Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 12:39
Behavioral task
behavioral1
Sample
ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2.msi
- Size 580KB
- Sample260925-pv2mlasvby
- SHA256 ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2
- MD5 752db4b87198eff1979ebf07156b20ae
- SHA1 674fcfc27b430a88091475991ebb8d96a4d81fae
- SHA512 eda8ba164ebbbcf77b60e5adfd2edcd17b5de3a822d01c36f0415f637557b0aeda89b2974e7cf5667a7239ca4f15871c0d3fb728de4ba6dd4bc560de62a2f006
- SSDEEP 12288:eIRrmyV1eJvNIGMevuspubrA8oDqT5EEbDWJWlH+oNQ99oD:ZTmdLPpuv5EEyGNQ99U
- TLSH T112C4231637A9823BE1C66734902CF3848E287C6C6F1E18167275715E1DB33E0DAB2BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1928 rnpkeys.exe - Loads dropped DLL 2 IoCs
pid Process 1928 rnpkeys.exe 1928 rnpkeys.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e59bdd8.msi msiexec.exe File opened for modification C:\Windows\Installer\e59bdd8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFAEBCED43BAB6C796.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{37EB615D-B64D-49CC-BEE6-BAAD778DF181} msiexec.exe File created C:\Windows\SystemTemp\~DFFAFD8A51E7780FC2.TMP msiexec.exe File created C:\Windows\Installer\e59bdda.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC327.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF6F0BCAFC4F238D12.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFCA94FCC758857FEC.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1948 msiexec.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3760 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3940 msiexec.exe 3940 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1948 msiexec.exe Token: SeIncreaseQuotaPrivilege 1948 msiexec.exe Token: SeSecurityPrivilege 3940 msiexec.exe Token: SeCreateTokenPrivilege 1948 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1948 msiexec.exe Token: SeLockMemoryPrivilege 1948 msiexec.exe Token: SeIncreaseQuotaPrivilege 1948 msiexec.exe Token: SeMachineAccountPrivilege 1948 msiexec.exe Token: SeTcbPrivilege 1948 msiexec.exe Token: SeSecurityPrivilege 1948 msiexec.exe Token: SeTakeOwnershipPrivilege 1948 msiexec.exe Token: SeLoadDriverPrivilege 1948 msiexec.exe Token: SeSystemProfilePrivilege 1948 msiexec.exe Token: SeSystemtimePrivilege 1948 msiexec.exe Token: SeProfSingleProcessPrivilege 1948 msiexec.exe Token: SeIncBasePriorityPrivilege 1948 msiexec.exe Token: SeCreatePagefilePrivilege 1948 msiexec.exe Token: SeCreatePermanentPrivilege 1948 msiexec.exe Token: SeBackupPrivilege 1948 msiexec.exe Token: SeRestorePrivilege 1948 msiexec.exe Token: SeShutdownPrivilege 1948 msiexec.exe Token: SeDebugPrivilege 1948 msiexec.exe Token: SeAuditPrivilege 1948 msiexec.exe Token: SeSystemEnvironmentPrivilege 1948 msiexec.exe Token: SeChangeNotifyPrivilege 1948 msiexec.exe Token: SeRemoteShutdownPrivilege 1948 msiexec.exe Token: SeUndockPrivilege 1948 msiexec.exe Token: SeSyncAgentPrivilege 1948 msiexec.exe Token: SeEnableDelegationPrivilege 1948 msiexec.exe Token: SeManageVolumePrivilege 1948 msiexec.exe Token: SeImpersonatePrivilege 1948 msiexec.exe Token: SeCreateGlobalPrivilege 1948 msiexec.exe Token: SeBackupPrivilege 2112 vssvc.exe Token: SeRestorePrivilege 2112 vssvc.exe Token: SeAuditPrivilege 2112 vssvc.exe Token: SeBackupPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1948 msiexec.exe 1948 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1948 msiexec.exe 3940 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2188 3940 msiexec.exe 95 PID 3940 wrote to memory of 3760 3940 msiexec.exe 97 PID 3760 wrote to memory of 1928 3760 cmd.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1948
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2188
-
-
C:\Windows\system32\cmd.execmd.exe /c start /min "" "rnpkeys.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\ProgramData\keyroll\rnpkeys.exe"rnpkeys.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59bdd9.rbs
- Size 9KB
- SHA256 cf33018cda6ec1645c20db11a828c4a0394020ac4afd512caa313084159d0091
- MD5 d97814b3ef3df8d8a70b2c8c2478e33c
- SHA1 98fcd443f85af5f616c25773bc2be1c4070bd443
- SHA512 93cd9e882575b986053be9cac3780aa92c6c011f7519f3d1f22602c0155a3af022d585c34797e6ec28d3b671b5fe00a3b33ef8753f3173035a7e0d8073d09c04
- SSDEEP 192:KdtHCczOIkiHI6kiHJWYUDxlmHSR2xNxwcpDR3NcRkFXq:K7jkiBki1G
- TLSH T198120242B54081D3E86B1732875727443BEAE3F98250768F44CE81748F53A9DEAEDAC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\keyroll\rnp.dll
- Size 300KB
- SHA256 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8
- MD5 c68b207f9fb46823f0760c099f92bdaa
- SHA1 0490e1a565e44fe5dfd56dc714fc7bf4f4351d18
- SHA512 79bb12015a9cbdb05bdf68c6ac165c6258f696af004934842796a77cdc72376017b16ebc246a5216e0e6a8360cb3bda139b57b58d3f93792f7c270f4ee9d4671
- SSDEEP 1536:ENT8GVHBqPYlAPArHUySGegmeKiXTJiTNEmKQbPuqUKtPb4eR+6dgWcalPHrfx1T:VGZBqPYKPG0JNSevHbSyNGal7vg/OQwZ
- TLSH T1A764886133FA6600F7FB6F7A9AB2A494DA3978722E75D10E0028814F2C75F95D970732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\keyroll\rnpkeys.exe
- Size 766KB
- SHA256 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991
- MD5 c851a97d208e5bc861ad6154c4731c86
- SHA1 31f45729438aa0527ff0a9b044195a67e773d8cb
- SHA512 228f3b5aab997159aa298bc9030fa9dcfad3bfd1dea5fd1564aec06acb83d35aa4c7f9e00d69e995c5896e42ce426935b97dcd4f210302f983df3b82fb7f83d0
- SSDEEP 12288:i8WTTJhxrTxgC4HP5rVixgEw1nHVM1DYOO6s06J2AAq6RfmagnD2bbMK/:iVrTqPHBEw5HVMtC6sR8gnD3Y
- TLSH T177F48D267A4841FED49AC0B586865552FBB1788B0B31AACF43D4477A2F6B6F41F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\keyroll\tdwp.dll
- Size 168KB
- SHA256 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7
- MD5 31c1bdfdaf139e17070bf3199da2eca9
- SHA1 7d737394140c056269ca173c73970b0dc8bc6b56
- SHA512 edc3afea34ec0c77baf04513f3851d6019f9c868ec5dbe8221ccb31ea5104977891c4dc3b32aeeaf2b3e30191a8a64087f5cadfcb0af97898174ad63f5b80774
- SSDEEP 3072:vJIP3FqeRjPDcR7eGRg07x+SPLg66O35nmDKarhOj9H4ENa7NwU:veoel07eGRx+Npa5nmDuYEsD
- TLSH T1B9F37C07B2A500FBE563957884B76606E37274011760ABEF03914B7A6F23BE19E7F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59bdd8.msi
- Size 580KB
- SHA256 ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2
- MD5 752db4b87198eff1979ebf07156b20ae
- SHA1 674fcfc27b430a88091475991ebb8d96a4d81fae
- SHA512 eda8ba164ebbbcf77b60e5adfd2edcd17b5de3a822d01c36f0415f637557b0aeda89b2974e7cf5667a7239ca4f15871c0d3fb728de4ba6dd4bc560de62a2f006
- SSDEEP 12288:eIRrmyV1eJvNIGMevuspubrA8oDqT5EEbDWJWlH+oNQ99oD:ZTmdLPpuv5EEyGNQ99U
- TLSH T112C4231637A9823BE1C66734902CF3848E287C6C6F1E18167275715E1DB33E0DAB2BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 f26184fb20e6854376f3f0f1d226d959ce72632e923989e320a27b884ef0352a
- MD5 77ea59cfcc3556bd8dd9ce059ee9fa03
- SHA1 f5a5d6295fafb5ed2f7274ab433b75fedbbe22ed
- SHA512 9022bf8eec75cdd674d748e47fab11f45f7de319414e9662ab320c3ae6286f1bbb2db637aeb7646046aa4b230998bf5a9048baa91f1e6ccbc79ef09130830ca7
- SSDEEP 24576:dFo3DMPidoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+H:KHE
- TLSH T1F257B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{746a263c-3077-4a2e-961a-081349f9b60f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ab110744d3971e1809721d768bb17414b98ccf354c53606d9a29cc5e8c61fcfb
- MD5 4ef761ea9c1a8d11dd85f569e8809edd
- SHA1 2131294194fcdd4a3edf21efffe942e591db6a02
- SHA512 e46051a2fbc9c6b39f013b0d9e4aa984649b4971da5291bd4823dee2ef20f83502782ea1da30b161aa032e38ed9857f7ab8a925a7c8cf1ef96c848ac4521ebfd
- SSDEEP 96:F6PqSZuvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:cPab++uVmN
- TLSH T187D1860C5AF54711E2B3AB3228F14557A877B852EF33CB8E0198238E6670910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH