Analysis
- max time kernel
15s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 00:09
General
- Target 214a9a8e38096a5e.msi
- Size 2.8MB
- Sample261102-aftacayzbv
- SHA256 214a9a8e38096a5eaffc0c3fcf3e1166702c8eb223fa0877caa8e948d30601e6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\214a9a8e38096a5e.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\cmd.execmd.exe /c start "" /min /wait cmd.exe /c call "C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat" "C:\Users\Admin\AppData\Local\Temp\214a9a8e38096a5e.msi"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\cmd.execmd.exe /c call "C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat" "C:\Users\Admin\AppData\Local\Temp\214a9a8e38096a5e.msi"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w h -c "$q=[char]34; $d='public static class N {[System.Runtime.InteropServices.DllImport('+$q+'kernel32.dll'+$q+')]public static extern System.IntPtr GetConsoleWindow();[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern System.IntPtr GetAncestor(System.IntPtr h,uint g);[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern bool ShowWindow(System.IntPtr h,int n);}'; Add-Type -TypeDefinition $d; $c=[N]::GetConsoleWindow(); $r=[N]::GetAncestor($c,2); if($r -eq [IntPtr]::Zero){$r=$c}; [void][N]::ShowWindow($r,7)"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lkxbiedk\lkxbiedk.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDE5.tmp" "c:\Users\Admin\AppData\Local\Temp\lkxbiedk\CSCD6EC8F7C6DC14F018C248E65D5D9B56C.TMP"6⤵
-
-
-
-
C:\Windows\System32\wscript.exewscript //B //nologo "C:\Users\Admin\AppData\Local\Temp\b2515.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\kyd9gv4D\p7aaPw1f.bat');$i=$r.LastIndexOf('REM#');&([scriptblock]::Create($r.Substring($i+4)))"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
e59bc33.rbs
StartupProfileData-NonInteractive
RESCDE5.tmp
__PSScriptPolicyTest_oi5y2l0q.pkw.psm1
b2515.vbs
lkxbiedk.dll
p7aaPw1f.bat
e59bc34.msi
metadata-2
{d9b0f13d-8846-4f4d-a2da-8231de84eed4}_OnDiskSnapshotProp
CSCD6EC8F7C6DC14F018C248E65D5D9B56C.TMP
lkxbiedk.0.cs
lkxbiedk.cmdline
memory/2804-53-0x0000020ACA4D0000-0x0000020ACA54A000-memory.dmp
memory/2804-43-0x0000020AC9B90000-0x0000020AC9B92000-memory.dmp
memory/2804-41-0x0000000140000000-0x0000000140166000-memory.dmp
memory/2804-54-0x0000020ACA4D0000-0x0000020ACA54A000-memory.dmp
memory/2804-58-0x0000000140000000-0x0000000140166000-memory.dmp
memory/5992-9-0x00000219D1B80000-0x00000219D1BA2000-memory.dmp
memory/5992-24-0x00000219D1B70000-0x00000219D1B78000-memory.dmp