Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 15:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ossl.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ossl.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target ossl.msi
- Size 5.8MB
- Sample261003-s6sqlstvbx
- SHA256 f834be0ee1ac9151cc86895cf8064c6802c0164e81cb4bf95eeceb3f07e8f523
- MD5 83671e263c44ce5e4b34e2aa0cb0f264
- SHA1 85e8ef110ca9103671ed6bc06f1de7bf7d86c1db
- SHA512 ba737f649c478745c265732372a16a8be10d9e3f0d7feba3190857915018cdd427b53fd4b9b6d88399f5c33e83251a362f2ec545c3410e2f76ee256deb73500d
- SSDEEP 98304:drcEBE9aw90SAmRh3DjSKa76HlWG6837yEVnPz0ZbXlNizn7v4HxgSO0FtmZ8f2v:drv6n0FQTjxN7mWr05vSnr4HOYFx
- TLSH T1BE563323B4E6D976F5F30A75862D6B76283DBC6C2F10D56A4304F91F0B309916B7232A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2180 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe 4272 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp - Loads dropped DLL 2 IoCs
pid Process 4272 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp 4272 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFB236754AA9BC7E36.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF38B58827746238A5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8004.tmp msiexec.exe File created C:\Windows\Installer\e597b22.msi msiexec.exe File opened for modification C:\Windows\Installer\e597b22.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{0DE61FED-0DCD-4CDF-BAAC-BF64792B7948} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6036 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x000d00000001c52e-9.dat innosetup behavioral2/memory/2180-10-0x0000000000400000-0x0000000000415000-memory.dmp innosetup behavioral2/memory/2180-25-0x0000000000400000-0x0000000000415000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4820 msiexec.exe 4820 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 6036 msiexec.exe Token: SeIncreaseQuotaPrivilege 6036 msiexec.exe Token: SeSecurityPrivilege 4820 msiexec.exe Token: SeCreateTokenPrivilege 6036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6036 msiexec.exe Token: SeLockMemoryPrivilege 6036 msiexec.exe Token: SeIncreaseQuotaPrivilege 6036 msiexec.exe Token: SeMachineAccountPrivilege 6036 msiexec.exe Token: SeTcbPrivilege 6036 msiexec.exe Token: SeSecurityPrivilege 6036 msiexec.exe Token: SeTakeOwnershipPrivilege 6036 msiexec.exe Token: SeLoadDriverPrivilege 6036 msiexec.exe Token: SeSystemProfilePrivilege 6036 msiexec.exe Token: SeSystemtimePrivilege 6036 msiexec.exe Token: SeProfSingleProcessPrivilege 6036 msiexec.exe Token: SeIncBasePriorityPrivilege 6036 msiexec.exe Token: SeCreatePagefilePrivilege 6036 msiexec.exe Token: SeCreatePermanentPrivilege 6036 msiexec.exe Token: SeBackupPrivilege 6036 msiexec.exe Token: SeRestorePrivilege 6036 msiexec.exe Token: SeShutdownPrivilege 6036 msiexec.exe Token: SeDebugPrivilege 6036 msiexec.exe Token: SeAuditPrivilege 6036 msiexec.exe Token: SeSystemEnvironmentPrivilege 6036 msiexec.exe Token: SeChangeNotifyPrivilege 6036 msiexec.exe Token: SeRemoteShutdownPrivilege 6036 msiexec.exe Token: SeUndockPrivilege 6036 msiexec.exe Token: SeSyncAgentPrivilege 6036 msiexec.exe Token: SeEnableDelegationPrivilege 6036 msiexec.exe Token: SeManageVolumePrivilege 6036 msiexec.exe Token: SeImpersonatePrivilege 6036 msiexec.exe Token: SeCreateGlobalPrivilege 6036 msiexec.exe Token: SeBackupPrivilege 3440 vssvc.exe Token: SeRestorePrivilege 3440 vssvc.exe Token: SeAuditPrivilege 3440 vssvc.exe Token: SeBackupPrivilege 4820 msiexec.exe Token: SeRestorePrivilege 4820 msiexec.exe Token: SeRestorePrivilege 4820 msiexec.exe Token: SeTakeOwnershipPrivilege 4820 msiexec.exe Token: SeRestorePrivilege 4820 msiexec.exe Token: SeTakeOwnershipPrivilege 4820 msiexec.exe Token: SeBackupPrivilege 4692 srtasks.exe Token: SeRestorePrivilege 4692 srtasks.exe Token: SeSecurityPrivilege 4692 srtasks.exe Token: SeTakeOwnershipPrivilege 4692 srtasks.exe Token: SeBackupPrivilege 4692 srtasks.exe Token: SeRestorePrivilege 4692 srtasks.exe Token: SeSecurityPrivilege 4692 srtasks.exe Token: SeTakeOwnershipPrivilege 4692 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 6036 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6036 msiexec.exe 4820 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4692 4820 msiexec.exe 94 PID 4820 wrote to memory of 2180 4820 msiexec.exe 96 PID 2180 wrote to memory of 4272 2180 setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ossl.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe"C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe" /NORESTART /RESTARTEXITCODE=0 /MSI=50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\is-69G53.tmp\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-69G53.tmp\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp" /SL5="$A0250,5591231,58368,C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe" /NORESTART /RESTARTEXITCODE=0 /MSI=50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4272
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3440
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-69G53.tmp\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.tmp
- Size 702KB
- SHA256 3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
- MD5 1afbd25db5c9a90fe05309f7c4fbcf09
- SHA1 baf330b5c249ca925b4ea19a52fe8b2c27e547fa
- SHA512 3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
- SSDEEP 12288:XqIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR:aIZg+uiirPO37fzH4A6haDbcUZEbdT9+
- TLSH T1F7E47D32F2A08837D1731E789D1B82955936FD113F38A9A736F91F0C4E796817A272D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-TC5AV.tmp\_isetup\_isdecmp.dll
- Size 29KB
- SHA256 6535ba91fcca7174c3974b19d9ab471f322c2bf49506ef03424517310080be1b
- MD5 fd4743e2a51dd8e0d44f96eae1853226
- SHA1 646cef384e949aaf61e6d0b243d8d84ab04e79b7
- SHA512 4587c853871624414e957f083713ec62d50c46b7041f83faa45dbf99b99b8399fc08d586d240e4bccee5eb0d09e1cdcb3fd013f07878adf4defcc312712e468d
- SSDEEP 768:84NHPfHCs6GNOpiM+RFjFyzcN23AEoSXMYisio:8anvc+R9F4s8BoaMYi2
- TLSH T11ED24A91B9DD1F43D7880A3056C9D427AC31E1D84B0494EBD9CDC6BB3A893F25EB315A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~_tmpdir\setup-50A9FBE2-0F8C-4D5D-97A4-A63A71C4EA1E-3.6.3-light-x64.exe
- Size 5.6MB
- SHA256 ea93c6f5d479a288784791f31c90ab5e4381abac127019cb95841bff19dcbc1a
- MD5 698ee2d9375c71c79d2595875ee00961
- SHA1 7be25ea4984c486df8dc76e35f335ad049aae78d
- SHA512 c46b6b6530e92edd6978258e4c062dbb0308c29ff9f1d283a044b83bc74532c54e34e4778d4505cc4018794c03738d10efabeed639b6c8eeac5a85c44ff3eaf7
- SSDEEP 98304:ZQrvgMAw6xys0/u4tuMQ6PCLcbpyRCOV3VDl2Q7yZxys0/u4tuMQ6PCLcbpyRCO7:Grv4weD0Gxv6FFyDribD0Gxv6FFyDDB
- TLSH T1D6463367E7A2DDF1F4B2CEBC97190E7A5029ACAD273021922746FE5F0B05920BD35139
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ea5237484cebc33af752b7740422f90c06bcbd70add1ce17c40e50461f12dcfe
- MD5 cb1dee0545b26e93d1031328e587cf39
- SHA1 04431c13374ec7ac0da6eb5aa56613c919469624
- SHA512 2babe61e315b5dcdc84c8d6fe257f363f6faf9cb3b0a7e353c556af335b30b923144407f1e5575064c5d1503d1d3ea04e5e8af4b5521a8c45f87716f0c089f8f
- SSDEEP 24576:wFo3DMPXdoO/vvTL/igWWyFgPbuMdLxlULwEd7I+gDY65hX2cYBmWPMXyu4:+HA
- TLSH T1E657901436F92150E7F79E3CA8F0AA2349397D5B9C1ADE8D05411F4E0861FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b6a78f0e-d824-4427-85f1-8a1f909f52f7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6f62ebdf69a6056e9dd24aec5b802d0e411ddfcbb85f6aee86520ec1f8bada30
- MD5 eb6a692b9237f221ef4402730178fc33
- SHA1 f0d6023212508077e30925a2d5020a48399ce170
- SHA512 65827c15568c6a24ddf8a1da16d1ac448cb3339236470837d7940399f411a8a8ef7cef04afcd854d95dcd12123abedc4ce16e18f5921ab1cc7dfeae55c6a71b7
- SSDEEP 96:Foip+3vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Gfb++uVmN
- TLSH T1DDD188185AF54711E2B3AB3128F58557A877B911FF33CB8E0198638E2670A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH