Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/09/2026, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
README.html
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
README.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
UEMSAgent.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
UEMSAgent.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
setup.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
setup.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target UEMSAgent.msi
- Size 60.3MB
- Sample260915-hlg39sshkh
- SHA256 9392dabf5b4a1d41329143c232e5130ad56e4ce1b5973372623e7982f683bbe2
- MD5 71e42f702ef3eb9906143f754ef85697
- SHA1 af484ae5b616abac8e33e8c5ca22d84252c8caed
- SHA512 a70b2b76e8a002d5a283301a64314378972724777b76dea9313ecb92b06da8a522ac7727ee2bac21f5c02faac16f2738759d7a659c74d6e646942f2f00bd36a2
- SSDEEP 1572864:kZO+GDQ9qACZ6Xbg+K+s5jZnKLY73TI2pOwAt++jlzfcj8ztlF96h1+vSK:k0PDC46Xbg4E9GYDTIvwAE6zf+aX0+vS
- TLSH T172D73323B8888136D59ED1300AB96F2D4E7E0C50877880D7E764BD6F51B5FC1A3793AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4828 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4996 msiexec.exe 4 4996 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4996 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4996 msiexec.exe Token: SeIncreaseQuotaPrivilege 4996 msiexec.exe Token: SeSecurityPrivilege 1100 msiexec.exe Token: SeCreateTokenPrivilege 4996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4996 msiexec.exe Token: SeLockMemoryPrivilege 4996 msiexec.exe Token: SeIncreaseQuotaPrivilege 4996 msiexec.exe Token: SeMachineAccountPrivilege 4996 msiexec.exe Token: SeTcbPrivilege 4996 msiexec.exe Token: SeSecurityPrivilege 4996 msiexec.exe Token: SeTakeOwnershipPrivilege 4996 msiexec.exe Token: SeLoadDriverPrivilege 4996 msiexec.exe Token: SeSystemProfilePrivilege 4996 msiexec.exe Token: SeSystemtimePrivilege 4996 msiexec.exe Token: SeProfSingleProcessPrivilege 4996 msiexec.exe Token: SeIncBasePriorityPrivilege 4996 msiexec.exe Token: SeCreatePagefilePrivilege 4996 msiexec.exe Token: SeCreatePermanentPrivilege 4996 msiexec.exe Token: SeBackupPrivilege 4996 msiexec.exe Token: SeRestorePrivilege 4996 msiexec.exe Token: SeShutdownPrivilege 4996 msiexec.exe Token: SeDebugPrivilege 4996 msiexec.exe Token: SeAuditPrivilege 4996 msiexec.exe Token: SeSystemEnvironmentPrivilege 4996 msiexec.exe Token: SeChangeNotifyPrivilege 4996 msiexec.exe Token: SeRemoteShutdownPrivilege 4996 msiexec.exe Token: SeUndockPrivilege 4996 msiexec.exe Token: SeSyncAgentPrivilege 4996 msiexec.exe Token: SeEnableDelegationPrivilege 4996 msiexec.exe Token: SeManageVolumePrivilege 4996 msiexec.exe Token: SeImpersonatePrivilege 4996 msiexec.exe Token: SeCreateGlobalPrivilege 4996 msiexec.exe Token: SeCreateTokenPrivilege 4996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4996 msiexec.exe Token: SeLockMemoryPrivilege 4996 msiexec.exe Token: SeIncreaseQuotaPrivilege 4996 msiexec.exe Token: SeMachineAccountPrivilege 4996 msiexec.exe Token: SeTcbPrivilege 4996 msiexec.exe Token: SeSecurityPrivilege 4996 msiexec.exe Token: SeTakeOwnershipPrivilege 4996 msiexec.exe Token: SeLoadDriverPrivilege 4996 msiexec.exe Token: SeSystemProfilePrivilege 4996 msiexec.exe Token: SeSystemtimePrivilege 4996 msiexec.exe Token: SeProfSingleProcessPrivilege 4996 msiexec.exe Token: SeIncBasePriorityPrivilege 4996 msiexec.exe Token: SeCreatePagefilePrivilege 4996 msiexec.exe Token: SeCreatePermanentPrivilege 4996 msiexec.exe Token: SeBackupPrivilege 4996 msiexec.exe Token: SeRestorePrivilege 4996 msiexec.exe Token: SeShutdownPrivilege 4996 msiexec.exe Token: SeDebugPrivilege 4996 msiexec.exe Token: SeAuditPrivilege 4996 msiexec.exe Token: SeSystemEnvironmentPrivilege 4996 msiexec.exe Token: SeChangeNotifyPrivilege 4996 msiexec.exe Token: SeRemoteShutdownPrivilege 4996 msiexec.exe Token: SeUndockPrivilege 4996 msiexec.exe Token: SeSyncAgentPrivilege 4996 msiexec.exe Token: SeEnableDelegationPrivilege 4996 msiexec.exe Token: SeManageVolumePrivilege 4996 msiexec.exe Token: SeImpersonatePrivilege 4996 msiexec.exe Token: SeCreateGlobalPrivilege 4996 msiexec.exe Token: SeCreateTokenPrivilege 4996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4996 msiexec.exe Token: SeLockMemoryPrivilege 4996 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4996 msiexec.exe 4996 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1100 wrote to memory of 4828 1100 msiexec.exe 87
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4996
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0F1639BDD0470C048C7D18822A0693BB C2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4828
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 1KB
- SHA256 bf0ce15c4ec9a573c681cbf1b08c905a55b5b20070a2843f3d7fd459486584b0
- MD5 f60441fc347e7acf957437a1f46e0904
- SHA1 9ea2c98a59bcbd59de557a2cda6a834316bea309
- SHA512 268152bd0ee32a523556c600c4ca92bc862329e6047de8d9768379d4f60cdb4a57c4d54884d48162993dba40d577474f56441fd0f497bcc7a0b0bed26386e233
- TLSH T127211B4E4FB524A0FF816D4732D9DA374DF336C108FC1049527884D116203657F9150E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 93867473fd2b8c88ad49aae3f301141acc09f807bcc26a2788fd327afcc8bb30
- MD5 13bd03df0a7837a634486b9b4ba814f2
- SHA1 0dabca1dc856a4b4cc5b07dc0dcb117498c6d29f
- SHA512 eecba74ecbc3e9085190e867e32201bbde80324c6536a4174fa3f5b45c3722bf80b6435a936a32c565c018d13f5257b9196226eb0e1105f7bbd90dae71355fdf
- TLSH T10B31F856AE7831839D50EDE42DE5F2377CE8B6D0E8D630426525440721903B3AF4AD8E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_A5F651B66AACC84B2508F9100DC17CA4
- Size 1KB
- SHA256 832eeaa32c3f8b4b9a927d27173f873e155737e1959cd1eeaa0674d8f8f4ba08
- MD5 774b8531aa922628e6a49343d25450cd
- SHA1 67040f37d7e6e80ecc979b90cec8e8173175cd69
- SHA512 420277daa70ef5af6c28a81ad98624905b954dd891c1afdd1b91b299cbf989604c9160e25ab8dac9a4b35e14b158c46d95425a6f56507ecfe83ae3dcf74ecf1d
- TLSH T1E831B64F5BB97542BB089C1159E69D33A9F023EC81F92B6A31BB569674607B28E06108
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 9953046f43d897b5c6bc855b6ff358124ccebb49fabcb203e0b02614e1d7ee71
- MD5 c21d10efeea2081aa311303c1f4ece58
- SHA1 e9e67965bcf299e392bdaa7369c22dae294ce6c5
- SHA512 b0e927ea17f3cee05c9aefba0a9eb1b41ae4f8d6e7deb26d54cda7ddc30518c6e253250930225bc49db8b339bd0623ed6f3347002e642f86f181f805700729d4
- TLSH T13021868726F23867F761CE4A19C57E772CF1B7D6A0CC144AB04FD2A918103E2AA8913D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 508B
- SHA256 cfc47cebee3abb3ad628e154d119b7d4104ee531a6fbf322a18230cec2d2809d
- MD5 eab19743987cf78fbe102a9ccbfa69f2
- SHA1 94fe8f576573a8636119e78ce0b173d418f78319
- SHA512 61f8e472b51a964584b34222c9f70ab5673c5479add199772a17a00d503183e648aec6ee8e248045039a7c4e6da99197299e50b69e5d0a8f750e952350e54d53
- TLSH T159F0D5184EFC513EF133CE3A06DA35A28E3BF7063016026822E0C748B940F092C2223D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 6b7f2aeffa5830555905da0d12e6b9a5250ae512a22d3732464e88b5d50ab9e4
- MD5 825107d2789e8b2f8d2ee4923286682f
- SHA1 57dde25eb6d8353d5b29a453962d4c1485410823
- SHA512 517359c119d50c7dd417c77b179b2e45cba6465ea4cd7de6dfce8875df744fbb8694fd491278a4395704a95a0a3860703d40d525ff028ba199a1be570f7ad4d2
- TLSH T1C5F0DC0809FC021FF036CE390EC561979D66F820380342720352831C4E23F20CD1A83D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_A5F651B66AACC84B2508F9100DC17CA4
- Size 540B
- SHA256 9d0607980555863805653f2e626864b69d234baab316fffa9dc9ccbe2ebf7a6a
- MD5 3538bab81c06fcb7175234ee0e32a7dd
- SHA1 01ac9c0fbf76c452a3af4cb0c30d12f1a5669dd7
- SHA512 dab31045ee61b63729048b42a6f43ef144408716c60c695a47311d75a5566cf46de1b5140f64918d1e919fb3b254d7659bb5eddc6ab0d7ae0a95adf77ac92cc7
- TLSH T17EF097384EF5912EF230DD7906D9A9630C65FA0B1C0289990A9983897912F04AC90E36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 79e46db553e1439e6cc88835b2494308e873740afd99eeab02117a2be59b2331
- MD5 9faa1b9f715716b6377c851308b1eb12
- SHA1 9394240b1c3bc8e70cbad6dbc9e3214536220d4c
- SHA512 6971f00e58172ff34bc504c5fd33dd41c12c23ec2586e35c837db50a9efa69e29158e475c407e850537cb2410b5180b05371f47fde33fd958c8fd2204bbdca00
- TLSH T121F0DC282CF4E02CF332CF7451E961F6AE6EBA1B740202BC06DA42089B54F003C46539
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID0C8.tmp
- Size 429KB
- SHA256 6da8e36f10949a6fa6bccca36b0c17a7b6d6e115139ea68b581bd384e5f1ee0e
- MD5 1c00042ce9032c2eeb93941f80fb8ae9
- SHA1 cf7c0f2eeb3b3694121fde4d0a0be51974dd88fe
- SHA512 7c6e5f9a0640d6ffaa930dd16054b0ba7992bf53d5f87b266919f06dbf3879a4af18a70eb7fd08cafda5d2cf4de1036b2e90ffc1588b358932352531234eb4b4
- SSDEEP 12288:HpqSpvhUEaxBOJBesypR2wd/8Vyfp7NTW:HJhUZxBOWsc1DFNS
- TLSH T18394BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH