Overview

overview

6

Static

static

1

wireguard-....1.msi

windows10-2004-x64

6

wireguard-....1.msi

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 06:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wireguard-amd64-1.1.1.msi
  • Size 3.1MB
  • Sample261023-hdphdazz7r
  • SHA256 7bfed60ad61b785c914b38b61555a975488e1d3ec472dbfb2fcdf498fca75242
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 42 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wireguard-amd64-1.1.1.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4940
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2640
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding F1E78D5F7A5BF5C641D28325CD60FE4B
        2⤵
        • Loads dropped DLL
        PID:4252
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 3CA1DEB9D1F22B59703AD34673F2624E E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:2536
      • C:\Program Files\WireGuard\wireguard.exe
        "C:\Program Files\WireGuard\wireguard.exe"
        2⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Program Files\WireGuard\wireguard.exe
          "C:\Program Files\WireGuard\wireguard.exe" /installmanagerservice
          3⤵
          • Executes dropped EXE
          PID:4768
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3576
    • C:\Program Files\WireGuard\wireguard.exe
      "C:\Program Files\WireGuard\wireguard.exe" /managerservice
      1⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Program Files\WireGuard\wireguard.exe
        "C:\Program Files\WireGuard\wireguard.exe" /ui 988 984 996 1004
        2⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2624

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59190d.rbs
          • Path C:\Config.Msi\e59190d.rbs
          • Size 8KB
          • SHA256 6d13ba18af5013b5476e6ff816dd5cab90f0eb8b0921403140c3e399cf618b8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59190f.rbs
          • Path C:\Config.Msi\e59190f.rbs
          • Size 417B
          • SHA256 3f159e874d38f327ece8b7bc1601628ecc06ffc3daf6a81237043cd6ef451057
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wireguard.exe
          • Path C:\Program Files\WireGuard\wireguard.exe
          • Size 8.9MB
          • SHA256 04c71fb1a555a6ace40d3ae9113c90c4829d7ca1d6c903fd20a8d41a0e2bef94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
          • Size 765B
          • SHA256 ef437cffc2bab6cc342d6cce0212fa30e55a54bd14ef3bcf6ec395bc63c72fcd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3AA0DCD5A74331FBD6F344550EC48B87_E08A58DF07B0C73A8FBB679D37942B4E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_E08A58DF07B0C73A8FBB679D37942B4E
          • Size 637B
          • SHA256 9bc0bc2972f47eb2ff65262dbaa662731d8a6ad0d7961095de924b0f8ce0dbf1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
          • Size 1KB
          • SHA256 e47bc4dc4e841694a92080d712e615b18b7da34ae698c575f7bbc5f4c9c8d556
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
          • Size 484B
          • SHA256 faa8020ac687b6c15d4584388271561e9308cc10eeaff1f1c2493869d4726048
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3AA0DCD5A74331FBD6F344550EC48B87_E08A58DF07B0C73A8FBB679D37942B4E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_E08A58DF07B0C73A8FBB679D37942B4E
          • Size 480B
          • SHA256 0dbb06e93c6b9abbc6ff2ddd1029f2059ab28f283b1801adeda7997d37f59896
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
          • Size 482B
          • SHA256 6702414cdd56382ac57b20462646e3963efadd9d00023fa2ecfca178c2557609
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI19D7.tmp
          • Path C:\Windows\Installer\MSI19D7.tmp
          • Size 35KB
          • SHA256 8dc9bb86f1a9ecfbc9e045ab4fa10d0adefc5387fa295f944396de7285e04837
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59190e.msi
          • Path C:\Windows\Installer\e59190e.msi
          • Size 3.1MB
          • SHA256 7bfed60ad61b785c914b38b61555a975488e1d3ec472dbfb2fcdf498fca75242
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 37112c8684238c8680a23d6100a854d137b3bb6b18120faefeb6c010fd43a4bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {f304e344-8a28-4e15-848c-6c2f5529bbd3}_OnDiskSnapshotProp
          • Path \??\Volume{8860bf69-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f304e344-8a28-4e15-848c-6c2f5529bbd3}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 e49b7fb44eee92a36e6c425edd3a5cb28e29125d75e60dbdd5d0e09b2f5d8ddf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download