Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0820cba063a03360.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0820cba063a03360.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 0820cba063a03360.msi
- Size 10KB
- Sample261030-exldaaaw2j
- SHA256 0820cba063a03360ce5b53609874d7daaa01331ee623036a5d0c1720ac6e7e98
- MD5 dcf695c82b5d0fcebffa37df73400b06
- SHA1 b80016922955536b6303381e1d6f41626336f629
- SHA512 e535343da36432b72f2431809c36e8fd568c70045273b07e01128f551eac7b8d77f2506efe8510c7fdc59f50b41a9576353684eb8b5e8c5cf1b4cc6d20d38d51
- SSDEEP 96:5yWVNmdQhGAL/FCwQlM5WuCZ+bvL5EzvjZkiBLazSIpZJ8ncqrWeFKSd9EAX+o1Y:xSAz4wvQCvL5QjZkkmpfUsSwW0E8SA
- TLSH T12222E985B502CA32C1419F3146670B4957B92C409E8B16073BBCF39C5FBA1D07AA93E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5964 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59ac73.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF68C95A76E83F4DC6.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF276D4780C609FCA8.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF051A6F2F0C1ED231.TMP msiexec.exe File created C:\Windows\Installer\e59ac73.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4896 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 4896 msiexec.exe Token: SeIncreaseQuotaPrivilege 4896 msiexec.exe Token: SeSecurityPrivilege 3688 msiexec.exe Token: SeCreateTokenPrivilege 4896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4896 msiexec.exe Token: SeLockMemoryPrivilege 4896 msiexec.exe Token: SeIncreaseQuotaPrivilege 4896 msiexec.exe Token: SeMachineAccountPrivilege 4896 msiexec.exe Token: SeTcbPrivilege 4896 msiexec.exe Token: SeSecurityPrivilege 4896 msiexec.exe Token: SeTakeOwnershipPrivilege 4896 msiexec.exe Token: SeLoadDriverPrivilege 4896 msiexec.exe Token: SeSystemProfilePrivilege 4896 msiexec.exe Token: SeSystemtimePrivilege 4896 msiexec.exe Token: SeProfSingleProcessPrivilege 4896 msiexec.exe Token: SeIncBasePriorityPrivilege 4896 msiexec.exe Token: SeCreatePagefilePrivilege 4896 msiexec.exe Token: SeCreatePermanentPrivilege 4896 msiexec.exe Token: SeBackupPrivilege 4896 msiexec.exe Token: SeRestorePrivilege 4896 msiexec.exe Token: SeShutdownPrivilege 4896 msiexec.exe Token: SeDebugPrivilege 4896 msiexec.exe Token: SeAuditPrivilege 4896 msiexec.exe Token: SeSystemEnvironmentPrivilege 4896 msiexec.exe Token: SeChangeNotifyPrivilege 4896 msiexec.exe Token: SeRemoteShutdownPrivilege 4896 msiexec.exe Token: SeUndockPrivilege 4896 msiexec.exe Token: SeSyncAgentPrivilege 4896 msiexec.exe Token: SeEnableDelegationPrivilege 4896 msiexec.exe Token: SeManageVolumePrivilege 4896 msiexec.exe Token: SeImpersonatePrivilege 4896 msiexec.exe Token: SeCreateGlobalPrivilege 4896 msiexec.exe Token: SeBackupPrivilege 3376 vssvc.exe Token: SeRestorePrivilege 3376 vssvc.exe Token: SeAuditPrivilege 3376 vssvc.exe Token: SeBackupPrivilege 3688 msiexec.exe Token: SeRestorePrivilege 3688 msiexec.exe Token: SeRestorePrivilege 3688 msiexec.exe Token: SeTakeOwnershipPrivilege 3688 msiexec.exe Token: SeBackupPrivilege 4432 srtasks.exe Token: SeRestorePrivilege 4432 srtasks.exe Token: SeSecurityPrivilege 4432 srtasks.exe Token: SeTakeOwnershipPrivilege 4432 srtasks.exe Token: SeBackupPrivilege 4432 srtasks.exe Token: SeRestorePrivilege 4432 srtasks.exe Token: SeSecurityPrivilege 4432 srtasks.exe Token: SeTakeOwnershipPrivilege 4432 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4896 msiexec.exe 4896 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4896 msiexec.exe 3688 msiexec.exe 5964 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3688 wrote to memory of 4432 3688 msiexec.exe 94 PID 3688 wrote to memory of 5964 3688 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0820cba063a03360.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4896
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FAF51B8A7CC6F51A4644E3B9593CF5F02⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5964
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 799384e4e90b96c9621ad672ed27eb7cfeed5388dbd32308830cd50af051629c
- MD5 5104f68bf9513f9451f31c8a6ec7c6d6
- SHA1 1edf6d8e27bee4f71f6d57648da38b1088b8b586
- SHA512 5366a7cc2f3513cd155328698088aa6f334d902d82e9a583d1d916b4cb8816258cdf2df19d3550d611a879793ff21a76622146f6e3270f0df79b601b1cadfb1f
- SSDEEP 24576:lFo3DMPKdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:qHI
- TLSH T16257B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{64948e64-a69b-478b-b826-8083fdca7790}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0b4afe2c0893f84be7bdbecdfc2afa4e366371b9502431ab5dc720f19c483e39
- MD5 09258f092cb591b22905bd75d2564899
- SHA1 fbaa4b8e2bc7d12b05eee5996c7c6697010e28ad
- SHA512 9fd21f097de932e0c7b1195b3e84131a7dd66d297a370fae04e2c37c0ecaf9e88b5b139a88703d82e293522cdca974da78feab160cce3fce79d3d11241617c24
- SSDEEP 96:FlPhZfvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:nPrb++uVm
- TLSH T191D1871C5AE54711E2B3AB3128F18557A877B911EF33CB8E0198238E6670A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH