d1c8f24720c88bcad76be7b32d3adab418c289f13647df23c179023849683e3e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MeshaqLauncherSetup.msi
Size 85.7MB
Sample261026-wn9sysfw7x
SHA256 d1c8f24720c88bcad76be7b32d3adab418c289f13647df23c179023849683e3e
MD5 d3db971bf694e33ffc2032f8a69a2b0f
SHA1 a9827851186c1d310b3c14d9140d3448d19216ec
SHA512 d5ac35bf88aa81a1ee16284351931f397e206eb1ab95831e06ca600c27382b1177ceea73c49a1baca1974527dfe4e89c5467106a31024bac66d0af922baaffb4
SSDEEP 1572864:rEoo5q0VyDJaVsFG601dGSH2RbJXhqd+TAkHl5cCG87S90tKcJYCy:rER5qEAg7pH2BLlTAkHDVjS9sKcJYCy
TLSH
T1EC18333FBA898F3EC367BC754172589E45D11D8687AA6985E034FDB2429BCC390F42D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1744	MsiExec.exe

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	1744	MsiExec.exe
13	1744	MsiExec.exe
14	1744	MsiExec.exe
15	1744	MsiExec.exe
16	1744	MsiExec.exe
17	1744	MsiExec.exe
18	1744	MsiExec.exe
19	1744	MsiExec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	api.gofile.io
1	api.gofile.io

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98
PID 1744 set thread context of 5852	1744	MsiExec.exe	98

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59c867.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c867.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3A0B44DD1EE24935.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID48C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID604.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF27209319C95BFE8.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC0D605FB5C2D87BE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9BBB77E3-5475-45A9-8483-2C2A25281B64}	msiexec.exe
File created	C:\Windows\Installer\e59c869.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB0CAAF755E3F8237.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5228	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsiExec.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E77BBB957459A544838C2A25282B146\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\ProductName = "Meshaq High Definition Audio Bridge"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\PackageCode = "BEAF3240C6E928A4DA6340EB9E7F8315"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\Version = "16832781"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\PackageName = "MeshaqLauncherSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7CB5CF891932F0A468589D7E7ED7BBEC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7CB5CF891932F0A468589D7E7ED7BBEC\3E77BBB957459A544838C2A25282B146	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E77BBB957459A544838C2A25282B146\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E77BBB957459A544838C2A25282B146	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4192	msiexec.exe
4192	msiexec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5228	msiexec.exe
Token: SeSecurityPrivilege	4192	msiexec.exe
Token: SeCreateTokenPrivilege	5228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5228	msiexec.exe
Token: SeLockMemoryPrivilege	5228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5228	msiexec.exe
Token: SeMachineAccountPrivilege	5228	msiexec.exe
Token: SeTcbPrivilege	5228	msiexec.exe
Token: SeSecurityPrivilege	5228	msiexec.exe
Token: SeTakeOwnershipPrivilege	5228	msiexec.exe
Token: SeLoadDriverPrivilege	5228	msiexec.exe
Token: SeSystemProfilePrivilege	5228	msiexec.exe
Token: SeSystemtimePrivilege	5228	msiexec.exe
Token: SeProfSingleProcessPrivilege	5228	msiexec.exe
Token: SeIncBasePriorityPrivilege	5228	msiexec.exe
Token: SeCreatePagefilePrivilege	5228	msiexec.exe
Token: SeCreatePermanentPrivilege	5228	msiexec.exe
Token: SeBackupPrivilege	5228	msiexec.exe
Token: SeRestorePrivilege	5228	msiexec.exe
Token: SeShutdownPrivilege	5228	msiexec.exe
Token: SeDebugPrivilege	5228	msiexec.exe
Token: SeAuditPrivilege	5228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5228	msiexec.exe
Token: SeChangeNotifyPrivilege	5228	msiexec.exe
Token: SeRemoteShutdownPrivilege	5228	msiexec.exe
Token: SeUndockPrivilege	5228	msiexec.exe
Token: SeSyncAgentPrivilege	5228	msiexec.exe
Token: SeEnableDelegationPrivilege	5228	msiexec.exe
Token: SeManageVolumePrivilege	5228	msiexec.exe
Token: SeImpersonatePrivilege	5228	msiexec.exe
Token: SeCreateGlobalPrivilege	5228	msiexec.exe
Token: SeBackupPrivilege	120	vssvc.exe
Token: SeRestorePrivilege	120	vssvc.exe
Token: SeAuditPrivilege	120	vssvc.exe
Token: SeBackupPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5228	msiexec.exe
5228	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5228	msiexec.exe
4192	msiexec.exe
1744	MsiExec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2796	4192	msiexec.exe	94
PID 4192 wrote to memory of 1744	4192	msiexec.exe	96
PID 1744 wrote to memory of 5852	1744	MsiExec.exe	98
PID 5852 wrote to memory of 1876	5852	chrome.exe	99
PID 1744 wrote to memory of 2828	1744	MsiExec.exe	100
PID 1744 wrote to memory of 2828	1744	MsiExec.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MeshaqLauncherSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2796
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 47508DFA4818B1C351DE939D41EE6D97
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-gpu --disable-extensions --window-position=-32000,-32000
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbfc10c728,0x7ffbfc10c734,0x7ffbfc10c740
      4⤵
      PID:1876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c868.rbs

Path C:\Config.Msi\e59c868.rbs
Size 7KB
SHA256 b08b5e6dba1f942b101d03c67948cf9288d6f174117748cf53c696f9643f40a0
MD5 42b3bb212893f70ee7468ec0ceba5ea5
SHA1 2d989203396d0a6da9753f3a2dca5ea35cf360e0
SHA512 84fdf54fffe589fa55ca84ac06c9e8fdae298491ed438e22167a116568da1ec52864a7d81e6d258d23ef81c0dff8566090bba6f4e6e9f641c75ebe6713d96735
SSDEEP 96:1gcvXCnnEw4UoxgCCsThql94UoxgCC6jTHmF3s5ThqdHtlx5MhCWvGTKICRpljTp:15XCEwXouBIgXouB85gLUCu/RpX
TLSH
T17FF10E01760596E3ECAE1734C70F5B553FB3E3AA5221134B44CD9070EF43399AEE46AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-2412456182\Local State
Size 4KB
SHA256 d614f3f99e0be2c6aee3092a4917c5d958c2f7cd6c0b7164a7d3a2fe677f4765
MD5 5fcd17a67bbee0275cb6531d723f3374
SHA1 f841dbd12b1c2df78f94a6b080e1fef967149371
SHA512 4fee6a07246ca83cb1bbfc999875ebc857c4166828d3cdd9a9211ccd66072f8dd55875fe5b749f87053c7c5fbec0e76970aa81c554caa448d5e976a6ac083fc2
SSDEEP 96:CC6sd+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Ap0cDyB6vGyvtBWL0cD3bOV4a:CCnoWqNVVxi+9oP8DUDe0KSDeW4cD3bC
TLSH
T103A11931B879997789F6D484B1123E538F7830ABA522DFD8E8EE5A1C21F349C0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-2723537952\download
Size 224KB
SHA256 1ba935b83104faba63785781dd06f1fb405f5f6c205dd557a94f50a87e9a6b0d
MD5 cc0b01b6e40c08b0732d098947ad2dc7
SHA1 1dd6b8b636d6f6592ebb8f74496271b507609de8
SHA512 4ed4e560bf01dcf12b20c264851b941bcabf443db80f139e5ec4fe45d73798e8e3a64961f9209e861b2f4fb7c8b6976a1618f4076d14929cea3b48a2def94187
SSDEEP 96:bnjFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:b2H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T10624EF4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-3082419717\Local State
Size 39KB
SHA256 6ec53c369e9a54beb4b193d42c341c261c98674a2c92e639b5327d66da7faf8e
MD5 737cd244ec48aa90140d19c0fa3cd84e
SHA1 a98225ad627b8fc8989719140adcd0beb75781e8
SHA512 ea84bedfa73a4d7dcc83a7356cc29f8ca8b2ad816e2e8afba9d560567b5287a4cb0df37d62046f78507c183eb99656bc155ecdb9a418a50a6c4b4a145c00583f
SSDEEP 768:U/UxvxjgC+B3GaO2gm1KESDmGA5b65Q92RQMPb5FzY:BZj3+B3XHyAF65dQOFzY
TLSH
T14B03CF36EC94AE779CF56280374BB35AAFF94463C1C856A049ED7E1D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-shm

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-3222040976\download-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

download

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-593056774\download
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

password_account

Path C:\Users\Admin\AppData\Local\Temp\ms-wrc-593056774\password_account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID604.tmp

Path C:\Windows\Installer\MSID604.tmp
Size 17KB
SHA256 657925880b927cf675eeb64c3207a510799a084efdf523241fb436ab75c61db6
MD5 af50d3cdbc2557cc07f2934b0aa79b60
SHA1 7ff7464b383463eeaaf1e33fcab81272232631b8
SHA512 d6a560a33139e0e00768bac9f3b401685687ab1efd40243b3fe1ab11dbb9b18246bccb9c3e4fdd85ac1447e9c30c6630c74a9f21718674987e2e0a4540ce3941
SSDEEP 192:dVgxsrTgsgN587RYU/lC7aWO5sL6ZkYytDxzVMzg3bRZM6CR796f6XePgsCYn:daJwqNSurYy/Cltl9agi
TLSH
T1EF82F90FA38354F9C94681F891FF53B2F8B1B84399799B2A9370C2312D74664137DA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d5e4c3c2c9809564929b34a91eade7cbbe026fd78b1cbe46de00cee680e4a52c
MD5 300e2572ceb1d2bff6a9736840754f86
SHA1 f74b4f7a3f48c68caf99bd4d2f2758cc850953b9
SHA512 00ddd23f4128cb2ff79b8531eedb3b8321f56978b001f2192cb21cbb320a1b577b4529d690691e3cee490565ec9810c1a582b9a347b41f8acac18e40386f88f1
SSDEEP 24576:MFo3DMP/doO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:SHI
TLSH
T18A57B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2e112388-b343-4b37-8736-29c6004c7463}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2e112388-b343-4b37-8736-29c6004c7463}_OnDiskSnapshotProp
Size 6KB
SHA256 78f9ef1380a19ebf9e9a5a9adade173fed9a30007d1e53cf808b231b8942ef5b
MD5 9af87b8cd7ad5c4fa1cd4e89dcafb197
SHA1 3f75ddc4221c524e10e533194d96e6d5ec49d684
SHA512 7d4cbce22717edc4b9bc10ceee22ca0389babfd630957aa3e47810f944fc19b3d02575b7c770dd64df710b8785c15f9317c288ec93a80932ee3e5aa2458653af
SSDEEP 96:FhPQDZpevc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:fPQzSb++uVm
TLSH
T17ED188185AF54711E2F3AB3128F18557A877B951EF33CB8E0198238E6670A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1744-48-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-73-0x00007FFC0CFF0000-0x00007FFC0CFFC000-memory.dmp

Download

memory/1744-58-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-53-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-52-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-51-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-47-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-36-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download

memory/1744-155-0x00000168DE400000-0x00000168E1171000-memory.dmp

Download