Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc103646d41c3585.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc103646d41c3585.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target dc103646d41c3585.msi
- Size 2.9MB
- Sample261102-az15ases4s
- SHA256 dc103646d41c35850ba55451810a40286b8a6bdcc39a164011855bc95ed42f01
- MD5 b65acd38486233fff9fa2cec416b4dbc
- SHA1 fdc8e7ab4fa4398c27295c3edd6e4e75ebe1e184
- SHA512 b6bae32668611da7ff53bded5695a0e5be9daec301c3250c50e9977eea861f7a471589ae996e1a0bd6e5c870f03fedf1db24ee82b409ec0a6eaa0833dbc27d58
- SSDEEP 49152:5/Z1QQG9HYxnEh91tkZ/QJ0hnvFAtFnKaznrurannnUEk:5/7QF949EBtkZMcg3rS
- TLSH T137E52B636990204552B1A8FEAEBE5E7B784F340D1029958EFED31B86E51D6F84C03E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 5048 powershell.exe 13 5048 powershell.exe 14 5048 powershell.exe 15 5048 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5048 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io 12 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFCD0697158AAC4075.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID8E2.tmp msiexec.exe File created C:\Windows\Installer\e5987d4.msi msiexec.exe File opened for modification C:\Windows\Installer\e5987d4.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{4A3D6A0A-A554-44F8-ACBD-4E2501A0BF23} msiexec.exe File created C:\Windows\SystemTemp\~DF20E30C4BEA15C22A.TMP msiexec.exe File created C:\Windows\Installer\e5987d6.msi msiexec.exe File created C:\Windows\SystemTemp\~DF24D6050ABB982277.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBD45508A9C9420C4.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4796 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000b9902af51b2dc4c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010b9902af0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010b9902af000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30b9902af00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60b9902af00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4952 msiexec.exe 4952 msiexec.exe 4952 msiexec.exe 5048 powershell.exe 5048 powershell.exe 5048 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4796 msiexec.exe Token: SeIncreaseQuotaPrivilege 4796 msiexec.exe Token: SeSecurityPrivilege 4952 msiexec.exe Token: SeCreateTokenPrivilege 4796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4796 msiexec.exe Token: SeLockMemoryPrivilege 4796 msiexec.exe Token: SeIncreaseQuotaPrivilege 4796 msiexec.exe Token: SeMachineAccountPrivilege 4796 msiexec.exe Token: SeTcbPrivilege 4796 msiexec.exe Token: SeSecurityPrivilege 4796 msiexec.exe Token: SeTakeOwnershipPrivilege 4796 msiexec.exe Token: SeLoadDriverPrivilege 4796 msiexec.exe Token: SeSystemProfilePrivilege 4796 msiexec.exe Token: SeSystemtimePrivilege 4796 msiexec.exe Token: SeProfSingleProcessPrivilege 4796 msiexec.exe Token: SeIncBasePriorityPrivilege 4796 msiexec.exe Token: SeCreatePagefilePrivilege 4796 msiexec.exe Token: SeCreatePermanentPrivilege 4796 msiexec.exe Token: SeBackupPrivilege 4796 msiexec.exe Token: SeRestorePrivilege 4796 msiexec.exe Token: SeShutdownPrivilege 4796 msiexec.exe Token: SeDebugPrivilege 4796 msiexec.exe Token: SeAuditPrivilege 4796 msiexec.exe Token: SeSystemEnvironmentPrivilege 4796 msiexec.exe Token: SeChangeNotifyPrivilege 4796 msiexec.exe Token: SeRemoteShutdownPrivilege 4796 msiexec.exe Token: SeUndockPrivilege 4796 msiexec.exe Token: SeSyncAgentPrivilege 4796 msiexec.exe Token: SeEnableDelegationPrivilege 4796 msiexec.exe Token: SeManageVolumePrivilege 4796 msiexec.exe Token: SeImpersonatePrivilege 4796 msiexec.exe Token: SeCreateGlobalPrivilege 4796 msiexec.exe Token: SeBackupPrivilege 5944 vssvc.exe Token: SeRestorePrivilege 5944 vssvc.exe Token: SeAuditPrivilege 5944 vssvc.exe Token: SeBackupPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeBackupPrivilege 5020 srtasks.exe Token: SeRestorePrivilege 5020 srtasks.exe Token: SeSecurityPrivilege 5020 srtasks.exe Token: SeTakeOwnershipPrivilege 5020 srtasks.exe Token: SeBackupPrivilege 5020 srtasks.exe Token: SeRestorePrivilege 5020 srtasks.exe Token: SeSecurityPrivilege 5020 srtasks.exe Token: SeTakeOwnershipPrivilege 5020 srtasks.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4796 msiexec.exe 4796 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4796 msiexec.exe 4952 msiexec.exe 5908 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4952 wrote to memory of 5020 4952 msiexec.exe 94 PID 4952 wrote to memory of 5908 4952 msiexec.exe 96 PID 5908 wrote to memory of 5048 5908 MsiExec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dc103646d41c3585.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4796
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 36D3AB8B7D4B1CE326D534D9CF8820322⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\dc103646d41c3585.msi"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5987d5.rbs
- Size 8KB
- SHA256 4d6d65b348f79021a9105b64dac573e217d11c5e6dd4a60f80abdf6b10f94fc4
- MD5 1bb279b4167ebe5ae684af890ac890ea
- SHA1 e9cee8b93db8fb3e6077bc63fab5359b8c5a22de
- SHA512 e1d92126b71fb0dcf01ec45649697f045f1dc0c869d624e02beaf444e56ab9f1222d0e18e20a81be016b298503bd52fa06d98f3ad576a15e67f924b51240ebe4
- SSDEEP 96:emiLzWm5V3PUDORnCsTlpUDORnC6jSH2++TlBJypmHtYQxCwp1Ctbp8BSNTYv0Rf:XsDL8KRCIgKRCz6JjwtbpJl
- TLSH T19B027300776482E2D4981335D7030B2033BAE3EA8355638B899E9DB94E6772DFE461DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
- Size 98KB
- SHA256 274314d567b18595ea34f098ec1198a027f9d580591b145c095854922c464b5b
- MD5 a4668f9d8ba4cb9ad5c2bd9a65793e90
- SHA1 7618fbb09d167de96a191b37c1f232ef998c9213
- SHA512 832d7448ea6707e6416d9c22a04a867278d41daf7655997ff67b7941342cf028c3f6d7ed1098e719196159f28a84993034be0d4f77a4bad5935d8c36e1996982
- SSDEEP 3072:V26IuHFgldDGjRvKwQs749KUZsPrv+m+8i:k2FLQsMH
- TLSH T1C2A3CD63017683D663F4127440780B0F5C9BFB252021ED3AF9E2A9DEB9294D5DCA7E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5987d6.msi
- Size 2.9MB
- SHA256 dc103646d41c35850ba55451810a40286b8a6bdcc39a164011855bc95ed42f01
- MD5 b65acd38486233fff9fa2cec416b4dbc
- SHA1 fdc8e7ab4fa4398c27295c3edd6e4e75ebe1e184
- SHA512 b6bae32668611da7ff53bded5695a0e5be9daec301c3250c50e9977eea861f7a471589ae996e1a0bd6e5c870f03fedf1db24ee82b409ec0a6eaa0833dbc27d58
- SSDEEP 49152:5/Z1QQG9HYxnEh91tkZ/QJ0hnvFAtFnKaznrurannnUEk:5/7QF949EBtkZMcg3rS
- TLSH T137E52B636990204552B1A8FEAEBE5E7B784F340D1029958EFED31B86E51D6F84C03E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 f33f30d5c567808c894688811782e41657e469d3610895e7743410b42df2e3da
- MD5 1ceb044ecbf4a221c5fbe692f1a4db12
- SHA1 56ff3df5fa5e1eeb90797ff4e0d1f46acb951faf
- SHA512 c1586fdaaa248434d2a02f71f8917ac069d3cd135d81e02a390c5ad88ed925b1d888d8020b4dcabacdda5530a9a69d7937651c971c6d18c8f10d6f76ee4b48bf
- SSDEEP 24576:eFo3DMPXdoO/vvTL/iQNtS1wv7u3WLqO0AbvtwTFbIDqZK8t8YxG9EXc5+1:AHQ
- TLSH T11857B22836F92250E7F79E3CA8F06A63493A7D5B9C15DE8D05411B4E0822F71E872F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{af02990b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{173a40c0-bbba-4eee-94ef-430a36eb8f19}_OnDiskSnapshotProp
- Size 6KB
- SHA256 3a2c580457b5ab33e1712da96ad24729e98c6fdce000d8a90604f84a190e5941
- MD5 c3013ee5b70a52eb3b148855f6c72536
- SHA1 88f44f6a06b8aed45490ff7006a875861e8222a4
- SHA512 0cd10680cd45aa0c73819da7e235c5e97e75f15fb086b49ee66c17e99421c6fdf8aa0b8939502709346bb38a22783b9af3a52bc9b90dc5273b925c56d1004878
- SSDEEP 96:FE0wwrvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:GSnb++uVm
- TLSH T110D189185AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E6630910F976F5B
- MD5 SHA1 SHA512 SSDEEP TLSH