Overview

overview

8

Static

static

3

9207d240580629f2.msi

windows10-2004-x64

8

9207d240580629f2.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 00:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9207d240580629f2.msi
  • Size 2.8MB
  • Sample261102-aft7msdf63
  • SHA256 9207d240580629f2296a8b602a143997fe3c67aa1f0c0842bad44c57aa827ff8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9207d240580629f2.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3556
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2268
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start "" /min /wait cmd.exe /c call "C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat" "C:\Users\Admin\AppData\Local\Temp\9207d240580629f2.msi"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\System32\cmd.exe
          cmd.exe /c call "C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat" "C:\Users\Admin\AppData\Local\Temp\9207d240580629f2.msi"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -nop -w h -c "$q=[char]34; $d='public static class N {[System.Runtime.InteropServices.DllImport('+$q+'kernel32.dll'+$q+')]public static extern System.IntPtr GetConsoleWindow();[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern System.IntPtr GetAncestor(System.IntPtr h,uint g);[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern bool ShowWindow(System.IntPtr h,int n);}'; Add-Type -TypeDefinition $d; $c=[N]::GetConsoleWindow(); $r=[N]::GetAncestor($c,2); if($r -eq [IntPtr]::Zero){$r=$c}; [void][N]::ShowWindow($r,7)"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\annsauuo\annsauuo.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4896
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFEA9.tmp" "c:\Users\Admin\AppData\Local\Temp\annsauuo\CSC206152CE59B14FA0826A40E48247D640.TMP"
                6⤵
                  PID:3036
            • C:\Windows\System32\wscript.exe
              wscript //B //nologo "C:\Users\Admin\AppData\Local\Temp\b28424.vbs"
              4⤵
              • Executes a VBScript file via the Windows Script Host.
              • Suspicious use of WriteProcessMemory
              PID:3320
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat');$i=$r.LastIndexOf('REM#');&([scriptblock]::Create($r.Substring($i+4)))"
                5⤵
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2680
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5856

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59f312.rbs
            • Path C:\Config.Msi\e59f312.rbs
            • Size 8KB
            • SHA256 a8b51324dc5520e28c9674c07bdb6a7aa4494f83181c882653a8bb4d39b6db00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 3b934c83c585bdbae7889ab44d0cfdc57b42ed8a2f276634c6ab2e016fe31bce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESFEA9.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESFEA9.tmp
            • Size 1KB
            • SHA256 9b5e959b847520dd7a73c1ac51b6662c33c7796bf53129f9d52069b793e48caf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_qqu13qpl.vfa.psm1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqu13qpl.vfa.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            annsauuo.dll
            • Path C:\Users\Admin\AppData\Local\Temp\annsauuo\annsauuo.dll
            • Size 3KB
            • SHA256 d3133b4781ab0b09eb3ae5769294a48105ffeb6434f7315a66a330a7893ff5a4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            b28424.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\b28424.vbs
            • Size 175B
            • SHA256 a37ecd480b44bf715fc30be4f744e50efe937e62817c15e3a9439417cf7e4dfe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            p7aaPw1f.bat
            • Path C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat
            • Size 40KB
            • SHA256 9bef8e8de4cbec5e35953b76d119468bc252f5a294087c1ded632677edab3ecd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59f313.msi
            • Path C:\Windows\Installer\e59f313.msi
            • Size 2.8MB
            • SHA256 9207d240580629f2296a8b602a143997fe3c67aa1f0c0842bad44c57aa827ff8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 47549e734351bacfbecf33a0f8a215a6796d0c62aa4b51755a487d08c8af9327
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {0f51b630-0f55-458d-a895-7aadd7ca1312}_OnDiskSnapshotProp
            • Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0f51b630-0f55-458d-a895-7aadd7ca1312}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 fafe4c22a0cf49ccf62385f382674e94812a970ed3ac83e9018340fcb0a2cb6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSC206152CE59B14FA0826A40E48247D640.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\annsauuo\CSC206152CE59B14FA0826A40E48247D640.TMP
            • Size 652B
            • SHA256 ee5ca9eef2afad5bb1e7e494fb658354155fd43c864176f53fa6d17d31e84976
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            annsauuo.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\annsauuo\annsauuo.0.cs
            • Size 382B
            • SHA256 42706b4746dc80e36b32b6c85865604af5d31b57467671860ef7722aef4e64c0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            annsauuo.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\annsauuo\annsauuo.cmdline
            • Size 369B
            • SHA256 9f5471fef63aacb5f9505ebb8a2a25a3d3fb1d0bb712b96ec41b72814a24c862
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1520-11-0x00000163E21A0000-0x00000163E21C2000-memory.dmp
            Download

            memory/1520-25-0x00000163CA070000-0x00000163CA078000-memory.dmp
            Download

            memory/2680-42-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/2680-54-0x00000200DF700000-0x00000200DF77A000-memory.dmp
            Download

            memory/2680-59-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/2680-44-0x00000200DEAA0000-0x00000200DEAA2000-memory.dmp
            Download

            memory/4848-60-0x000002352B100000-0x000002352BAA4000-memory.dmp
            Download

            memory/4896-23-0x000002E84D040000-0x000002E84D9E4000-memory.dmp
            Download