Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b63d78664c7e5302.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b63d78664c7e5302.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target b63d78664c7e5302.msi
- Size 2.9MB
- Sample261102-azz71adg83
- SHA256 b63d78664c7e53028f9d9e9d23c316a55a3980b32c4fb0181f82d34073e4a78a
- MD5 630bf52c11d8770aba43f5aa882fdb33
- SHA1 fffb9732e5d2e82a6ea618bf59b9f75e1082eeb1
- SHA512 e111db91382a0dda7a6f29b19c5d3052a39a4253e0cb7cbfb5eaa32efe1e3ec990f9b6ba73ba220b0ec7ca25b484c32fd9a843c8f1229af3d092194d46b4da8b
- SSDEEP 49152:5/Z1QQG9HYxnEh91tkZ/QJ0hnvFAtFnKaznrurannnU9k:5/7QF949EBtkZMcg3r9
- TLSH T1A8E52B636990204552B1A8FEAEBE5E7B784F340D1029958EFED31B86E51D6F84C03E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 24 5164 powershell.exe 26 5164 powershell.exe 28 5164 powershell.exe 30 5164 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5164 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 ipinfo.io 23 ipinfo.io - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e58da9e.msi msiexec.exe File created C:\Windows\Installer\e58da9c.msi msiexec.exe File opened for modification C:\Windows\Installer\e58da9c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4A3D6A0A-A554-44F8-ACBD-4E2501A0BF23} msiexec.exe File opened for modification C:\Windows\Installer\MSI9DA.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2764 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000069bf6088149b83f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000069bf60880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090069bf6088000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a69bf6088000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d69bf6088000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3556 msiexec.exe 3556 msiexec.exe 5164 powershell.exe 5164 powershell.exe 5164 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2764 msiexec.exe Token: SeIncreaseQuotaPrivilege 2764 msiexec.exe Token: SeSecurityPrivilege 3556 msiexec.exe Token: SeCreateTokenPrivilege 2764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2764 msiexec.exe Token: SeLockMemoryPrivilege 2764 msiexec.exe Token: SeIncreaseQuotaPrivilege 2764 msiexec.exe Token: SeMachineAccountPrivilege 2764 msiexec.exe Token: SeTcbPrivilege 2764 msiexec.exe Token: SeSecurityPrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeLoadDriverPrivilege 2764 msiexec.exe Token: SeSystemProfilePrivilege 2764 msiexec.exe Token: SeSystemtimePrivilege 2764 msiexec.exe Token: SeProfSingleProcessPrivilege 2764 msiexec.exe Token: SeIncBasePriorityPrivilege 2764 msiexec.exe Token: SeCreatePagefilePrivilege 2764 msiexec.exe Token: SeCreatePermanentPrivilege 2764 msiexec.exe Token: SeBackupPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeShutdownPrivilege 2764 msiexec.exe Token: SeDebugPrivilege 2764 msiexec.exe Token: SeAuditPrivilege 2764 msiexec.exe Token: SeSystemEnvironmentPrivilege 2764 msiexec.exe Token: SeChangeNotifyPrivilege 2764 msiexec.exe Token: SeRemoteShutdownPrivilege 2764 msiexec.exe Token: SeUndockPrivilege 2764 msiexec.exe Token: SeSyncAgentPrivilege 2764 msiexec.exe Token: SeEnableDelegationPrivilege 2764 msiexec.exe Token: SeManageVolumePrivilege 2764 msiexec.exe Token: SeImpersonatePrivilege 2764 msiexec.exe Token: SeCreateGlobalPrivilege 2764 msiexec.exe Token: SeBackupPrivilege 3648 vssvc.exe Token: SeRestorePrivilege 3648 vssvc.exe Token: SeAuditPrivilege 3648 vssvc.exe Token: SeBackupPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeBackupPrivilege 3368 srtasks.exe Token: SeRestorePrivilege 3368 srtasks.exe Token: SeSecurityPrivilege 3368 srtasks.exe Token: SeTakeOwnershipPrivilege 3368 srtasks.exe Token: SeBackupPrivilege 3368 srtasks.exe Token: SeRestorePrivilege 3368 srtasks.exe Token: SeSecurityPrivilege 3368 srtasks.exe Token: SeTakeOwnershipPrivilege 3368 srtasks.exe Token: SeDebugPrivilege 5164 powershell.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe Token: SeRestorePrivilege 3556 msiexec.exe Token: SeTakeOwnershipPrivilege 3556 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2764 msiexec.exe 2764 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3556 wrote to memory of 3368 3556 msiexec.exe 100 PID 3556 wrote to memory of 4512 3556 msiexec.exe 102 PID 4512 wrote to memory of 5164 4512 MsiExec.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b63d78664c7e5302.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2764
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0B5F39386282BEF269633DA68213C6572⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\b63d78664c7e5302.msi"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5164
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58da9d.rbs
- Size 8KB
- SHA256 7471d56e4271a962b3bad2e3b25c78957a3cdca9d948be649a367a5d603dac38
- MD5 cf8434328815c744687d21daa697a251
- SHA1 5de3cd8845b8f7d311c639b2613e79d561148032
- SHA512 4a72586bfac191b75c718cd170210e2600830cbec7e37b40505ec619202c1d572acfdb4b2c1ad1e493df3ab8df5f551349469d45690eb6553dcb1d4a7bc03610
- SSDEEP 96:kmUVXWvw9SPUDORnCsTlpUDORnC6jSHTp+TlB4kyMmytYhIl7SLCtbpXBSmoqv/p:h6+P8KRCIgKRCzE4kFDtbpAE
- TLSH T123021D01B66487E2D8681736D7034F1033B7E3C98351A24B989E9DB84F7B71DAE452EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
- Size 98KB
- SHA256 274314d567b18595ea34f098ec1198a027f9d580591b145c095854922c464b5b
- MD5 a4668f9d8ba4cb9ad5c2bd9a65793e90
- SHA1 7618fbb09d167de96a191b37c1f232ef998c9213
- SHA512 832d7448ea6707e6416d9c22a04a867278d41daf7655997ff67b7941342cf028c3f6d7ed1098e719196159f28a84993034be0d4f77a4bad5935d8c36e1996982
- SSDEEP 3072:V26IuHFgldDGjRvKwQs749KUZsPrv+m+8i:k2FLQsMH
- TLSH T1C2A3CD63017683D663F4127440780B0F5C9BFB252021ED3AF9E2A9DEB9294D5DCA7E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbgakusv.2kg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58da9e.msi
- Size 2.9MB
- SHA256 b63d78664c7e53028f9d9e9d23c316a55a3980b32c4fb0181f82d34073e4a78a
- MD5 630bf52c11d8770aba43f5aa882fdb33
- SHA1 fffb9732e5d2e82a6ea618bf59b9f75e1082eeb1
- SHA512 e111db91382a0dda7a6f29b19c5d3052a39a4253e0cb7cbfb5eaa32efe1e3ec990f9b6ba73ba220b0ec7ca25b484c32fd9a843c8f1229af3d092194d46b4da8b
- SSDEEP 49152:5/Z1QQG9HYxnEh91tkZ/QJ0hnvFAtFnKaznrurannnU9k:5/7QF949EBtkZMcg3r9
- TLSH T1A8E52B636990204552B1A8FEAEBE5E7B784F340D1029958EFED31B86E51D6F84C03E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 5e3dbe65c91151f28021292f939ef6564b099f3da0209bf2a4efdbdd84affbda
- MD5 c3d4111cc7c095c7f0fac40a34edbb80
- SHA1 8a01021255f65e8993a180274fa7b128e145cb9e
- SHA512 fb0129d4178d4f245d4acf748ffa5d993c78987f198fbfd6ed9fea0ae5171c2b7f8e88b089941f6c8b63d3a72db016f73b64c9d66b60c8c953768ca91776989c
- SSDEEP 24576:ru8m+1zpdoO/vvTLbW4+9GK8JREDAlIykeGdKXpVA0apOvxV4PlxwuzhN:p
- TLSH T18F47B52436FD2110E7F79F3CA8F06A23493A7D57AC159E8D45411B4E0922BB1E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{8860bf69-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{57031b4b-8ff0-4873-ba42-1724da9b9263}_OnDiskSnapshotProp
- Size 6KB
- SHA256 612f167f535f0b80179c2186afd1259763bd303a28406b2cd5eb1e3002660ffa
- MD5 1d9d8072db03da614b892fee1246a6c9
- SHA1 0e0d1bd532e0de76f7b52d0e14fc033fc8e40479
- SHA512 7cba27d4e56cdcdc99fcb5c921152aa09341bc505da74d94f7fab60f3926375d8cb4abc6f5c03509fe81e9fe61345f2183e8eb12448d1dae9f8320f7adff0f48
- SSDEEP 96:F8vRnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:a7b++ZVm
- TLSH T1F0D188085AE54311E2B3AB7228F18557A877B911FF33CB8E0298238E6670910F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH