Analysis
- user interaction
yes - max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 15:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ossl.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ossl.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target ossl.msi
- Size 5.8MB
- Sample261003-s6sqlstvbx
- SHA256 f834be0ee1ac9151cc86895cf8064c6802c0164e81cb4bf95eeceb3f07e8f523
- MD5 83671e263c44ce5e4b34e2aa0cb0f264
- SHA1 85e8ef110ca9103671ed6bc06f1de7bf7d86c1db
- SHA512 ba737f649c478745c265732372a16a8be10d9e3f0d7feba3190857915018cdd427b53fd4b9b6d88399f5c33e83251a362f2ec545c3410e2f76ee256deb73500d
- SSDEEP 98304:drcEBE9aw90SAmRh3DjSKa76HlWG6837yEVnPz0ZbXlNizn7v4HxgSO0FtmZ8f2v:drv6n0FQTjxN7mWr05vSnr4HOYFx
- TLSH T1BE563323B4E6D976F5F30A75862D6B76283DBC6C2F10D56A4304F91F0B309916B7232A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2732 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe 3760 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp - Loads dropped DLL 2 IoCs
pid Process 3760 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp 3760 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0DE61FED-0DCD-4CDF-BAAC-BF64792B7948} msiexec.exe File opened for modification C:\Windows\Installer\MSIF39.tmp msiexec.exe File created C:\Windows\Installer\e590e5e.msi msiexec.exe File opened for modification C:\Windows\Installer\e590e5e.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2528 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x00070000000244d6-9.dat innosetup behavioral1/memory/2732-10-0x0000000000400000-0x0000000000415000-memory.dmp innosetup behavioral1/memory/2732-24-0x0000000000400000-0x0000000000415000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000087bc5fd0f69d84a90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000087bc5fd00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090087bc5fd0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a87bc5fd0000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d87bc5fd0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1428 msiexec.exe 1428 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 2528 msiexec.exe Token: SeIncreaseQuotaPrivilege 2528 msiexec.exe Token: SeSecurityPrivilege 1428 msiexec.exe Token: SeCreateTokenPrivilege 2528 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2528 msiexec.exe Token: SeLockMemoryPrivilege 2528 msiexec.exe Token: SeIncreaseQuotaPrivilege 2528 msiexec.exe Token: SeMachineAccountPrivilege 2528 msiexec.exe Token: SeTcbPrivilege 2528 msiexec.exe Token: SeSecurityPrivilege 2528 msiexec.exe Token: SeTakeOwnershipPrivilege 2528 msiexec.exe Token: SeLoadDriverPrivilege 2528 msiexec.exe Token: SeSystemProfilePrivilege 2528 msiexec.exe Token: SeSystemtimePrivilege 2528 msiexec.exe Token: SeProfSingleProcessPrivilege 2528 msiexec.exe Token: SeIncBasePriorityPrivilege 2528 msiexec.exe Token: SeCreatePagefilePrivilege 2528 msiexec.exe Token: SeCreatePermanentPrivilege 2528 msiexec.exe Token: SeBackupPrivilege 2528 msiexec.exe Token: SeRestorePrivilege 2528 msiexec.exe Token: SeShutdownPrivilege 2528 msiexec.exe Token: SeDebugPrivilege 2528 msiexec.exe Token: SeAuditPrivilege 2528 msiexec.exe Token: SeSystemEnvironmentPrivilege 2528 msiexec.exe Token: SeChangeNotifyPrivilege 2528 msiexec.exe Token: SeRemoteShutdownPrivilege 2528 msiexec.exe Token: SeUndockPrivilege 2528 msiexec.exe Token: SeSyncAgentPrivilege 2528 msiexec.exe Token: SeEnableDelegationPrivilege 2528 msiexec.exe Token: SeManageVolumePrivilege 2528 msiexec.exe Token: SeImpersonatePrivilege 2528 msiexec.exe Token: SeCreateGlobalPrivilege 2528 msiexec.exe Token: SeBackupPrivilege 1572 vssvc.exe Token: SeRestorePrivilege 1572 vssvc.exe Token: SeAuditPrivilege 1572 vssvc.exe Token: SeBackupPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeBackupPrivilege 2328 srtasks.exe Token: SeRestorePrivilege 2328 srtasks.exe Token: SeSecurityPrivilege 2328 srtasks.exe Token: SeTakeOwnershipPrivilege 2328 srtasks.exe Token: SeBackupPrivilege 2328 srtasks.exe Token: SeRestorePrivilege 2328 srtasks.exe Token: SeSecurityPrivilege 2328 srtasks.exe Token: SeTakeOwnershipPrivilege 2328 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2528 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1428 wrote to memory of 2328 1428 msiexec.exe 102 PID 1428 wrote to memory of 2732 1428 msiexec.exe 104 PID 2732 wrote to memory of 3760 2732 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ossl.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2528
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe"C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe" /NORESTART /RESTARTEXITCODE=0 /MSI=50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\is-S2E9U.tmp\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-S2E9U.tmp\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp" /SL5="$50202,5591231,58368,C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe" /NORESTART /RESTARTEXITCODE=0 /MSI=50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3760
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1572
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-6FO4N.tmp\_isetup\_isdecmp.dll
- Size 29KB
- SHA256 6535ba91fcca7174c3974b19d9ab471f322c2bf49506ef03424517310080be1b
- MD5 fd4743e2a51dd8e0d44f96eae1853226
- SHA1 646cef384e949aaf61e6d0b243d8d84ab04e79b7
- SHA512 4587c853871624414e957f083713ec62d50c46b7041f83faa45dbf99b99b8399fc08d586d240e4bccee5eb0d09e1cdcb3fd013f07878adf4defcc312712e468d
- SSDEEP 768:84NHPfHCs6GNOpiM+RFjFyzcN23AEoSXMYisio:8anvc+R9F4s8BoaMYi2
- TLSH T11ED24A91B9DD1F43D7880A3056C9D427AC31E1D84B0494EBD9CDC6BB3A893F25EB315A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-S2E9U.tmp\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp
- Size 702KB
- SHA256 3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
- MD5 1afbd25db5c9a90fe05309f7c4fbcf09
- SHA1 baf330b5c249ca925b4ea19a52fe8b2c27e547fa
- SHA512 3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
- SSDEEP 12288:XqIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR:aIZg+uiirPO37fzH4A6haDbcUZEbdT9+
- TLSH T1F7E47D32F2A08837D1731E789D1B82955936FD113F38A9A736F91F0C4E796817A272D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe
- Size 5.6MB
- SHA256 ea93c6f5d479a288784791f31c90ab5e4381abac127019cb95841bff19dcbc1a
- MD5 698ee2d9375c71c79d2595875ee00961
- SHA1 7be25ea4984c486df8dc76e35f335ad049aae78d
- SHA512 c46b6b6530e92edd6978258e4c062dbb0308c29ff9f1d283a044b83bc74532c54e34e4778d4505cc4018794c03738d10efabeed639b6c8eeac5a85c44ff3eaf7
- SSDEEP 98304:ZQrvgMAw6xys0/u4tuMQ6PCLcbpyRCOV3VDl2Q7yZxys0/u4tuMQ6PCLcbpyRCO7:Grv4weD0Gxv6FFyDribD0Gxv6FFyDDB
- TLSH T1D6463367E7A2DDF1F4B2CEBC97190E7A5029ACAD273021922746FE5F0B05920BD35139
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 75184e140a2d3d7a0295fb078b8195249d8b54b6b605b51cd6b954ce3c5cf202
- MD5 0649f8efbe302aece0070a002e24f04c
- SHA1 e2100a4ff0c885e5de181691f11a797e4622b4e7
- SHA512 6f7d1ca1ce474c22825bf9e86d965ca309fcec5aa2ac2012fadbaeccf9091fb4cf00b95f7dab3ffd34f9e93aaeb746932f88b9bba52cb61c6e859bab551d2ee4
- SSDEEP 24576:Hu8m+1zhdoO/vvTLrWUehm6w1dEzc10CIS2Nm7lFMka1ej9ZYfFtsSPBB:F
- TLSH T17A47C52436F92100E7F79E3CACF06A674D3A7D579C159E8D05411B8E0922FB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d05fbc87-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0ec532f0-64b2-44be-a523-e769731df341}_OnDiskSnapshotProp
- Size 6KB
- SHA256 b04d6fe3628757f8aef7b5634952b7a225df6c0e5b7c3cc85ef97c3037297c8e
- MD5 b59c160ff7b8c37c4f51d8441bdb2b0c
- SHA1 1e7f7dc3766ec0817e7f6f34af7c45134a02a7b7
- SHA512 46239d2ea98fa9bd88c5b6c2afb234fdbd99505a86448d45054f97ec8a678932a90c6b08c5458404ee74e09b21da8096a4435b2f8934bca15a3db40a11a52bea
- SSDEEP 96:F9BpxpwYvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Pfjb++ZVmN
- TLSH T1A3D199185AF54711E2B3AB3229F14557A877B911EF33CB8E0298638E2670A10F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH