d1c8f24720c88bcad76be7b32d3adab418c289f13647df23c179023849683e3e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MeshaqLauncherSetup.msi
Size 85.7MB
Sample261026-wn9sysfw7x
SHA256 d1c8f24720c88bcad76be7b32d3adab418c289f13647df23c179023849683e3e
MD5 d3db971bf694e33ffc2032f8a69a2b0f
SHA1 a9827851186c1d310b3c14d9140d3448d19216ec
SHA512 d5ac35bf88aa81a1ee16284351931f397e206eb1ab95831e06ca600c27382b1177ceea73c49a1baca1974527dfe4e89c5467106a31024bac66d0af922baaffb4
SSDEEP 1572864:rEoo5q0VyDJaVsFG601dGSH2RbJXhqd+TAkHl5cCG87S90tKcJYCy:rER5qEAg7pH2BLlTAkHDVjS9sKcJYCy
TLSH
T1EC18333FBA898F3EC367BC754172589E45D11D8687AA6985E034FDB2429BCC390F42D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1948	MsiExec.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	1948	MsiExec.exe
24	1948	MsiExec.exe
26	1948	MsiExec.exe
28	1948	MsiExec.exe
30	1948	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
27	ip-api.com

Suspicious use of SetThreadContext 46 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101
PID 1948 set thread context of 4120	1948	MsiExec.exe	101

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{9BBB77E3-5475-45A9-8483-2C2A25281B64}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5904cb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI883.tmp	msiexec.exe
File created	C:\Windows\Installer\e5904c9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5904c9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4228	msiexec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4048	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7CB5CF891932F0A468589D7E7ED7BBEC\3E77BBB957459A544838C2A25282B146	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7CB5CF891932F0A468589D7E7ED7BBEC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E77BBB957459A544838C2A25282B146	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\ProductName = "Meshaq High Definition Audio Bridge"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\PackageCode = "BEAF3240C6E928A4DA6340EB9E7F8315"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Version = "16832781"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E77BBB957459A544838C2A25282B146\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\PackageName = "MeshaqLauncherSetup.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
744	msiexec.exe
744	msiexec.exe
1948	MsiExec.exe
1948	MsiExec.exe
1948	MsiExec.exe
1948	MsiExec.exe
4120	chrome.exe
4120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	744	msiexec.exe
Token: SeCreateTokenPrivilege	4228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4228	msiexec.exe
Token: SeLockMemoryPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeMachineAccountPrivilege	4228	msiexec.exe
Token: SeTcbPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeLoadDriverPrivilege	4228	msiexec.exe
Token: SeSystemProfilePrivilege	4228	msiexec.exe
Token: SeSystemtimePrivilege	4228	msiexec.exe
Token: SeProfSingleProcessPrivilege	4228	msiexec.exe
Token: SeIncBasePriorityPrivilege	4228	msiexec.exe
Token: SeCreatePagefilePrivilege	4228	msiexec.exe
Token: SeCreatePermanentPrivilege	4228	msiexec.exe
Token: SeBackupPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeDebugPrivilege	4228	msiexec.exe
Token: SeAuditPrivilege	4228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4228	msiexec.exe
Token: SeChangeNotifyPrivilege	4228	msiexec.exe
Token: SeRemoteShutdownPrivilege	4228	msiexec.exe
Token: SeUndockPrivilege	4228	msiexec.exe
Token: SeSyncAgentPrivilege	4228	msiexec.exe
Token: SeEnableDelegationPrivilege	4228	msiexec.exe
Token: SeManageVolumePrivilege	4228	msiexec.exe
Token: SeImpersonatePrivilege	4228	msiexec.exe
Token: SeCreateGlobalPrivilege	4228	msiexec.exe
Token: SeBackupPrivilege	2128	vssvc.exe
Token: SeRestorePrivilege	2128	vssvc.exe
Token: SeAuditPrivilege	2128	vssvc.exe
Token: SeBackupPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4228	msiexec.exe
4120	chrome.exe
4120	chrome.exe
4228	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1732	744	msiexec.exe	97
PID 744 wrote to memory of 1948	744	msiexec.exe	99
PID 1948 wrote to memory of 4120	1948	MsiExec.exe	101
PID 4120 wrote to memory of 4936	4120	chrome.exe	102
PID 4120 wrote to memory of 4480	4120	chrome.exe	103
PID 4120 wrote to memory of 4048	4120	chrome.exe	104
PID 4120 wrote to memory of 2288	4120	chrome.exe	105
PID 4120 wrote to memory of 2044	4120	chrome.exe	107
PID 4120 wrote to memory of 3328	4120	chrome.exe	108
PID 4120 wrote to memory of 540	4120	chrome.exe	110
PID 1948 wrote to memory of 4504	1948	MsiExec.exe	111
PID 1948 wrote to memory of 4504	1948	MsiExec.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MeshaqLauncherSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1732
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 14E89A8551E66E21107B780B96938AC0
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-gpu --disable-extensions --window-position=-32000,-32000
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x84,0x104,0x7fffb153c728,0x7fffb153c734,0x7fffb153c740
      4⤵
      PID:4936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,8358207787734067561,341333109094284087,262144 --field-trial-handle=1884,i,12400006479796166060,5152942095026057338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1880 /prefetch:2
      4⤵
      PID:4480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,9382598204421926846,18240178058281315433,524288 --field-trial-handle=1884,i,12400006479796166060,5152942095026057338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2100 /prefetch:3
      4⤵
      System Time Discovery
      PID:4048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,13805572760741068705,10905153992899975731,524288 --field-trial-handle=1884,i,12400006479796166060,5152942095026057338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,11644823402644453562,15685701734121630934,2097152 --field-trial-handle=1884,i,12400006479796166060,5152942095026057338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2920 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2928,i,836459454498522405,13950604351299665922,2097152 --field-trial-handle=1884,i,12400006479796166060,5152942095026057338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2900 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3784,i,16307904009979890449,5833139628463534875,2097152 --field-trial-handle=1884,i,12400006479796166060,5152942095026057338,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      PID:540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4504

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5904ca.rbs

Path C:\Config.Msi\e5904ca.rbs
Size 7KB
SHA256 f0b82732c7cdb97aac8fcf81e19aeddadba031fb53220ca20daa678e3849ec35
MD5 bf90baedf5d35db271e7a3556ef71c15
SHA1 aab0ed63b03949d775c18e3d2d1b993833953ba2
SHA512 08c6238381845b82c8c04556ad759862de82d89c61270accbed40db477ab1247cb3ceeb29eb1a6130fd7b68a8c734b211372a57f816404e05c69160c0fbd37cd
SSDEEP 96:6lSvueVQf96Ew4UoxgCCsThql94UoxgCC6jTHmF3s5ThqdHtlx5MhCWvGTKICRpX:6sueIwXouBIgXouB85gLUCu/RpX
TLSH
T1BFF10E01760592E3ECAE1774C70F5B553BB3E3AA5221134B44CDD470EF43399AEE46AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d104cfc-41f9-4951-83e7-50702fa9e7c3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0d104cfc-41f9-4951-83e7-50702fa9e7c3.tmp
Size 130KB
SHA256 9074576b2911f2dc6d063accf2d34a192e558703ca180d678f3d8d57f5d5d76a
MD5 032a91535e2187b1fbfc0edd2925aeca
SHA1 8a6ca442dbf60afcac75353eb4d68183a6db9c1b
SHA512 6adc2fe5b246972a02bf2c40dfb30cccd29aa9022bfdc5ce45998bbe515f1657aceeba7a33579231774c0fa1198a010e3ab26cacdc4f3ccb98c10afd6d0b9c36
SSDEEP 3072:B+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:B+hFD+7t56OD9ZfSApprU
TLSH
T170D31232AA91D87BC9FD6541B157A300DD666CED41DE3A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae545a19-de7b-4fef-a4d7-e6ff493b3aec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ae545a19-de7b-4fef-a4d7-e6ff493b3aec.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cef72334-8506-41fe-accd-79abc3aecf46.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cef72334-8506-41fe-accd-79abc3aecf46.tmp
Size 11KB
SHA256 df274fb2f305eb160b83d709cf88c0a509f2798d15278d9b906c1181550a2402
MD5 402e59a5dcede42a2d963f4f7f8627f3
SHA1 cf6bd85fb2028d37348ddb4ba4c9c8de91c91054
SHA512 7aa11d12cdc2580e452e32701d4a876014da431e6d18b595c569547b66e48b2170654427a374d7f6a8a69172f71f8bed534add631fadba2fb6f303f726a545b7
SSDEEP 192:GRMi/7Yv7TpAPRp2V9WHsb+WNnih0jn2+3akwZuVyIsnAUge:GRMizEvUX6Uw40T2+3awe
TLSH
T12142952DEE24B93B5CDBC21AF9627753E6F9102175942E88E6FC893C14E79CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebf3e59c-c381-43c4-9251-a1d0c679ac94.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ebf3e59c-c381-43c4-9251-a1d0c679ac94.tmp
Size 14KB
SHA256 070dd731ce036711426b3d49f5f5eaacf501a5e738207d32876e7c29eba3cd0f
MD5 c0b64b70b4d8de28fd1b805a97e63ee9
SHA1 956fbab931786bfd6c6348fa4351c3b287a72c15
SHA512 c1ad465997bee156cfe2daf92d1d7bbd0043c71a133bdafc305b3eb03e9651466b32d417bc668effbaf0adac3e026e1b07d6eae9629f7334fb9b57bda67f9f78
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5p7pLuLceSZkXOD/q+ErU3bSDrQa:TN/O7KxkXqKf/pUZNCgVLH2Hfgsvp7pS
TLSH
T18262E967BC489E3B0F94C588CC167B4FADF8028B61E9886496FB982503D5BCE11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1cafd0f-c029-4fe3-8fbf-b9beb2971e07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a1cafd0f-c029-4fe3-8fbf-b9beb2971e07.tmp
Size 131KB
SHA256 e6111fb22ca27006aeb2deb6e55238fb0a3a780fb88a9db306d74566acd51e11
MD5 5dc5aaf3e2d65ab9257635ca7d7e715c
SHA1 4c5b6757fc95fd6306d0510823ee2db6f019d7c1
SHA512 578a2fda46b27e9e344b5b13d373c2cd5bc60c8b6be3b6a783b7266e6ff1097a20868a044a597c742c6f12c058fe15cb5f21bbbf44f952ea0efcf097fd9af5d0
SSDEEP 3072:S+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:S+hFD+7t56OD9ZfSApprZ
TLSH
T117D31232A994D87B8DFD6541B247A300CE7668ED45DE7A09444A5F8EA0DFC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-815620575\Local State
Size 130KB
SHA256 a029cbdd63c10eb4a054ec9238095653996acff4ff042bcbe707c344bdc2b069
MD5 c3e0d85120f5fc35de43c080e32df1b7
SHA1 f55f59c2f1627a8db47ed8a3c7a2440361e1cbad
SHA512 ad9077b795dc4c02b76a4fbbbdab5e85504ac535b27e7bcc491b12338b6003893da7b38d450cb06a738101e5204a99545df928d59e8708d49b25bae8a1e4307c
SSDEEP 3072:W+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gb:W+hFD+7t56OD9ZfSApprb
TLSH
T181D31232AA91D87BC9FD6541B157A300DE766CED41EE2A09444A9F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI883.tmp

Path C:\Windows\Installer\MSI883.tmp
Size 17KB
SHA256 657925880b927cf675eeb64c3207a510799a084efdf523241fb436ab75c61db6
MD5 af50d3cdbc2557cc07f2934b0aa79b60
SHA1 7ff7464b383463eeaaf1e33fcab81272232631b8
SHA512 d6a560a33139e0e00768bac9f3b401685687ab1efd40243b3fe1ab11dbb9b18246bccb9c3e4fdd85ac1447e9c30c6630c74a9f21718674987e2e0a4540ce3941
SSDEEP 192:dVgxsrTgsgN587RYU/lC7aWO5sL6ZkYytDxzVMzg3bRZM6CR796f6XePgsCYn:daJwqNSurYy/Cltl9agi
TLSH
T1EF82F90FA38354F9C94681F891FF53B2F8B1B84399799B2A9370C2312D74664137DA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 94cd0db7d9193f6444ce5700ae75c86b896bc5403df921c7487a50add23f93ff
MD5 6d61e1eb08170fca88c82d63676de0f8
SHA1 2920a95d50cccfa3d343a78ce747f032264dc363
SHA512 c35d9fd0b1b9d6defd4f5bc1d73c9581471613f841f935dc3cdd1664aa86b564c19747c0a8eedcdb3f22dece6d4858061d85b92038ce8b1c763492296be57ea5
SSDEEP 24576:Bu8m+1zAdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:K
TLSH
T16547C52437F92240E7F79E3D6CF06A2389397D579C169E8D05421B4E0921BB1E8B2F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{56256718-fed9-4bd1-8628-4b90a928a393}_OnDiskSnapshotProp

Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{56256718-fed9-4bd1-8628-4b90a928a393}_OnDiskSnapshotProp
Size 6KB
SHA256 07eb8f90c4f2f43089c872cfb07e8891b842126e350bea3230bb9099ff43eaaf
MD5 4294410ee6c02edf1bf9ce50055c1fd6
SHA1 6b4bd0807b6021c8dd7bb8ee0835c5824eaa9dff
SHA512 6c659cffd37d172a869f2d8ea4e6ebfbaa00f6873318a2b0ae6373905ed35fe008bdd7566d1ce484a85cb2bf89fc4a50a1e6113b7259e9019513aa09e66541ed
SSDEEP 96:ForDc+vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:arhb++ZVm
TLSH
T120D199085AE54711E2F3AB7129F18557A837B911EF33CB8E0298638E2670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-49-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-67-0x00007FFFBF850000-0x00007FFFBF85C000-memory.dmp

Download

memory/1948-60-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-55-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-53-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-52-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-54-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-38-0x0000015623450000-0x00000156261C1000-memory.dmp

Download

memory/1948-164-0x0000015623450000-0x00000156261C1000-memory.dmp

Download