Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
167.148.201.191_sample.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
167.148.201.191_sample.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 167.148.201.191_sample.msi
- Size 2.0MB
- Sample261015-vpjsgsdd87
- SHA256 25b25da412b5836143a4b06b8670be366a0b78629026543a8720f2676898d310
- MD5 45494ed58f019be9a44efefa95f9c816
- SHA1 c4a66bdafb202f4184b3c47d0528588516d0b337
- SHA512 858ec1de2f6a904bf6e52550fd427a56ae756c76c769a851091e9bc18a72c343bd7d270a5af8339558306335ffda80421ecda3425b8f8eea64c5d5840d27dadc
- SSDEEP 49152:YsTWI0oNlZyesa3vSOMluMqrqSzSS3InnnnTF:TTq4Q8vahqrvOS2
- TLSH T1F3956D236A50600646B598FABEBD5E37695F7409101AD94EFFD34B86F12EBF80802D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3620 p2DyDlCr.exe 1588 p2DyDlCr.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io 12 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e598e8c.msi msiexec.exe File created C:\Windows\Installer\e598e8a.msi msiexec.exe File opened for modification C:\Windows\Installer\e598e8a.msi msiexec.exe File created C:\Windows\SystemTemp\~DFF426842E794627C8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI93F9.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFFB64C3A8D69BADF7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF1F9DBF73BED44F8A.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD27307FDEBBB60C5.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D97BDB31-6D03-4CDB-AD5A-7062318C67C3} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2028 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname p2DyDlCr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain p2DyDlCr.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2876 msiexec.exe 2876 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2028 msiexec.exe Token: SeIncreaseQuotaPrivilege 2028 msiexec.exe Token: SeSecurityPrivilege 2876 msiexec.exe Token: SeCreateTokenPrivilege 2028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2028 msiexec.exe Token: SeLockMemoryPrivilege 2028 msiexec.exe Token: SeIncreaseQuotaPrivilege 2028 msiexec.exe Token: SeMachineAccountPrivilege 2028 msiexec.exe Token: SeTcbPrivilege 2028 msiexec.exe Token: SeSecurityPrivilege 2028 msiexec.exe Token: SeTakeOwnershipPrivilege 2028 msiexec.exe Token: SeLoadDriverPrivilege 2028 msiexec.exe Token: SeSystemProfilePrivilege 2028 msiexec.exe Token: SeSystemtimePrivilege 2028 msiexec.exe Token: SeProfSingleProcessPrivilege 2028 msiexec.exe Token: SeIncBasePriorityPrivilege 2028 msiexec.exe Token: SeCreatePagefilePrivilege 2028 msiexec.exe Token: SeCreatePermanentPrivilege 2028 msiexec.exe Token: SeBackupPrivilege 2028 msiexec.exe Token: SeRestorePrivilege 2028 msiexec.exe Token: SeShutdownPrivilege 2028 msiexec.exe Token: SeDebugPrivilege 2028 msiexec.exe Token: SeAuditPrivilege 2028 msiexec.exe Token: SeSystemEnvironmentPrivilege 2028 msiexec.exe Token: SeChangeNotifyPrivilege 2028 msiexec.exe Token: SeRemoteShutdownPrivilege 2028 msiexec.exe Token: SeUndockPrivilege 2028 msiexec.exe Token: SeSyncAgentPrivilege 2028 msiexec.exe Token: SeEnableDelegationPrivilege 2028 msiexec.exe Token: SeManageVolumePrivilege 2028 msiexec.exe Token: SeImpersonatePrivilege 2028 msiexec.exe Token: SeCreateGlobalPrivilege 2028 msiexec.exe Token: SeBackupPrivilege 4864 vssvc.exe Token: SeRestorePrivilege 4864 vssvc.exe Token: SeAuditPrivilege 4864 vssvc.exe Token: SeBackupPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2028 msiexec.exe 2028 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2028 msiexec.exe 2876 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2876 wrote to memory of 5228 2876 msiexec.exe 94 PID 2876 wrote to memory of 3620 2876 msiexec.exe 96 PID 3620 wrote to memory of 1588 3620 p2DyDlCr.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\167.148.201.191_sample.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2028
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5228
-
-
C:\Users\Admin\AppData\Local\UtProCA7\p2DyDlCr.exe"C:\Users\Admin\AppData\Local\UtProCA7\p2DyDlCr.exe" "C:\Users\Admin\AppData\Local\Temp\167.148.201.191_sample.msi" IRWpp7rS2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\UtProCA7\p2DyDlCr.exe"C:\Users\Admin\AppData\Local\UtProCA7\p2DyDlCr.exe" --go "C:\Users\Admin\AppData\Local\Temp\167.148.201.191_sample.msi" "IRWpp7rS"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e598e8b.rbs
- Size 8KB
- SHA256 13f2ad7656c84d0d33dce90a298c6a83fb838d699eb5cbe76ea6948d59e1b69f
- MD5 279d8eb17f97ebff7610aa845cddd340
- SHA1 d473e11d6a10beff1a7c281bc6d56c837d4f6907
- SHA512 34514efe736b852d220f250f5c1381e3ce81c2ca01ebe8d782c9f16f52149f012329d2a6894d2934416b883db78ed5cfb61bc0637474fd6ef7c87232bce923a0
- SSDEEP 96:lmcKWy4zXTpXT0XT1B9+ZUorNCS/CsTlTUorNCS/C6jeX/lRTlxIyc1maY9EZ9OP:ocKh4MKSohCnISohCnX303ocpiJ
- TLSH T140021F027114D6F6E8D05A35C707176833B6F2CBA722274B1A8DA4AC9E67B55AF0D0CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\UtProCA7\p2DyDlCr.exe
- Size 19KB
- SHA256 67c6f67ed61b56971d18fc5b7181d67f04caa9aaf539bce02b7c18fe065f9662
- MD5 1f4d87cd97088b66459c61922997d0c8
- SHA1 85eb0365151d763cc6a4bd9b2943f1e11b4bf3a5
- SHA512 1b0140f5753b5c96e68d623442da71ffd99344d4fc0f3e7e8326cd83d727a3e873372b97caf7f5eaa182d423acc196e23de6519437e3608ca38a0e8cd477760e
- SSDEEP 384:Ke8yBVHI1vhOkg6MNT5d8VNRXIkrd0outo874jWmwRWc:KwByvwkKNT5+VNRXIid0vG87bT
- TLSH T190921A0AA3E615FCC027D13481FA6B32E5F5F820456B571E1630C2353E34AB4AF76B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e598e8c.msi
- Size 2.0MB
- SHA256 25b25da412b5836143a4b06b8670be366a0b78629026543a8720f2676898d310
- MD5 45494ed58f019be9a44efefa95f9c816
- SHA1 c4a66bdafb202f4184b3c47d0528588516d0b337
- SHA512 858ec1de2f6a904bf6e52550fd427a56ae756c76c769a851091e9bc18a72c343bd7d270a5af8339558306335ffda80421ecda3425b8f8eea64c5d5840d27dadc
- SSDEEP 49152:YsTWI0oNlZyesa3vSOMluMqrqSzSS3InnnnTF:TTq4Q8vahqrvOS2
- TLSH T1F3956D236A50600646B598FABEBD5E37695F7409101AD94EFFD34B86F12EBF80802D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e1b769f3d9d80363c6881b33180f59f07c8fa237ff9c31dd037fe27dc9618217
- MD5 57da43dc12a87cc257aa59a8b4012f24
- SHA1 e5447dadcf0fc2cda7fb7dfb9e6731372baa179a
- SHA512 1b55975518a540be0c586df0ecf2ffda3c1b0b68ce49efe772c38598c9048d2d87a82be440d47d337d15fba33c8c5a4df298f8ee1e57ca7cb3d71aed3d72b740
- SSDEEP 24576:BFo3DMPhdoO/vvTL/igWWyFgPbuMdLxlULwEd7I+gDY65hX2cYBmWPMXyu4:1HA
- TLSH T1E257901436F92150E7F79E3CA8F0AA2349397D5B9C1ADE8D05411F4E0861FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f1b17a5b-bf45-42db-a0f9-95e0a2b02c83}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1e55c64d792602e1f1cf95b7b3342f8ec3742321f1c7a364cf2b678c12dd7677
- MD5 27ca456a33f514bbeb65e696d46f6364
- SHA1 294b3ba1a2a19d4380be188d872fd576e9ad6c64
- SHA512 e94b383d8540d9fe83e90ea3df795533d13486dbf8943756cfcc70213167c8ae26f3fc4baabeddf4095d9075c807982f2be57bc537c449477e0d5e5c946fae7a
- SSDEEP 96:FfIN+rvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:meb++uVm
- TLSH T18BD1991C5AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E6661A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH