Analysis
- max time kernel
148s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b48a4a99b619566d.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b48a4a99b619566d.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target b48a4a99b619566d.msi
- Size 2.9MB
- Sample261102-ataedses21
- SHA256 b48a4a99b619566ddb7b5ec0edcf36b798eac1eabb94deef70a0546254d478af
- MD5 12ad2fce5c5554c566ae553ebf2c75bc
- SHA1 58e9f02c540de81a80b213061e75098aab002dae
- SHA512 4d99b374973eb7c1809595c61db669d46548a5e474abd33f4d8a49f9a7562b4813ba2cea60f449830aeff1c0048aac0370fec51bab7e39a411d93659282f8bbf
- SSDEEP 24576:D4nnnnnnnkoVYOD2nOtBkA2yxR9P1ivgvXZ4NqWzbE/de/i1j30wLcwcl4UO:D4nnnnnnnkbODIOtBP79C54GilTLa4t
- TLSH T1B0E52AA369D0204552B1A8FEEEBA5E37295F380D201A998EFED35B46F51D5F84C02D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 1468 powershell.exe 13 1468 powershell.exe 14 1468 powershell.exe 15 1468 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1468 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io 12 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{64423996-6E5A-4EBB-A2C3-24198A91844F} msiexec.exe File opened for modification C:\Windows\Installer\MSI1195.tmp msiexec.exe File created C:\Windows\Installer\e59bd9b.msi msiexec.exe File created C:\Windows\SystemTemp\~DFAD0AFD2A52DFCB5B.TMP msiexec.exe File created C:\Windows\Installer\e59bd99.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF646578FE738445E7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF0BFB41EA2F3EFA40.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59bd99.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF64343C12FB58ED34.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4416 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0d977edac71670e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b0d977ed0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b0d977ed000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b0d977ed00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b0d977ed00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4464 msiexec.exe 4464 msiexec.exe 1468 powershell.exe 1468 powershell.exe 1468 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4416 msiexec.exe Token: SeIncreaseQuotaPrivilege 4416 msiexec.exe Token: SeSecurityPrivilege 4464 msiexec.exe Token: SeCreateTokenPrivilege 4416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4416 msiexec.exe Token: SeLockMemoryPrivilege 4416 msiexec.exe Token: SeIncreaseQuotaPrivilege 4416 msiexec.exe Token: SeMachineAccountPrivilege 4416 msiexec.exe Token: SeTcbPrivilege 4416 msiexec.exe Token: SeSecurityPrivilege 4416 msiexec.exe Token: SeTakeOwnershipPrivilege 4416 msiexec.exe Token: SeLoadDriverPrivilege 4416 msiexec.exe Token: SeSystemProfilePrivilege 4416 msiexec.exe Token: SeSystemtimePrivilege 4416 msiexec.exe Token: SeProfSingleProcessPrivilege 4416 msiexec.exe Token: SeIncBasePriorityPrivilege 4416 msiexec.exe Token: SeCreatePagefilePrivilege 4416 msiexec.exe Token: SeCreatePermanentPrivilege 4416 msiexec.exe Token: SeBackupPrivilege 4416 msiexec.exe Token: SeRestorePrivilege 4416 msiexec.exe Token: SeShutdownPrivilege 4416 msiexec.exe Token: SeDebugPrivilege 4416 msiexec.exe Token: SeAuditPrivilege 4416 msiexec.exe Token: SeSystemEnvironmentPrivilege 4416 msiexec.exe Token: SeChangeNotifyPrivilege 4416 msiexec.exe Token: SeRemoteShutdownPrivilege 4416 msiexec.exe Token: SeUndockPrivilege 4416 msiexec.exe Token: SeSyncAgentPrivilege 4416 msiexec.exe Token: SeEnableDelegationPrivilege 4416 msiexec.exe Token: SeManageVolumePrivilege 4416 msiexec.exe Token: SeImpersonatePrivilege 4416 msiexec.exe Token: SeCreateGlobalPrivilege 4416 msiexec.exe Token: SeBackupPrivilege 2988 vssvc.exe Token: SeRestorePrivilege 2988 vssvc.exe Token: SeAuditPrivilege 2988 vssvc.exe Token: SeBackupPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeBackupPrivilege 2784 srtasks.exe Token: SeRestorePrivilege 2784 srtasks.exe Token: SeSecurityPrivilege 2784 srtasks.exe Token: SeTakeOwnershipPrivilege 2784 srtasks.exe Token: SeBackupPrivilege 2784 srtasks.exe Token: SeRestorePrivilege 2784 srtasks.exe Token: SeSecurityPrivilege 2784 srtasks.exe Token: SeTakeOwnershipPrivilege 2784 srtasks.exe Token: SeDebugPrivilege 1468 powershell.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe Token: SeRestorePrivilege 4464 msiexec.exe Token: SeTakeOwnershipPrivilege 4464 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4416 msiexec.exe 4416 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4416 msiexec.exe 4464 msiexec.exe 2976 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4464 wrote to memory of 2784 4464 msiexec.exe 96 PID 4464 wrote to memory of 2976 4464 msiexec.exe 98 PID 2976 wrote to memory of 1468 2976 MsiExec.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b48a4a99b619566d.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4416
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B2FAF05D1C7097E4721F0795E1A28DDF2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\b48a4a99b619566d.msi"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59bd9a.rbs
- Size 8KB
- SHA256 0eb062c4edf72ac1e7a0f931b5dc3b21722ba4a2a083b7e5669e1db6b73d8327
- MD5 c6efdb78b03c8b40ec0756a4365776b1
- SHA1 4ca50145a3d420cf95254273b41981e5d6421830
- SHA512 fd5cb51c0974d28a21ca1f308564f35902e665ebb4d6f4c376db2cb92dca1e5246b3f79e028d160d4ed99643806ea3e949e7a0c5f8514041c0af90608475b641
- SSDEEP 192:cWveJy2ykuvw3IBvw3mGytyHLUQsy0+yjyMyo7X7XtUQpgiM7d7H7Q7P7m7P7R7w:cWv2y2yxvwkvwVytyoQsyLyjyMyo7X7L
- TLSH T1110214057354C195E4691736CA0747A233B7F3DBD2513B8F1CCF98289E43BAC9A6A1CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
- Size 69KB
- SHA256 cb75b645be14ad3db55b2860260afb5c993c1ce5d34a2de183b97790a5a9ad9d
- MD5 5fd6f8d52e45ce41c4cd3af499867356
- SHA1 50709af75f8b44bcd6bbd1e87de9fd73552b6b86
- SHA512 0090c8f817920104e0798e11a3e93aeaa3bfc5e0242cd81366911036f0d0cad57691e3cd06813df619ba6bf39e7aacbd3e4ac4649bc504aa652333b84bbdefa7
- SSDEEP 384:z+9qb27LvOviAOufn2saMO8eXszJHkSs/KkAw0Fs5RdZyW8ifx/kOkAfs/9gw78l:b4
- TLSH T15A6399E709DA05C800F17828849352D35B8E9C3E6FD756CE3743B7A6E414DF5ACA8D8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_izh5gynv.4mg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59bd9b.msi
- Size 2.9MB
- SHA256 b48a4a99b619566ddb7b5ec0edcf36b798eac1eabb94deef70a0546254d478af
- MD5 12ad2fce5c5554c566ae553ebf2c75bc
- SHA1 58e9f02c540de81a80b213061e75098aab002dae
- SHA512 4d99b374973eb7c1809595c61db669d46548a5e474abd33f4d8a49f9a7562b4813ba2cea60f449830aeff1c0048aac0370fec51bab7e39a411d93659282f8bbf
- SSDEEP 24576:D4nnnnnnnkoVYOD2nOtBkA2yxR9P1ivgvXZ4NqWzbE/de/i1j30wLcwcl4UO:D4nnnnnnnkbODIOtBP79C54GilTLa4t
- TLSH T1B0E52AA369D0204552B1A8FEEEBA5E37295F380D201A998EFED35B46F51D5F84C02D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 49b4802d54051d1f11efd10b9ee6f52d5ad922149008358049ee8c313f888000
- MD5 a7e7529d6373d60c860e921f5177b974
- SHA1 9103355f92502cb2d2a40da64cc275f40b3f1253
- SHA512 684407bebbeb287764a48c2c831330e6d9e93d7359d999320d5db850244c8347687915870f09b993420ea77f8050d35ba9d8870f9baf6e66750ef9919568028d
- SSDEEP 24576:kFo3DMPJdoO/vvTL/yg00C1Q/Le+/7zHEpiW9p6ciBa6ZzFk8YRWk9O1g+a:QH0
- TLSH T11C57B42536F92210E7F79F3CA8F06A2749397D5B9C19DE8D05411B8E0821F71E8B2F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ed77d9b0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d519c2e6-2144-4fbc-8a50-f61ff635b126}_OnDiskSnapshotProp
- Size 6KB
- SHA256 85ab76340463b5de8936c829cd5fbab37c091c9401882212e2782c1f73770d94
- MD5 e9ba25c28a30878aa9ec4f2d69837772
- SHA1 e602be28a29e20dbdd5c0c54efcc4e71b663cfc9
- SHA512 42e10719f18bc5ce0541ad46f8df2a5744b5b79b096e1ea56cd160dcc3a05c099c5377451e3b2e15b86361dfd82399792c33b90df00ad0ab70ecbff715029707
- SSDEEP 96:FYMI62aaR5vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:GMIImb++uVm
- TLSH T104D188185AF54711E2B3AB7129F18557A837B911FF33CB8E0198238E6630A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH