Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 12:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20260925_1430.clickfixmalware.p7z8zuisfbufr3.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
20260925_1430.clickfixmalware.p7z8zuisfbufr3.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 20260925_1430.clickfixmalware.p7z8zuisfbufr3.msi
- Size 3.1MB
- Sample260925-pvb2yawemb
- SHA256 ac77785703f4d68076b970698345c77b279bb1165326d480efcf58adb3a961b9
- MD5 463fd21ce2de5e660cc6f093e904a1a5
- SHA1 24c4ed3463e198a1554183ce836305ba18bd5a56
- SHA512 8b9ab14f2a76b4e17e227e1c461ab230c5bd0a9777dc821cca074b106521687cfc4d20f6f04805ae0ee1d2dedb1696ed62fea4d17c698e37de6089a619a084a4
- SSDEEP 98304:jTxa7bQfzsZlDCDvmOMHmawNkC1nB02fLyX:jJsDPOMYT1nB0mL
- TLSH T1DAE53352F948935FD1120E35BD0B93E42E83EDB98EB98665150A731C1D32DB80DAF8F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Installer\e58d6d3.msi msiexec.exe File opened for modification C:\Windows\Installer\e58d6d3.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3064 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001302849f6a5860da0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001302849f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001302849f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1302849f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1302849f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 3064 msiexec.exe Token: SeIncreaseQuotaPrivilege 3064 msiexec.exe Token: SeSecurityPrivilege 1248 msiexec.exe Token: SeCreateTokenPrivilege 3064 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3064 msiexec.exe Token: SeLockMemoryPrivilege 3064 msiexec.exe Token: SeIncreaseQuotaPrivilege 3064 msiexec.exe Token: SeMachineAccountPrivilege 3064 msiexec.exe Token: SeTcbPrivilege 3064 msiexec.exe Token: SeSecurityPrivilege 3064 msiexec.exe Token: SeTakeOwnershipPrivilege 3064 msiexec.exe Token: SeLoadDriverPrivilege 3064 msiexec.exe Token: SeSystemProfilePrivilege 3064 msiexec.exe Token: SeSystemtimePrivilege 3064 msiexec.exe Token: SeProfSingleProcessPrivilege 3064 msiexec.exe Token: SeIncBasePriorityPrivilege 3064 msiexec.exe Token: SeCreatePagefilePrivilege 3064 msiexec.exe Token: SeCreatePermanentPrivilege 3064 msiexec.exe Token: SeBackupPrivilege 3064 msiexec.exe Token: SeRestorePrivilege 3064 msiexec.exe Token: SeShutdownPrivilege 3064 msiexec.exe Token: SeDebugPrivilege 3064 msiexec.exe Token: SeAuditPrivilege 3064 msiexec.exe Token: SeSystemEnvironmentPrivilege 3064 msiexec.exe Token: SeChangeNotifyPrivilege 3064 msiexec.exe Token: SeRemoteShutdownPrivilege 3064 msiexec.exe Token: SeUndockPrivilege 3064 msiexec.exe Token: SeSyncAgentPrivilege 3064 msiexec.exe Token: SeEnableDelegationPrivilege 3064 msiexec.exe Token: SeManageVolumePrivilege 3064 msiexec.exe Token: SeImpersonatePrivilege 3064 msiexec.exe Token: SeCreateGlobalPrivilege 3064 msiexec.exe Token: SeBackupPrivilege 2868 vssvc.exe Token: SeRestorePrivilege 2868 vssvc.exe Token: SeAuditPrivilege 2868 vssvc.exe Token: SeBackupPrivilege 1248 msiexec.exe Token: SeRestorePrivilege 1248 msiexec.exe Token: SeRestorePrivilege 1248 msiexec.exe Token: SeTakeOwnershipPrivilege 1248 msiexec.exe Token: SeBackupPrivilege 2276 srtasks.exe Token: SeRestorePrivilege 2276 srtasks.exe Token: SeSecurityPrivilege 2276 srtasks.exe Token: SeTakeOwnershipPrivilege 2276 srtasks.exe Token: SeBackupPrivilege 2276 srtasks.exe Token: SeRestorePrivilege 2276 srtasks.exe Token: SeSecurityPrivilege 2276 srtasks.exe Token: SeTakeOwnershipPrivilege 2276 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3064 msiexec.exe 3064 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1248 wrote to memory of 2276 1248 msiexec.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\20260925_1430.clickfixmalware.p7z8zuisfbufr3.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3064
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 caa49fa00e19070cb483d17edc84891423e6a20b1c0b6399c0d272618e2b2291
- MD5 8ca7b7d152ff050d579d6e361e4a4082
- SHA1 0c54b5b2237d028c3baa2988aaec3d0a20e5a6d2
- SHA512 65eb3616d35026e9a8329e2d006aa709e8664f135fa6d4dbfba6ea188f18d1debdbe4b78f6ff0f0a6e253b48b8c29fea74a79b202c7f7c9b885a84c4978f4f89
- SSDEEP 24576:+u8m+1zkdoO/vvTLr2GejWKyXfkzOFGyqQGNE5H1eUqH+BvbYPlfegthj:h
- TLSH T1C547B52437FD2210E7F7AE3CA8F06A2349397D579C15DE8D45411B4E0922BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{9f840213-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e5d8a8be-d048-4703-b70a-84ebd898ddc6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 72bfbc7778ecb37e53c7403873478833ff23a456bfc2987bb13bf1c8e9b77f28
- MD5 922c819cd42962b7d84d708f037fe3e4
- SHA1 10c328b0c1213f12117ad9d42f8ed5126a61cfa0
- SHA512 14e1f62d415a741ca750a48e1e0df970a7b92d4f671ae3434c4647e7241f94261d21d9c806664cd8a89bd0d6c634d91ab8d4eab9ef79648809bcf5fe87937ca4
- SSDEEP 96:FMEFjkTvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:OQ0b++ZVm
- TLSH T1FDD18A085AF54711E2B3AB7229F14557A477B811EF33CB8E0198238E2670910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH