Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
WindowsDefender.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsDefender.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target WindowsDefender.msi
- Size 1016KB
- Sample261029-w1f2easv8m
- SHA256 fb6b0467ce17ed027f3e6eade7dc298b7ffece59c6f0150b57ada60259dde797
- MD5 94b2c2f4829a5d16bd7bc3efa7e27594
- SHA1 f8bae731bb1db5318138ecf5515ef8c8859abf93
- SHA512 1fe61ad69b43527edd7007d719ce0dd2e76d9ae8296a9f51541a84f9431e7f6e02c7a3612a61aef23504e2898176dfbc30d8a9a3f55c28d5f1b3e6a491093747
- SSDEEP 24576:8tSmlAmesDoaXIXGbOjF3QifCa1KiTZNSbbNZAsfKPokC:i4mJMo8gkBQifbZZNSbbNZAbgkC
- TLSH T170253305AE00C292ED89A7B468D342938F2BDED09DC655F27D1FB1693136AD095CBEF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5136 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59e0a2.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF9BBA63038EE4A0A0.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE6BC.tmp msiexec.exe File created C:\Windows\Installer\e59e0a4.msi msiexec.exe File created C:\Windows\SystemTemp\~DF55D64C79BC0FAA11.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBB47AFCD8D1B5CD7.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{5753BDDD-590D-4919-A1C1-4A3BCD087A1F} msiexec.exe File created C:\Windows\SystemTemp\~DFBA2E4398F34A4B4F.TMP msiexec.exe File created C:\Windows\Installer\e59e0a2.msi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2664 file_5.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5136 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname file_5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain file_5.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4388 msiexec.exe 4388 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5136 msiexec.exe Token: SeIncreaseQuotaPrivilege 5136 msiexec.exe Token: SeSecurityPrivilege 4388 msiexec.exe Token: SeCreateTokenPrivilege 5136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5136 msiexec.exe Token: SeLockMemoryPrivilege 5136 msiexec.exe Token: SeIncreaseQuotaPrivilege 5136 msiexec.exe Token: SeMachineAccountPrivilege 5136 msiexec.exe Token: SeTcbPrivilege 5136 msiexec.exe Token: SeSecurityPrivilege 5136 msiexec.exe Token: SeTakeOwnershipPrivilege 5136 msiexec.exe Token: SeLoadDriverPrivilege 5136 msiexec.exe Token: SeSystemProfilePrivilege 5136 msiexec.exe Token: SeSystemtimePrivilege 5136 msiexec.exe Token: SeProfSingleProcessPrivilege 5136 msiexec.exe Token: SeIncBasePriorityPrivilege 5136 msiexec.exe Token: SeCreatePagefilePrivilege 5136 msiexec.exe Token: SeCreatePermanentPrivilege 5136 msiexec.exe Token: SeBackupPrivilege 5136 msiexec.exe Token: SeRestorePrivilege 5136 msiexec.exe Token: SeShutdownPrivilege 5136 msiexec.exe Token: SeDebugPrivilege 5136 msiexec.exe Token: SeAuditPrivilege 5136 msiexec.exe Token: SeSystemEnvironmentPrivilege 5136 msiexec.exe Token: SeChangeNotifyPrivilege 5136 msiexec.exe Token: SeRemoteShutdownPrivilege 5136 msiexec.exe Token: SeUndockPrivilege 5136 msiexec.exe Token: SeSyncAgentPrivilege 5136 msiexec.exe Token: SeEnableDelegationPrivilege 5136 msiexec.exe Token: SeManageVolumePrivilege 5136 msiexec.exe Token: SeImpersonatePrivilege 5136 msiexec.exe Token: SeCreateGlobalPrivilege 5136 msiexec.exe Token: SeBackupPrivilege 5448 vssvc.exe Token: SeRestorePrivilege 5448 vssvc.exe Token: SeAuditPrivilege 5448 vssvc.exe Token: SeBackupPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5136 msiexec.exe 5136 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5136 msiexec.exe 4388 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4388 wrote to memory of 6012 4388 msiexec.exe 94 PID 4388 wrote to memory of 2664 4388 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WindowsDefender.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5136
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:6012
-
-
C:\Users\Admin\AppData\Local\App\file_5.exe"C:\Users\Admin\AppData\Local\App\file_5.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2664
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e0a3.rbs
- Size 8KB
- SHA256 c5e62ec96cc8b0454036cc3e5c06a99ad9ca8fe73ff9cd76789c20c4be79b5e6
- MD5 3122da573ed35879179f4c565991ec35
- SHA1 dda9c5930e415638275838ba894a48322104dc45
- SHA512 520be8493133608f753e3518d863b1a1a63a4717d4075c2df86a63a71ed3c7fee66596cda6969230030f23f2ff8b97d96a5a974293e51051f1dc1fc0007b9927
- SSDEEP 96:sq4XSUAtC5qDp1U7BvITCOThq0+U7BvITCgjPIvEMThq03HdtWpFyFV84gudC1pt:snEC5EOaOGzaOW2F41pOw/
- TLSH T12A021301769585D1F86D1737871B1B503FFBE3F987A5B39F048D90285E02A8FAA8E0D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\App\file_5.exe
- Size 2.8MB
- SHA256 e3711177a50d16f873a478bc3de05b078eb176af8a69c47d4c7f25a8360a69c5
- MD5 66467f48ba2683945566b86e5d10c334
- SHA1 d205d8003f5d3b84d75756640e5385d85abbfa59
- SHA512 04e659129ad60fec3296e7d28eda55812a560a962c66de557855c22e0c3d7731c9c1fc7ab2ee239d8b6733a2581d0008f49f36e85f2535a3e90d3e14d260df30
- SSDEEP 49152:epUaV313IwdBCa0KAXrlnXrIZ9aYRhnQXpYf8vqCU2vtAImrBznm+q:259wa0y2RuBq+q
- TLSH T12BD538617B5A99EDC19BC07483468672693270DB0F35BAFF44C486383E6AAF51F3C258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59e0a4.msi
- Size 1016KB
- SHA256 fb6b0467ce17ed027f3e6eade7dc298b7ffece59c6f0150b57ada60259dde797
- MD5 94b2c2f4829a5d16bd7bc3efa7e27594
- SHA1 f8bae731bb1db5318138ecf5515ef8c8859abf93
- SHA512 1fe61ad69b43527edd7007d719ce0dd2e76d9ae8296a9f51541a84f9431e7f6e02c7a3612a61aef23504e2898176dfbc30d8a9a3f55c28d5f1b3e6a491093747
- SSDEEP 24576:8tSmlAmesDoaXIXGbOjF3QifCa1KiTZNSbbNZAsfKPokC:i4mJMo8gkBQifbZZNSbbNZAbgkC
- TLSH T170253305AE00C292ED89A7B468D342938F2BDED09DC655F27D1FB1693136AD095CBEF0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 084e7a5eeaaebcfede31c552280d062f61581f246e5def2ace3f2b9dc47f3f68
- MD5 d979be3ba8fe8764cfcf74352094d755
- SHA1 c881f9a7b037ff40e6be5c44de7b31452a098599
- SHA512 1e674980fbb63b6446a45b88ca2906b6b4ac6bb2a40286ca7ed012cec81e71d7ed04dcc905d9583aa800fc0808e10e18fc5eb48f4d6994902de06fc9d4cda65c
- SSDEEP 24576:qFo3DMPBdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:mHo
- TLSH T17557B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5092f0c7-49df-4995-a671-a214d80da15c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d668b3aadc5110a99a86e7bf35fd61d59f6a8f9df5f4409311038f64c1cd5397
- MD5 d3ccabb0e93be75241eff6e8d71c68d4
- SHA1 24cf23f87c7a65cd89a46c1656e94d190d4820a2
- SHA512 988b9ab1db28e052d26e89c6e46c8cd52d701110cf452b31d843cb731febc9724f5ccf0eaf82ecfeff22da67f9d16a31216c6ba48640b3527be4e895ad46d48f
- SSDEEP 96:FL7WPcZGvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:l7WP/b++uVm
- TLSH T132D198085AF54711E2B3AB3128F18557A877B911EF33CB8E0198238F6630910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH