Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 22:10
General
- Target QP RG 5683674 img.msi
- Size 340KB
- Sample260916-13rcda1s3m
- SHA256 4689c3da35b61bd84a7d57363c9d346078ec8645ef72d4397cd608f97c62f601
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 16 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\QP RG 5683674 img.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /x {F4AA89B9-1E0A-469F-B157-3308B08FB3F6} /qn /norestart2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Documents\UXVRIYDHQWZBVAVA\UXVRIYDHQWZBVAVA.EXE"C:\Users\Admin\Documents\UXVRIYDHQWZBVAVA\UXVRIYDHQWZBVAVA.EXE" "C:\Users\Admin\Documents\UXVRIYDHQWZBVAVA\UXVRIYDHQWZBVAVA.css"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 3603⤵
- Program crash
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5796 -ip 57961⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e5a8c54.rbs
e5a8c58.rbs
UXVRIYDHQWZBVAVA.EXE
UXVRIYDHQWZBVAVA.css
e5a8c55.msi
metadata-2
{9c7906e7-ac05-4da0-adf9-a589bf3bbe1c}_OnDiskSnapshotProp
memory/5796-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-84-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-83-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-82-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-81-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-80-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-79-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-78-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-77-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-76-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-75-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-74-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-73-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-85-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5796-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp