Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b48a4a99b619566d.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b48a4a99b619566d.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target b48a4a99b619566d.msi
- Size 2.9MB
- Sample261102-ataedses21
- SHA256 b48a4a99b619566ddb7b5ec0edcf36b798eac1eabb94deef70a0546254d478af
- MD5 12ad2fce5c5554c566ae553ebf2c75bc
- SHA1 58e9f02c540de81a80b213061e75098aab002dae
- SHA512 4d99b374973eb7c1809595c61db669d46548a5e474abd33f4d8a49f9a7562b4813ba2cea60f449830aeff1c0048aac0370fec51bab7e39a411d93659282f8bbf
- SSDEEP 24576:D4nnnnnnnkoVYOD2nOtBkA2yxR9P1ivgvXZ4NqWzbE/de/i1j30wLcwcl4UO:D4nnnnnnnkbODIOtBP79C54GilTLa4t
- TLSH T1B0E52AA369D0204552B1A8FEEEBA5E37295F380D201A998EFED35B46F51D5F84C02D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 23 2916 powershell.exe 25 2916 powershell.exe 27 2916 powershell.exe 29 2916 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2916 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ipinfo.io 23 ipinfo.io - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e592541.msi msiexec.exe File opened for modification C:\Windows\Installer\e592541.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{64423996-6E5A-4EBB-A2C3-24198A91844F} msiexec.exe File opened for modification C:\Windows\Installer\MSI5DE5.tmp msiexec.exe File created C:\Windows\Installer\e592543.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2872 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3712 msiexec.exe 3712 msiexec.exe 2916 powershell.exe 2916 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2872 msiexec.exe Token: SeIncreaseQuotaPrivilege 2872 msiexec.exe Token: SeSecurityPrivilege 3712 msiexec.exe Token: SeCreateTokenPrivilege 2872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2872 msiexec.exe Token: SeLockMemoryPrivilege 2872 msiexec.exe Token: SeIncreaseQuotaPrivilege 2872 msiexec.exe Token: SeMachineAccountPrivilege 2872 msiexec.exe Token: SeTcbPrivilege 2872 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeLoadDriverPrivilege 2872 msiexec.exe Token: SeSystemProfilePrivilege 2872 msiexec.exe Token: SeSystemtimePrivilege 2872 msiexec.exe Token: SeProfSingleProcessPrivilege 2872 msiexec.exe Token: SeIncBasePriorityPrivilege 2872 msiexec.exe Token: SeCreatePagefilePrivilege 2872 msiexec.exe Token: SeCreatePermanentPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeShutdownPrivilege 2872 msiexec.exe Token: SeDebugPrivilege 2872 msiexec.exe Token: SeAuditPrivilege 2872 msiexec.exe Token: SeSystemEnvironmentPrivilege 2872 msiexec.exe Token: SeChangeNotifyPrivilege 2872 msiexec.exe Token: SeRemoteShutdownPrivilege 2872 msiexec.exe Token: SeUndockPrivilege 2872 msiexec.exe Token: SeSyncAgentPrivilege 2872 msiexec.exe Token: SeEnableDelegationPrivilege 2872 msiexec.exe Token: SeManageVolumePrivilege 2872 msiexec.exe Token: SeImpersonatePrivilege 2872 msiexec.exe Token: SeCreateGlobalPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 2920 vssvc.exe Token: SeRestorePrivilege 2920 vssvc.exe Token: SeAuditPrivilege 2920 vssvc.exe Token: SeBackupPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeBackupPrivilege 3732 srtasks.exe Token: SeRestorePrivilege 3732 srtasks.exe Token: SeSecurityPrivilege 3732 srtasks.exe Token: SeTakeOwnershipPrivilege 3732 srtasks.exe Token: SeBackupPrivilege 3732 srtasks.exe Token: SeRestorePrivilege 3732 srtasks.exe Token: SeSecurityPrivilege 3732 srtasks.exe Token: SeTakeOwnershipPrivilege 3732 srtasks.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2872 msiexec.exe 2872 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3712 wrote to memory of 3732 3712 msiexec.exe 96 PID 3712 wrote to memory of 5072 3712 msiexec.exe 98 PID 5072 wrote to memory of 2916 5072 MsiExec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b48a4a99b619566d.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8DAAB599DCB287C197C3BE72C8A359C42⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\b48a4a99b619566d.msi"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592542.rbs
- Size 8KB
- SHA256 0ca85af40c5c59a3a35047d92889ffd80490bfe05197ba064cd094d61dc253bc
- MD5 5b4a9dbc8dc7e5ca37a21d2f4339ce10
- SHA1 21cc5e6713bcf4457f6a519edb3ee79074eb7072
- SHA512 86e8634316884a8ca1a9c8a09c7e4ba0f898d2b178307ffcd55fbeda976a48f40985ccd4b04aac8a109017a233b7794b5247d42db8b52899c847652b9d57c452
- SSDEEP 192:O3vD1ikuvw3IBvw3m52Hbvt01cP+TXtUQp5wP9UVMVDw:O3vJixvwkvw+27tEcP+TeLP9UVMVDw
- TLSH T1CF024305B344D2E1F4A51B32D6871BA633B7E3E8E6147B4B1CAF582C4E13748AF691C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
- Size 69KB
- SHA256 cb75b645be14ad3db55b2860260afb5c993c1ce5d34a2de183b97790a5a9ad9d
- MD5 5fd6f8d52e45ce41c4cd3af499867356
- SHA1 50709af75f8b44bcd6bbd1e87de9fd73552b6b86
- SHA512 0090c8f817920104e0798e11a3e93aeaa3bfc5e0242cd81366911036f0d0cad57691e3cd06813df619ba6bf39e7aacbd3e4ac4649bc504aa652333b84bbdefa7
- SSDEEP 384:z+9qb27LvOviAOufn2saMO8eXszJHkSs/KkAw0Fs5RdZyW8ifx/kOkAfs/9gw78l:b4
- TLSH T15A6399E709DA05C800F17828849352D35B8E9C3E6FD756CE3743B7A6E414DF5ACA8D8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjju215l.oys.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e592543.msi
- Size 2.9MB
- SHA256 b48a4a99b619566ddb7b5ec0edcf36b798eac1eabb94deef70a0546254d478af
- MD5 12ad2fce5c5554c566ae553ebf2c75bc
- SHA1 58e9f02c540de81a80b213061e75098aab002dae
- SHA512 4d99b374973eb7c1809595c61db669d46548a5e474abd33f4d8a49f9a7562b4813ba2cea60f449830aeff1c0048aac0370fec51bab7e39a411d93659282f8bbf
- SSDEEP 24576:D4nnnnnnnkoVYOD2nOtBkA2yxR9P1ivgvXZ4NqWzbE/de/i1j30wLcwcl4UO:D4nnnnnnnkbODIOtBP79C54GilTLa4t
- TLSH T1B0E52AA369D0204552B1A8FEEEBA5E37295F380D201A998EFED35B46F51D5F84C02D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 84c8b713758cc880ee34d0b2ed7934aa33aca1dd181e050399537ee413e52eeb
- MD5 6083f3ef453c499f0316e1defbf97c54
- SHA1 f9173c709ad3de13f8a65abbe45100cd8a939dd5
- SHA512 5313c1417e1ba154fdb832ec2c7f30d10eea927798d6f80635375d3904001b6842bb819b1be701c8be0ca270e634f62feb9db639330e47f8cc545d13a139452f
- SSDEEP 24576:gu8m+1zfdoO/vvTLr28epm649lUTE1MCQKGN+Ttl00aNOrFhIvVlk63xJ:s
- TLSH T15247902837F92200E7F79E3D68F06A234D3A7D5B9C199E8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4e847b64-088a-4c2d-bf3a-b2650c75237e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 cf27f8f58e3b0fb6841acdccc80d6ffe53da4c088e8c6c2589e8cce9b57026b8
- MD5 58e9e5e9235123e61e614fcf6850e8ec
- SHA1 282fb86ad5f4d5a9915fa91de3c4c0871be4f1c3
- SHA512 806dcda106bb8693686c3f71bcd293e6264007976266273cc997128f0e269788c1fb212c1c1d48f78bc1c89e58d219e372be17f1ad8cbf11fae0c2503da9adb4
- SSDEEP 96:FZp32aa6q0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:npz4ub++ZVm
- TLSH T1E0D189085AF54311E2B3AB7229F14557A877B911EF33CB8E0198638E2670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH