Overview
overview
7Static
static
5CANdelaPer...1).exe
windows10-2004-x64
6CANdelaPer...1).exe
windows11-ltsc_2024-x64
6CANdelaPer...20.msi
windows10-2004-x64
6CANdelaPer...20.msi
windows11-ltsc_2024-x64
6MSIChainer.exe
windows10-2004-x64
6MSIChainer.exe
windows11-ltsc_2024-x64
6Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...64.exe
windows10-2004-x64
7Prerequisi...64.exe
windows11-ltsc_2024-x64
7Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Prerequisi...la.rtf
windows10-2004-x64
1Prerequisi...la.rtf
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 08:27
Behavioral task
behavioral1
Sample
CANdelaPersistors20 (1).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
CANdelaPersistors20 (1).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
CANdelaPersistors20.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
CANdelaPersistors20.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
MSIChainer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral6
Sample
MSIChainer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral7
Sample
Prerequisites/DotNetFX40/cs/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
Prerequisites/DotNetFX40/cs/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
Prerequisites/DotNetFX40/de/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Prerequisites/DotNetFX40/de/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Prerequisites/DotNetFX40/dotNetFx40_Full_x86_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral12
Sample
Prerequisites/DotNetFX40/dotNetFx40_Full_x86_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral13
Sample
Prerequisites/DotNetFX40/en/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
Prerequisites/DotNetFX40/en/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
Prerequisites/DotNetFX40/es/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Prerequisites/DotNetFX40/es/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
Prerequisites/DotNetFX40/fr/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Prerequisites/DotNetFX40/fr/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Prerequisites/DotNetFX40/it/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Prerequisites/DotNetFX40/it/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Prerequisites/DotNetFX40/ja/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
Prerequisites/DotNetFX40/ja/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
Prerequisites/DotNetFX40/ko/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
Prerequisites/DotNetFX40/ko/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
Prerequisites/DotNetFX40/pl/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
Prerequisites/DotNetFX40/pl/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
Prerequisites/DotNetFX40/pt-BR/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
Prerequisites/DotNetFX40/pt-BR/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
Prerequisites/DotNetFX40/ru/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
Prerequisites/DotNetFX40/ru/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
Prerequisites/DotNetFX40/tr/Eula.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
Prerequisites/DotNetFX40/tr/Eula.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target CANdelaPersistors20.msi
- Size 38.4MB
- Sample260922-kcyqrssbjf
- SHA256 84b3fbc064e11e91db0f01fe4b754cb010460aac39a0a5ab70a7290697ea3888
- MD5 75f6b1e1d0dbcf0fc34da6545abe584e
- SHA1 0fffc0e76df7d14a70a94444b8fa94f58d2cb513
- SHA512 2759c633b2744ff284942d689d199eea6954c440a8fe1c395f133690567eb7e2b9413fce080fa1dfcd58b78cea67985036836d797e8d1e5b3d8b8b60fb04fae6
- SSDEEP 786432:LPgBbJVuIEj+kcZbGwRzofl3Q7VuNgs5CB9UMDjO3/:LoBlVua9EJQ7VuNgvB9v
- TLSH T1B6973383EDA2EB3EE85ED1BE48572B2E81418D3D4F506C2361B7B054A1F4769A9F430D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\17.0.1_17.0.1_18.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.5.1_7.5.1_8.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.0.1_7.0.1_7.1.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.0.1_7.0.1_7.1.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\expatw.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\Logging.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\Buffers.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\16.0.1_16.0.1_17.0.99999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\CANdelaSharedUtil.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\Requirements.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\16.0.1_16.0.1_17.0.99999\Requirements.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\1.1.0_2.0.5_3.0.16\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.0.1_7.0.1_7.1.99999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.0.1_7.0.1_7.1.99999\CANdelaSharedUtil.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\DepMan.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\Logging.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\VeLogging.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\13.0.1_13.0.1_15.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.5.1_7.5.1_8.0.99999\expatw.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\Requirements.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.1.1_7.1.1_7.5.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\VeLogging.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_8.0.1_8.2.99999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_5.0.1_5.5.999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\VeLogging.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.1.1_9.1.1_12.0.99999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\expatw.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\17.0.1_17.0.1_18.0.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.0.1_6.0.1_6.5.999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.5.1_7.5.1_8.0.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_5.0.1_5.5.999\Buffers.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\expatw.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\Requirements.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\16.0.1_16.0.1_17.0.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\VeLogging.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\1.1.0_2.0.5_3.0.16\Buffers.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\Requirements.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.0.1_6.0.1_6.5.999\CANdelaSharedUtil.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\Buffers.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.1.1_9.1.1_12.0.99999\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\17.0.1_17.0.1_18.0.99999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\CANdelaConvert.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\CANdelaSharedUtil.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\DaMe.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\expatw.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\Persistor.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\13.0.1_13.0.1_15.0.99999\Requirements.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\13.0.1_13.0.1_15.0.99999\VeLogging.dll msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e594cce.msi msiexec.exe File opened for modification C:\Windows\Installer\e594cce.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4EE1.tmp msiexec.exe File created C:\Windows\Installer\e594cd0.msi msiexec.exe File created C:\Windows\Installer\SourceHash{D1AB5818-B0E4-454A-972E-D45DBB94A0D0} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2348 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\PackageCode = "352D8160DCEFDA94DB2F4DC25D3EB262" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8185BA1D4E0BA45479E24DD5BB490A0D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\ProductName = "Vector CANdelaPersistors 20" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AEAC170454295914DAC861E3912ADD36\8185BA1D4E0BA45479E24DD5BB490A0D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8185BA1D4E0BA45479E24DD5BB490A0D\FeatureCANdelaPersistors msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Version = "335544420" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\PackageName = "CANdelaPersistors20.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AEAC170454295914DAC861E3912ADD36 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5016 msiexec.exe 5016 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2348 msiexec.exe Token: SeIncreaseQuotaPrivilege 2348 msiexec.exe Token: SeSecurityPrivilege 5016 msiexec.exe Token: SeCreateTokenPrivilege 2348 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2348 msiexec.exe Token: SeLockMemoryPrivilege 2348 msiexec.exe Token: SeIncreaseQuotaPrivilege 2348 msiexec.exe Token: SeMachineAccountPrivilege 2348 msiexec.exe Token: SeTcbPrivilege 2348 msiexec.exe Token: SeSecurityPrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeLoadDriverPrivilege 2348 msiexec.exe Token: SeSystemProfilePrivilege 2348 msiexec.exe Token: SeSystemtimePrivilege 2348 msiexec.exe Token: SeProfSingleProcessPrivilege 2348 msiexec.exe Token: SeIncBasePriorityPrivilege 2348 msiexec.exe Token: SeCreatePagefilePrivilege 2348 msiexec.exe Token: SeCreatePermanentPrivilege 2348 msiexec.exe Token: SeBackupPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeShutdownPrivilege 2348 msiexec.exe Token: SeDebugPrivilege 2348 msiexec.exe Token: SeAuditPrivilege 2348 msiexec.exe Token: SeSystemEnvironmentPrivilege 2348 msiexec.exe Token: SeChangeNotifyPrivilege 2348 msiexec.exe Token: SeRemoteShutdownPrivilege 2348 msiexec.exe Token: SeUndockPrivilege 2348 msiexec.exe Token: SeSyncAgentPrivilege 2348 msiexec.exe Token: SeEnableDelegationPrivilege 2348 msiexec.exe Token: SeManageVolumePrivilege 2348 msiexec.exe Token: SeImpersonatePrivilege 2348 msiexec.exe Token: SeCreateGlobalPrivilege 2348 msiexec.exe Token: SeBackupPrivilege 1812 vssvc.exe Token: SeRestorePrivilege 1812 vssvc.exe Token: SeAuditPrivilege 1812 vssvc.exe Token: SeBackupPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeBackupPrivilege 6064 srtasks.exe Token: SeRestorePrivilege 6064 srtasks.exe Token: SeSecurityPrivilege 6064 srtasks.exe Token: SeTakeOwnershipPrivilege 6064 srtasks.exe Token: SeBackupPrivilege 6064 srtasks.exe Token: SeRestorePrivilege 6064 srtasks.exe Token: SeSecurityPrivilege 6064 srtasks.exe Token: SeTakeOwnershipPrivilege 6064 srtasks.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe Token: SeTakeOwnershipPrivilege 5016 msiexec.exe Token: SeRestorePrivilege 5016 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2348 msiexec.exe 2348 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5016 wrote to memory of 6064 5016 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CANdelaPersistors20.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2348
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:6064
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e594ccf.rbs
- Size 37KB
- SHA256 24256e778812b242a372ac2a252a30153777835e4058a68df9cdd530394d2cae
- MD5 70151d71bce86dc98f0efffca3a79399
- SHA1 f314b2d256975d4636cda7251ed182d1b7cc4fad
- SHA512 1e319882fc481d96455496c4f61e1dfda42c8c28342f7304de6f27784f8fa96220c19682710e0a3541d6aaf6dd1199787bad96da88f946c01a098957eabcca41
- SSDEEP 768:+YLlLcLlLjLlLjLlLYLlLgLlL9LlL5LlLLLlLhLlLALlLTLlLVLlL6LlLALlLIl7:nxYx/xvxExUxhx1x3xtxcxfxpx+xcxi7
- TLSH T19B033E838E52D3FCFE5790A677926C61138ADFC927700532B16D631B69C0909BB782B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\expatw.dll
- Size 108KB
- SHA256 2eb4054a039e52b360012bac51d91dd7ebf3cc52a4e6817e7967369809b8d5ad
- MD5 64ea4ede62429692ed5d6afb0a3bd17f
- SHA1 c292db93e68472eeb58a56f743ddc2e9d54e8e70
- SHA512 51cee0e05a3b3ec0a7c7796664d5046cc0e49adc3c3cecd96a8df799973824b6608610e247e8072c3b2a144a768feabb1dcdb3d7089bcb9ed0ecbb7b22f72924
- SSDEEP 1536:1owViW8je6l+2mx0lSDWwNc0xbK8Nq3KAyrFSjbZy:1o8iR7+7RWD0x+8I3diFSjbZy
- TLSH T1D9B30720BC83D02AE2D70136A1B80BA2597D9F6107EF55EFAE10B5BD8E339C27935715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e594cce.msi
- Size 38.4MB
- SHA256 84b3fbc064e11e91db0f01fe4b754cb010460aac39a0a5ab70a7290697ea3888
- MD5 75f6b1e1d0dbcf0fc34da6545abe584e
- SHA1 0fffc0e76df7d14a70a94444b8fa94f58d2cb513
- SHA512 2759c633b2744ff284942d689d199eea6954c440a8fe1c395f133690567eb7e2b9413fce080fa1dfcd58b78cea67985036836d797e8d1e5b3d8b8b60fb04fae6
- SSDEEP 786432:LPgBbJVuIEj+kcZbGwRzofl3Q7VuNgs5CB9UMDjO3/:LoBlVua9EJQ7VuNgvB9v
- TLSH T1B6973383EDA2EB3EE85ED1BE48572B2E81418D3D4F506C2361B7B054A1F4769A9F430D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 c8beb1ea7184e9c2d95ecb888a2dfecf39b50e4527d3dcbb442d2a3a96d3c571
- MD5 dea0a4f44c0b047fa33448b481c309d7
- SHA1 06a05db08f56536d6f3b2f18b9575d6aa695da89
- SHA512 d7e22b2111e7b1042d7df133f008f8d08f7b275843af56432283a629f4775b3c68532203e9488f37e2dc3e1a9c20df1f55870a49eb494facc13375cc5fd0afd2
- SSDEEP 24576:Tu8m+1zAdoO/vvTLL2WezWqCHvkTel2y6gGNUJX1O0K3+x/L4vlvuwdhz:4
- TLSH T11147F42436F92210E7F39F3CA8F16A2B493A7D5B9C15DE8D05411F4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{7d83d395-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{10ac54f4-8484-48c1-ac77-49457a62eef9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 bfdaaf87226eac0b812b12362ff1b5193eed7de04d67a3e50facc71b07d78dc7
- MD5 dde6e2de8614cdbd806fd73ab48ae77e
- SHA1 63a26bd2e5b36e4521c7640f43621704cd07d6f2
- SHA512 7606220c605682b37925c7fff08269f9528e95a866b85c006f1797e6750ceceaed0665aa311e6f4e94f9dee5f21e1c26ee1ab945df9b8b095081eaf5b87d84ed
- SSDEEP 96:F+MTBZ4x2kvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Fcb++ZVm
- TLSH T175D189185AE54311E2B3AB7129F14557A877B811EF33CB8E0298238E6670A10F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH