC31D6C663DA22AE4352E
          • Size 540B
          • SHA256 8469b48f9f54a5a911e21cb42a6bdc53e781e29248cc12474969c230e28e95cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIA92D.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIA92D.tmp
          • Size 1.1MB
          • SHA256 98911811a173883c729791a5d57e16533bfd8703d340f71da80c3e5996aecf17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MultiNAI.msi
          • Path C:\Users\Admin\AppData\Roaming\Ametek & Marschelke Messtechnik\MultiNAI 1.3.0.0\install\MultiNAI.msi
          • Size 14.5MB
          • SHA256 eeba84b73cac66648108db3e589110990a7e6bce00a0686fe6e43813b726bd0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MultiNAI1.cab
          • Path C:\Users\Admin\AppData\Roaming\Ametek & Marschelke Messtechnik\MultiNAI 1.3.0.0\install\MultiNAI1.cab
          • Size 1.4MB
          • SHA256 d180e600f492dcf11235ed5c46bda049d830f9a73587080513186d9fb89d0dd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI141E.tmp
          • Path C:\Windows\Installer\MSI141E.tmp
          • Size 926KB
          • SHA256 09266865df24fcbd8ae16d895a25551422cd2659b1d889cc6b074aae716f12d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI1519.tmp
          • Path C:\Windows\Installer\MSI1519.tmp
          • Size 28KB
          • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.6MB
          • SHA256 aa7eeeffbdd47e661e83560c76db32490a1698d0187bfbae7a184cf44a613f21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {cabd34a0-e746-4de2-810e-e534d76fcf78}_OnDiskSnapshotProp
          • Path \??\Volume{8b022b51-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cabd34a0-e746-4de2-810e-e534d76fcf78}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 36a6ed80c3809940dfaeb486d3548f7d12775cbb013f51203db5823cf60d5ec7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download