Analysis
- max time kernel
39s - max time network
42s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 12:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff1e782be75f12c391d1cc91f2433d6be1f4bbc58a030b5e61e65aaf8a1765dc.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
40 seconds
Behavioral task
behavioral2
Sample
ff1e782be75f12c391d1cc91f2433d6be1f4bbc58a030b5e61e65aaf8a1765dc.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
40 seconds
General
- Target ff1e782be75f12c391d1cc91f2433d6be1f4bbc58a030b5e61e65aaf8a1765dc.msi
- Size 3.7MB
- Sample260916-pp3ygabl3s
- SHA256 ff1e782be75f12c391d1cc91f2433d6be1f4bbc58a030b5e61e65aaf8a1765dc
- MD5 ad86a694c4182860dd1d1912e8b61a6d
- SHA1 38029b19b8c1bc400868e6a9d5500909c66bb987
- SHA512 a88895584564a64f3c60801572c4076842b125b335d9c1c000724f16441857b25f098ebee8265604eb28236cebbd08c2526884dba07293c6fe46fe9442690b08
- SSDEEP 98304:78zNA3xMwqmTQhfBY0oepa8BoFyPsYVKJ0U:78zm3mwH4B1oF0SykYPU
- TLSH T14E062356B79411FAD1A75136C8221302E7763C250370AB9F43A07779AF37BA18D3AF92
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4176 MSI77A7.tmp 3000 MSI9C37.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{F379D24E-E70A-4C95-BCC1-1D307712D7ED} msiexec.exe File created C:\Windows\SystemTemp\~DF491C03D0CAB79E03.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9CA6.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF9F11FDDF3E30AE1F.TMP msiexec.exe File created C:\Windows\Installer\e5973fd.msi msiexec.exe File opened for modification C:\Windows\Installer\e5973fd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF6BF2931EFACF34FD.TMP msiexec.exe File created C:\Windows\Installer\e5973ff.msi msiexec.exe File created C:\Windows\SystemTemp\~DF801591999EEE88C0.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI77A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C37.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6124 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSI77A7.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSI77A7.tmp - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4176 MSI77A7.tmp - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4176 MSI77A7.tmp 4176 MSI77A7.tmp 4176 MSI77A7.tmp 4176 MSI77A7.tmp 4176 MSI77A7.tmp 4176 MSI77A7.tmp 4176 MSI77A7.tmp 4176 MSI77A7.tmp 1676 msiexec.exe 1676 msiexec.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4176 MSI77A7.tmp 4176 MSI77A7.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 6124 msiexec.exe Token: SeIncreaseQuotaPrivilege 6124 msiexec.exe Token: SeSecurityPrivilege 1676 msiexec.exe Token: SeCreateTokenPrivilege 6124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6124 msiexec.exe Token: SeLockMemoryPrivilege 6124 msiexec.exe Token: SeIncreaseQuotaPrivilege 6124 msiexec.exe Token: SeMachineAccountPrivilege 6124 msiexec.exe Token: SeTcbPrivilege 6124 msiexec.exe Token: SeSecurityPrivilege 6124 msiexec.exe Token: SeTakeOwnershipPrivilege 6124 msiexec.exe Token: SeLoadDriverPrivilege 6124 msiexec.exe Token: SeSystemProfilePrivilege 6124 msiexec.exe Token: SeSystemtimePrivilege 6124 msiexec.exe Token: SeProfSingleProcessPrivilege 6124 msiexec.exe Token: SeIncBasePriorityPrivilege 6124 msiexec.exe Token: SeCreatePagefilePrivilege 6124 msiexec.exe Token: SeCreatePermanentPrivilege 6124 msiexec.exe Token: SeBackupPrivilege 6124 msiexec.exe Token: SeRestorePrivilege 6124 msiexec.exe Token: SeShutdownPrivilege 6124 msiexec.exe Token: SeDebugPrivilege 6124 msiexec.exe Token: SeAuditPrivilege 6124 msiexec.exe Token: SeSystemEnvironmentPrivilege 6124 msiexec.exe Token: SeChangeNotifyPrivilege 6124 msiexec.exe Token: SeRemoteShutdownPrivilege 6124 msiexec.exe Token: SeUndockPrivilege 6124 msiexec.exe Token: SeSyncAgentPrivilege 6124 msiexec.exe Token: SeEnableDelegationPrivilege 6124 msiexec.exe Token: SeManageVolumePrivilege 6124 msiexec.exe Token: SeImpersonatePrivilege 6124 msiexec.exe Token: SeCreateGlobalPrivilege 6124 msiexec.exe Token: SeBackupPrivilege 4612 vssvc.exe Token: SeRestorePrivilege 4612 vssvc.exe Token: SeAuditPrivilege 4612 vssvc.exe Token: SeBackupPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 6124 msiexec.exe 6124 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6124 msiexec.exe 1676 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1676 wrote to memory of 3384 1676 msiexec.exe 93 PID 1676 wrote to memory of 4176 1676 msiexec.exe 95 PID 4176 wrote to memory of 2040 4176 MSI77A7.tmp 96 PID 4176 wrote to memory of 2040 4176 MSI77A7.tmp 96 PID 4176 wrote to memory of 984 4176 MSI77A7.tmp 97 PID 4176 wrote to memory of 984 4176 MSI77A7.tmp 97 PID 1676 wrote to memory of 3000 1676 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ff1e782be75f12c391d1cc91f2433d6be1f4bbc58a030b5e61e65aaf8a1765dc.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6124
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3384
-
-
C:\Windows\Installer\MSI77A7.tmp"C:\Windows\Installer\MSI77A7.tmp"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window3⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window3⤵PID:984
-
-
-
C:\Windows\Installer\MSI9C37.tmp"C:\Windows\Installer\MSI9C37.tmp"2⤵
- Executes dropped EXE
PID:3000
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4612
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5973fe.rbs
- Size 8KB
- SHA256 5a28a06cdfb42ca937da249473b98ca209619475c6ab586e2e32e365562090bf
- MD5 6412c918bcf3364946b3b33059fdcdeb
- SHA1 f292886fff48f6ee66bb88d16ddfcf7598cf2781
- SHA512 4e22133e8730394e63c011b8021f4e589cf176adf0fb2ca6a3aca8c3b10c4706983a8f1152a04fb4b817b07b843ed63f363f1496422bca65198430d6ec686051
- SSDEEP 192:w/Cv/AJ68IL68ppegfrIBAHssgeFpDHob1DyT6E/:wz6D6Vvo
- TLSH T1B302DD86F750C9D2F9D62732D7172B5137B3D6E8D321238B084F81A59F83B9A8B584C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI77A7.tmp
- Size 3.3MB
- SHA256 555c22c2504b29b31adc40d8b7068b3d829ec26dec666bfa77c03307ee57dd5c
- MD5 4ece29ed5dce6a03f0aa13358ea758b7
- SHA1 3b60d111fec843b89eb7622836500674d72589ce
- SHA512 ccfa6ed8874fb43d043576d8b8b143ef56186601c60e183093bb984547284e278a95251a10ab1001d9b8a353d09ccd5bde1ad1e095077aedd5675b7b19e71840
- SSDEEP 98304:CNA3xMwqmTQhfBY0oepa8BoFyPsYVKJ0U:Cm3mwH4B1oF0SykYPU
- TLSH T1A5F53395B7A014F9E1A7B436C4211106E3793D2513706BDF93A0877AEF2B662CE39F42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9C37.tmp
- Size 329KB
- SHA256 00d7c9257a88e98e709065e6c7e286cf378f1f16da528b67787095fbe7dc3b92
- MD5 f596510fdb220d50bd17ade10b1122d1
- SHA1 ba15724ce90fe45fd0a0c947580d72b745da5628
- SHA512 7fbb83aab0722903c9276e2cc5845b5aa86f7f24aeea1bc5e2cf2957d4084dc47a116c8c351a5152cbad739ba14b435182dce06bfab8f66e590580d0423d441a
- SSDEEP 6144:T/EIJq5q9KyXHX3+aafQmzi4SWG0iZzjJnViedg/u:TcIo5PyXHXgQm+4SZ0iZz1n0edg/u
- TLSH T13574C04AB3E910FCD177913989611507F7B2B8221320ABAF07E047B59F276D19D3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 1d4240f3bff28e1a2538f594627fd8256ef00c0cb17fc5fb5daf99cbfe483e13
- MD5 b8844c21780d81a228ae248fa64d08ab
- SHA1 4efbd5bf1f72eca8a1e438cd00ebca2dbeca3996
- SHA512 e694e0bfd19348c69692fa3f209034f838a5f74e751a15b759d1e799cc6204ba43ddb69d71a506eee85062d9073c76003d682da962d8b8e46e09bbec27c90893
- SSDEEP 24576:sFo3DMPOdoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeQ:PHw
- TLSH T14457042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f3a702f7-f529-45ec-ae5f-1307ba9d369d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1cccc8cb0ab881b9732f881e9425c1a8059aa0c7bc9d5bbd7638a3dd461bbe6b
- MD5 60a79f70c7384d97617759c859c63d6c
- SHA1 47c68a9956408bcd139eb5895873fe688aa9feef
- SHA512 b1ff463ea385035ff2712b17fa6961ab8e6f0ba24d2f1b9cf63503077281f767f7cc4fd1b611606c75d80835d818ea37abc2d371c2f3edcd82d61e8cf1954bc3
- SSDEEP 96:FEXFOHvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:O07b++uVmN
- TLSH T1F5D188185AF54711E2B3AB7129F18557A877B811EF33CB8E0198238E6670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH