Analysis
- max time kernel
148s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install.m.1.11.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
42 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.m.1.11.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target install.m.1.11.msi
- Size 5.9MB
- Sample261029-g15mfaxtfz
- SHA256 30189abe92d154f0bb28a6aeb2cb5fa7305b61a3c62f629910b1c2d7dc8b8ca0
- MD5 45c423ea093e053b201b6d00c745b29e
- SHA1 db579338bb581c7b12cc9fd128708882c28c128f
- SHA512 4c9db2a94a5148d32b0118efbdc531e88718b21ec1188814d28339bba6ab5dfa9b002f3ac120be2e5f1fbae8998d05f08635eb82da401821af0ed58061e139bd
- SSDEEP 98304:eDimI+59D+3alOGoFjkmuwmmTM2PI5VnNLMbIUK742I8GCGKgSBan1ZQsl8f:eDiGD+3VjkmbmmgLNJEXKjGKgSBa1ll0
- TLSH T15C563385BCC622B1D05BC3B5A241216D711A7FE47F724C12BBE97F8C9D33A1A097A394
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Af6EzS = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4500 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2864 MRtMzI.exe - Loads dropped DLL 2 IoCs
pid Process 1860 MsiExec.exe 2864 MRtMzI.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Af6EzS\\MRtMzI.exe\"" MRtMzI.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 17 1860 MsiExec.exe 19 1860 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 4 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 2312 cmd.exe 4176 cmd.exe 4244 cmd.exe 4140 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b MRtMzI.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{E22BF092-D100-59BA-9D5C-1546E9FB2186} msiexec.exe File opened for modification C:\Windows\Installer\MSICBC2.tmp msiexec.exe File created C:\Windows\Installer\e59c6e2.msi msiexec.exe File created C:\Windows\SystemTemp\~DF5C49543190AE6933.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF406FE49A6D9FDEC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB33895572BDFC71C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICC50.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFB5A7D2DE2A5A2AC8.TMP msiexec.exe File created C:\Windows\Installer\e59c6e0.msi msiexec.exe File opened for modification C:\Windows\Installer\e59c6e0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2632 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1444 cmd.exe 5664 cmd.exe 4632 cmd.exe 3924 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MRtMzI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MRtMzI.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fa6709e762e3d5140000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801fa6709e70000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101fa6709e7000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3fa6709e700000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6fa6709e700000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList\PackageName = "install.m.1.11.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\524A3EEE6419B8F78B6D7381898FDBC7\290FB22E001DAB95D9C551649EBF1268 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\ProductName = "WINBOM Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\524A3EEE6419B8F78B6D7381898FDBC7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\290FB22E001DAB95D9C551649EBF1268 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\290FB22E001DAB95D9C551649EBF1268\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\PackageCode = "3DEBFD3515D061A43B1A8410A5F2C847" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\290FB22E001DAB95D9C551649EBF1268\SourceList msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1708 schtasks.exe 5708 schtasks.exe 5456 schtasks.exe 5228 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5656 msiexec.exe 5656 msiexec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 1860 MsiExec.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe 2864 MRtMzI.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 5656 msiexec.exe Token: SeCreateTokenPrivilege 2632 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2632 msiexec.exe Token: SeLockMemoryPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeMachineAccountPrivilege 2632 msiexec.exe Token: SeTcbPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 2632 msiexec.exe Token: SeTakeOwnershipPrivilege 2632 msiexec.exe Token: SeLoadDriverPrivilege 2632 msiexec.exe Token: SeSystemProfilePrivilege 2632 msiexec.exe Token: SeSystemtimePrivilege 2632 msiexec.exe Token: SeProfSingleProcessPrivilege 2632 msiexec.exe Token: SeIncBasePriorityPrivilege 2632 msiexec.exe Token: SeCreatePagefilePrivilege 2632 msiexec.exe Token: SeCreatePermanentPrivilege 2632 msiexec.exe Token: SeBackupPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 2632 msiexec.exe Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeDebugPrivilege 2632 msiexec.exe Token: SeAuditPrivilege 2632 msiexec.exe Token: SeSystemEnvironmentPrivilege 2632 msiexec.exe Token: SeChangeNotifyPrivilege 2632 msiexec.exe Token: SeRemoteShutdownPrivilege 2632 msiexec.exe Token: SeUndockPrivilege 2632 msiexec.exe Token: SeSyncAgentPrivilege 2632 msiexec.exe Token: SeEnableDelegationPrivilege 2632 msiexec.exe Token: SeManageVolumePrivilege 2632 msiexec.exe Token: SeImpersonatePrivilege 2632 msiexec.exe Token: SeCreateGlobalPrivilege 2632 msiexec.exe Token: SeBackupPrivilege 4440 vssvc.exe Token: SeRestorePrivilege 4440 vssvc.exe Token: SeAuditPrivilege 4440 vssvc.exe Token: SeBackupPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeBackupPrivilege 4772 srtasks.exe Token: SeRestorePrivilege 4772 srtasks.exe Token: SeSecurityPrivilege 4772 srtasks.exe Token: SeTakeOwnershipPrivilege 4772 srtasks.exe Token: SeBackupPrivilege 4772 srtasks.exe Token: SeRestorePrivilege 4772 srtasks.exe Token: SeSecurityPrivilege 4772 srtasks.exe Token: SeTakeOwnershipPrivilege 4772 srtasks.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe Token: SeTakeOwnershipPrivilege 5656 msiexec.exe Token: SeRestorePrivilege 5656 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2632 msiexec.exe 2632 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2632 msiexec.exe 5656 msiexec.exe 1860 MsiExec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5656 wrote to memory of 4772 5656 msiexec.exe 94 PID 5656 wrote to memory of 1860 5656 msiexec.exe 96 PID 2864 wrote to memory of 4500 2864 MRtMzI.exe 99 PID 2864 wrote to memory of 4140 2864 MRtMzI.exe 101 PID 4140 wrote to memory of 1708 4140 cmd.exe 103 PID 4140 wrote to memory of 4868 4140 cmd.exe 106 PID 4140 wrote to memory of 1784 4140 cmd.exe 109 PID 2864 wrote to memory of 2312 2864 MRtMzI.exe 111 PID 2312 wrote to memory of 5708 2312 cmd.exe 113 PID 2312 wrote to memory of 1008 2312 cmd.exe 114 PID 2312 wrote to memory of 1704 2312 cmd.exe 116 PID 1444 wrote to memory of 4560 1444 cmd.exe 118 PID 5664 wrote to memory of 3400 5664 cmd.exe 119 PID 2864 wrote to memory of 4176 2864 MRtMzI.exe 120 PID 4176 wrote to memory of 5456 4176 cmd.exe 122 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.m.1.11.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2632
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F610B72EDCF0D6307CAC1FAB81F6082D E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
C:\Users\Public\Af6EzS\MRtMzI.exe"C:\Users\Public\Af6EzS\MRtMzI.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:4500
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Af6EzS\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Af6EzS\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1708
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4868
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5708
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1008
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5456
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4484
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:4244 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5228
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4112
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1968
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Af6EzS" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Af6EzS" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4560
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:2592
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3400
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:4632
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
PID:3924
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c6e1.rbs
- Size 7KB
- SHA256 66bc10601e8fc578fe4ba082f2693b1df3476d62a1a76dbcde29b64de88cb12a
- MD5 36ea917f58f1246a2d6b88859f54ac29
- SHA1 e270d596e89b9900098ec62dbc07a512e62a968b
- SHA512 d3f63045b295b749c0181a83746030fa13fdc3dd5385ed2bbb4933d303f83976556cd59a71b2598331809cf424c652d1316c522a426350934fd1002c0c008062
- SSDEEP 96:LA0SAMgu0CvhnhEUU7/1CsThqbU7/1C6j8mjhFh3WThqHHpgT5hNK+WhvhGhTQL9:LhCszzIIRzIHvpNj+KpaD
- TLSH T149F12F017E0185D2FEE6AB72D31B276537A2D3D95704138755CCC924AF8278C7BEA28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4yvptp2o.o1l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Af6EzS\MRtMzI.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Af6EzS\UxEnhance64.dll
- Size 3.1MB
- SHA256 76ef2172f10e2a67147c930f22870051f27d30ef6277253774c69adb47fb2456
- MD5 b8117cd89842c74afa30e9ace596bb82
- SHA1 a0a682b206e3be79910f5ad711e36308fe36de26
- SHA512 98925410f956eeb4a76b3dba309c50a74ffa0db0397e82c850c51892dde0a7cd83c7928163e00ab444dbe619407d999f1bf0a03143a63e132fc71c6bb24d7792
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+U:P9m29xx3Tiqt06ox6+z2rNNrKoU
- TLSH T1D0E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Af6EzS\adoresd.dat
- Size 4.8MB
- SHA256 d7c4df6a8f087678c6b2499c98f831f10fb6fa96da66e3e1ffda242a62f6f941
- MD5 86cf07f056ec9901dc8875489eb07ce9
- SHA1 295c885fd76e07407ed330741fbfaa662beafc2c
- SHA512 9c6738e2e7e76e0f3a70c87e4e8424f6122fc3e454978f362f302a583930b50708b9289999da6ea1502e55918edf4c59aaaa099c94db331ad4d8be2981c5df08
- SSDEEP 98304:eWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:eWj3WRdRQH5fimPGmNc7dBtYOc
- TLSH T1093633AF2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Af6EzS\msadox.tb
- Size 8KB
- SHA256 32eaaebe0a2f552975b5d1c16c9591be80ff2e8cd3f5e61d46668c6a5c1bb59b
- MD5 f53e6163bb3ad42a16deea489cf88a0c
- SHA1 af947a9e5dde34b25b655775ee9cf927f880cb6f
- SHA512 9d21eb38faf8fff9d6b345950d74845a939235dbac8d69ff1c5d33faa849c9b3aa9ae2f729a6419efc2643ccdf8a1a2cc78bae4a9e4f392d1ae915b226ea516a
- SSDEEP 192:VqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:VsZqZOXQ3uqvR2Kfzp
- TLSH T154029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICC50.tmp
- Size 5.9MB
- SHA256 8dc3f9862bbaaaf4745e0f198d156959e951072275ab675118f8cc904ae09a2f
- MD5 db48c31df74cf90f21f65618b4a180fe
- SHA1 e45c246f8f202e8585da89028edc3810bb8562be
- SHA512 9b37d54c76f9357daac8256b0cc4220ca48c74064cf91b89e284311cce0cdecf05ca14a8d524f756090226d86302e1da1b53497f4bb63c18cff95d2102f6d884
- SSDEEP 98304:EDimI+59D+3alOGoFjkmuwmmTM2PI5VnNLMbIUK742I8GWGKgSBan1ZQsl8d:EDiGD+3VjkmbmmgLNJEXKPGKgSBa1lly
- TLSH T1CB563385B8C622B0D05BC3B6A251212D71167FE57F720C12BFE97F9C9D33A0A197A394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c6e2.msi
- Size 5.9MB
- SHA256 30189abe92d154f0bb28a6aeb2cb5fa7305b61a3c62f629910b1c2d7dc8b8ca0
- MD5 45c423ea093e053b201b6d00c745b29e
- SHA1 db579338bb581c7b12cc9fd128708882c28c128f
- SHA512 4c9db2a94a5148d32b0118efbdc531e88718b21ec1188814d28339bba6ab5dfa9b002f3ac120be2e5f1fbae8998d05f08635eb82da401821af0ed58061e139bd
- SSDEEP 98304:eDimI+59D+3alOGoFjkmuwmmTM2PI5VnNLMbIUK742I8GCGKgSBan1ZQsl8f:eDiGD+3VjkmbmmgLNJEXKjGKgSBa1ll0
- TLSH T15C563385BCC622B1D05BC3B5A241216D711A7FE47F724C12BBE97F8C9D33A1A097A394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 67c826ad5646de273ebceb002037b7379ca71eabb9ad9a7816b1377c1a9236d7
- MD5 e9d4cb99e448472693a01786b46eb3e0
- SHA1 a9135b8ee43a3007128345a963ba4eddcb08c7fd
- SHA512 2420aabf997ad0a1de5b5e7e3c971755862234eb743089b56f5754055b7283b56eb76a1e977418e7d9c699cce75a93f0f85f4a9461479e412310a79aef7a235b
- SSDEEP 24576:4Fo3DMP0doO/vvTL/ig//ylAPL+1UrYc0CZNtSxHpKRa5oOvcYh2/mV+buL:tHc
- TLSH T1B857A32537F92210E7B79E3CACF0AA2349397D5B9C16DE8D45411B4E0821F71E8B2F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e70967fa-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0a1251ad-5186-4e8a-ace4-3d0abd0f8efd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8d70656f79cb7ee67fc2b2f17f447fa173ded7213580cc4dab6a7f9ccf4c784c
- MD5 bb2fa266c0fbba2374a4eb060ccd0d89
- SHA1 de8d0b087bfb76cb3a382eac4918b5eca34f897d
- SHA512 5e82289639affd09a7da635603ceeefb2123fa76faa0dc2ff0b625ba6ea78507640ea311d6f82ddd873c06f7909203bd0416596918c13874aaa836fe5b081c24
- SSDEEP 96:F3TfOivc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Jpb++uVmN
- TLSH T1DFD197185AE54711E2B3AB312CF18557A877B911FF33CB8E0198238E6631A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH