Analysis
- max time kernel
298s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
elita.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
elita.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
300 seconds
General
- Target elita.msi
- Size 1.1MB
- Sample260916-pm5dhsx1ev
- SHA256 38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878
- MD5 1f250eb486571d99bc1e4d760e37a554
- SHA1 94a102fb67c4d65a83c64e9d57a79fae7ad63d92
- SHA512 f03c4624da95b8c65d33ca5154cd2ccc5bcaa62ebdb05a526ff8731bab34990781e3470f3c3889ba626a6845c451bbb55c1eebd204f6023d8ed99a6ef66bc494
- SSDEEP 24576:doT4PLqXxmX1bUdvuC1lZ18B77eOoNUsGP9e6yq6/2s:doT4PLqhmFYukx8t7e+lpa
- TLSH T1FC45232635496277C1A3077A134FD3D897368C0843B341672096B5DD6AB5EA0EEF3AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1624 psychedelic.exe 6064 h87a5cnmh.sys - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFDD99ABD3DE5165B9.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBF394AEB200B9D42.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59c625.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF4B545D559547D184.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{6870A6BF-6480-4E51-AA74-E66972166C02} msiexec.exe File created C:\Windows\SystemTemp\~DF475E61DB5C93E8AB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICC20.tmp msiexec.exe File created C:\Windows\Installer\e59c625.msi msiexec.exe File created C:\Windows\Installer\e59c629.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3884 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 436 msiexec.exe 436 msiexec.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 436 msiexec.exe Token: SeCreateTokenPrivilege 3884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3884 msiexec.exe Token: SeLockMemoryPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeMachineAccountPrivilege 3884 msiexec.exe Token: SeTcbPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 3884 msiexec.exe Token: SeTakeOwnershipPrivilege 3884 msiexec.exe Token: SeLoadDriverPrivilege 3884 msiexec.exe Token: SeSystemProfilePrivilege 3884 msiexec.exe Token: SeSystemtimePrivilege 3884 msiexec.exe Token: SeProfSingleProcessPrivilege 3884 msiexec.exe Token: SeIncBasePriorityPrivilege 3884 msiexec.exe Token: SeCreatePagefilePrivilege 3884 msiexec.exe Token: SeCreatePermanentPrivilege 3884 msiexec.exe Token: SeBackupPrivilege 3884 msiexec.exe Token: SeRestorePrivilege 3884 msiexec.exe Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeDebugPrivilege 3884 msiexec.exe Token: SeAuditPrivilege 3884 msiexec.exe Token: SeSystemEnvironmentPrivilege 3884 msiexec.exe Token: SeChangeNotifyPrivilege 3884 msiexec.exe Token: SeRemoteShutdownPrivilege 3884 msiexec.exe Token: SeUndockPrivilege 3884 msiexec.exe Token: SeSyncAgentPrivilege 3884 msiexec.exe Token: SeEnableDelegationPrivilege 3884 msiexec.exe Token: SeManageVolumePrivilege 3884 msiexec.exe Token: SeImpersonatePrivilege 3884 msiexec.exe Token: SeCreateGlobalPrivilege 3884 msiexec.exe Token: SeBackupPrivilege 3676 vssvc.exe Token: SeRestorePrivilege 3676 vssvc.exe Token: SeAuditPrivilege 3676 vssvc.exe Token: SeBackupPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeRestorePrivilege 436 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3884 msiexec.exe 3884 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3884 msiexec.exe 436 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 436 wrote to memory of 4760 436 msiexec.exe 93 PID 436 wrote to memory of 1624 436 msiexec.exe 95 PID 1624 wrote to memory of 5708 1624 psychedelic.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\elita.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3884
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4760
-
-
C:\Users\Admin\AppData\Local\Programs\Internal Software\Vertification\psychedelic.exe"C:\Users\Admin\AppData\Local\Programs\Internal Software\Vertification\psychedelic.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SYSTEM32\curl.execurl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/953A8DE880B0818C32DA2DEC1D79C2D91/ntkrnlmp.pdb"3⤵PID:5708
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
C:\Windows\Temp\h87a5cnmh.sysC:\Windows\Temp\h87a5cnmh.sys1⤵
- Executes dropped EXE
PID:6064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c628.rbs
- Size 8KB
- SHA256 e10dad4caa83603f766e927ef09691887d974d23cbbea75d67594e680375d3d5
- MD5 2d4f84611eaad2013518d41ceb0997f6
- SHA1 3049375cd5a0f75d498b0e83871eef38ad75ead2
- SHA512 736c9a067dea2b1c95f6523a657f128f55f27d67a65000636132bec8e8d7734327920265cd276b5ba12e1ea1d2eae930df14165ab819a725d9496daeae5b7f9c
- SSDEEP 192:nZv0YCvKxXvZnkIuJvZnkfQuBuukoA4b99TlpgtSXwqNkV/y:nN39G96hGK
- TLSH T1DE022D80F251C5E2FCD50B3287176B9837B2E2DCD691234F064D86B55E03B8E8F5A0EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\Internal Software\Vertification\psychedelic.exe
- Size 2.2MB
- SHA256 bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8
- MD5 348cabe85c8bb40e690ab873ab94acac
- SHA1 ae5292a44abb8faefa9d26a1ca9dd23e69c0d272
- SHA512 0ac049ca3f1d9aa0263db0b8e80f526546894a244dabcd259e0d36276914c59945090d49f9f5ac1813dfe928171f89181b85903d60252e754072d36943380931
- SSDEEP 24576:TyaJv/B3Wdgfs2hOkyHDHyZxUdv+3Vr3HLk7bOpmH1pDIeZiQqZd7id:2aJB3WCOkyCYCx3LkPlppiQqZRS
- TLSH T1C3B58FD6E1070CF0DB1949FBA10D3F23AD96307AE35C647EA48A773076AD5A9BB48134
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb
- Size 10.5MB
- SHA256 e987244cfdc33cb195c34231d8905d9e87019b36f199d17ab0638187ce0aaf7f
- MD5 566f8135567a80ba945eee5ce9be4f69
- SHA1 26008b593f2deacd27d6c55220cbcacfeaeb1a37
- SHA512 86bfd6689da02d75e8323b6420c35fc86c487906d82827ec595d6d308e9f32fb23aca9b2c72f071fab77ed78b3997b8fae5034bc105e1109f2e3df32c5603829
- SSDEEP 49152:R85MWAL/kNIUlMy+1sA3w9QnZcaDkFAjcLU3I67bX3V/lxKPmng+Y99+1lM8faZJ:R85rADkNl63pnR7fDgf
- TLSH T150B60615BA937EF6DC5A457FA0160329F6F596CA03A947E33D46B3A90DC2212CF2E341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c625.msi
- Size 1.1MB
- SHA256 38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878
- MD5 1f250eb486571d99bc1e4d760e37a554
- SHA1 94a102fb67c4d65a83c64e9d57a79fae7ad63d92
- SHA512 f03c4624da95b8c65d33ca5154cd2ccc5bcaa62ebdb05a526ff8731bab34990781e3470f3c3889ba626a6845c451bbb55c1eebd204f6023d8ed99a6ef66bc494
- SSDEEP 24576:doT4PLqXxmX1bUdvuC1lZ18B77eOoNUsGP9e6yq6/2s:doT4PLqhmFYukx8t7e+lpa
- TLSH T1FC45232635496277C1A3077A134FD3D897368C0843B341672096B5DD6AB5EA0EEF3AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\h87a5cnmh.sys
- Size 78KB
- SHA256 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1
- MD5 b96d75a000367c200958089728fc5cb8
- SHA1 f329ae0fdf1e198bea6ba787e59cb73f90714002
- SHA512 60fb02287aff7b7d7b7057be6f0a828c702a0ba9653fd4079d0e5bea3b476dc06cae4f27292684c9235ed21a498403bbf4bc6609c0d9c3c2de920e981ef1df17
- SSDEEP 1536:Qn8/+PtpHLPxNn1szNYeYVxRqx+g1JOE7ubt6INPXWmT6A5+KA:5/yTxNKOesx8xIh6AGLA5I
- TLSH T1C173E0D1162CA4C2ED879D31A2C8D623BC70B3911E62D6F391A5D1790E867C16F2C9AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0ac1292fcb0bf302e65778e02ec9708abc27ee7c5e99c092302cfdeed23d61a0
- MD5 e25910297fa3d75eb4e927d23d8a55fa
- SHA1 e0f4c3b62deaf01bb11fe3c8769198b5384e2b16
- SHA512 9dbb13445f0b7a5eea8b309924c86385758046c7e3dbce64fc08f1fda53e08746c513a1d391481854d7a443ba193e5f6fab282776baf717af65567a211f2e337
- SSDEEP 24576:PFo3DMPgdoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKes:GHM
- TLSH T1CC57042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e227cad2-2e76-418f-9c2c-f499633060c9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 b0011beb64c6820772c2924cefa3faf6495117e9349d1f69266b5b69ab993240
- MD5 c85a2c5f885114e3927b6f6d7c933b77
- SHA1 3cfe0bb370a9bc6152ab56c2eb519af8d457acc0
- SHA512 50b6d989338a336c53c8fb3e057da67d15c96189da5081ae9fd6aa2df9e7c456d8f536e40ad5a5e314816c3f5b2abd2c8a0c0717ffbecc471a23505c3077ad2f
- SSDEEP 96:FAhYFHrvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:IUnb++uVmN
- TLSH T13AD188185AF54711E2B3AB3128F58557A877B911EF33CB8E0198238E6621910F835F6F
- MD5 SHA1 SHA512 SSDEEP TLSH