Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b63d78664c7e5302.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b63d78664c7e5302.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target b63d78664c7e5302.msi
- Size 2.9MB
- Sample261102-azz71adg83
- SHA256 b63d78664c7e53028f9d9e9d23c316a55a3980b32c4fb0181f82d34073e4a78a
- MD5 630bf52c11d8770aba43f5aa882fdb33
- SHA1 fffb9732e5d2e82a6ea618bf59b9f75e1082eeb1
- SHA512 e111db91382a0dda7a6f29b19c5d3052a39a4253e0cb7cbfb5eaa32efe1e3ec990f9b6ba73ba220b0ec7ca25b484c32fd9a843c8f1229af3d092194d46b4da8b
- SSDEEP 49152:5/Z1QQG9HYxnEh91tkZ/QJ0hnvFAtFnKaznrurannnU9k:5/7QF949EBtkZMcg3r9
- TLSH T1A8E52B636990204552B1A8FEAEBE5E7B784F340D1029958EFED31B86E51D6F84C03E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 3300 powershell.exe 13 3300 powershell.exe 14 3300 powershell.exe 15 3300 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3300 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io 12 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e590bae.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4A3D6A0A-A554-44F8-ACBD-4E2501A0BF23} msiexec.exe File created C:\Windows\SystemTemp\~DF78B1D34A25BD984B.TMP msiexec.exe File created C:\Windows\Installer\e590bb0.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCD2B355A6341B4A2.TMP msiexec.exe File opened for modification C:\Windows\Installer\e590bae.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF4FE5ACEB24861AAE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6548.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF13D61A12BEBE6758.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2816 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072eafa9cea60e45e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380172eafa9c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410172eafa9c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e372eafa9c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e672eafa9c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3456 msiexec.exe 3456 msiexec.exe 3300 powershell.exe 3300 powershell.exe 3300 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2816 msiexec.exe Token: SeIncreaseQuotaPrivilege 2816 msiexec.exe Token: SeSecurityPrivilege 3456 msiexec.exe Token: SeCreateTokenPrivilege 2816 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2816 msiexec.exe Token: SeLockMemoryPrivilege 2816 msiexec.exe Token: SeIncreaseQuotaPrivilege 2816 msiexec.exe Token: SeMachineAccountPrivilege 2816 msiexec.exe Token: SeTcbPrivilege 2816 msiexec.exe Token: SeSecurityPrivilege 2816 msiexec.exe Token: SeTakeOwnershipPrivilege 2816 msiexec.exe Token: SeLoadDriverPrivilege 2816 msiexec.exe Token: SeSystemProfilePrivilege 2816 msiexec.exe Token: SeSystemtimePrivilege 2816 msiexec.exe Token: SeProfSingleProcessPrivilege 2816 msiexec.exe Token: SeIncBasePriorityPrivilege 2816 msiexec.exe Token: SeCreatePagefilePrivilege 2816 msiexec.exe Token: SeCreatePermanentPrivilege 2816 msiexec.exe Token: SeBackupPrivilege 2816 msiexec.exe Token: SeRestorePrivilege 2816 msiexec.exe Token: SeShutdownPrivilege 2816 msiexec.exe Token: SeDebugPrivilege 2816 msiexec.exe Token: SeAuditPrivilege 2816 msiexec.exe Token: SeSystemEnvironmentPrivilege 2816 msiexec.exe Token: SeChangeNotifyPrivilege 2816 msiexec.exe Token: SeRemoteShutdownPrivilege 2816 msiexec.exe Token: SeUndockPrivilege 2816 msiexec.exe Token: SeSyncAgentPrivilege 2816 msiexec.exe Token: SeEnableDelegationPrivilege 2816 msiexec.exe Token: SeManageVolumePrivilege 2816 msiexec.exe Token: SeImpersonatePrivilege 2816 msiexec.exe Token: SeCreateGlobalPrivilege 2816 msiexec.exe Token: SeBackupPrivilege 4440 vssvc.exe Token: SeRestorePrivilege 4440 vssvc.exe Token: SeAuditPrivilege 4440 vssvc.exe Token: SeBackupPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeBackupPrivilege 5092 srtasks.exe Token: SeRestorePrivilege 5092 srtasks.exe Token: SeSecurityPrivilege 5092 srtasks.exe Token: SeTakeOwnershipPrivilege 5092 srtasks.exe Token: SeBackupPrivilege 5092 srtasks.exe Token: SeRestorePrivilege 5092 srtasks.exe Token: SeSecurityPrivilege 5092 srtasks.exe Token: SeTakeOwnershipPrivilege 5092 srtasks.exe Token: SeDebugPrivilege 3300 powershell.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2816 msiexec.exe 2816 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2816 msiexec.exe 3456 msiexec.exe 2560 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3456 wrote to memory of 5092 3456 msiexec.exe 96 PID 3456 wrote to memory of 2560 3456 msiexec.exe 98 PID 2560 wrote to memory of 3300 2560 MsiExec.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b63d78664c7e5302.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2816
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DEC2FD10C88CE057B3D1037BAF985E1C2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\b63d78664c7e5302.msi"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4440
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e590baf.rbs
- Size 8KB
- SHA256 bd4a1fa3b6a847eea9259c407530e185096420f3252a3c618bfb812ee8b962eb
- MD5 97fc81ff1f7b9d9128a224f21335d584
- SHA1 606a2dcf613605b344377da749b37bfe88da7efa
- SHA512 a205340c4636b10ce1414cb11b88dd677dbf8a67b49c0621114c12d3cb483ec93add4f0f1e859d8d8c3692187f37a33c9089497963ec67c5523c864a3aa7101d
- SSDEEP 96:cm/LzWm7sLPUDORnCsTlpUDORnC6jSpcC+TlBJyTIztKeHeGTLCtbpCBSXZrvm39:5TDK8KRCIgKRCzaJzMtbpD2
- TLSH T17A020000726087D3D8A51732D2132F6037B6E3D9C392A34B589E99B81F2777EAE445DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
- Size 98KB
- SHA256 274314d567b18595ea34f098ec1198a027f9d580591b145c095854922c464b5b
- MD5 a4668f9d8ba4cb9ad5c2bd9a65793e90
- SHA1 7618fbb09d167de96a191b37c1f232ef998c9213
- SHA512 832d7448ea6707e6416d9c22a04a867278d41daf7655997ff67b7941342cf028c3f6d7ed1098e719196159f28a84993034be0d4f77a4bad5935d8c36e1996982
- SSDEEP 3072:V26IuHFgldDGjRvKwQs749KUZsPrv+m+8i:k2FLQsMH
- TLSH T1C2A3CD63017683D663F4127440780B0F5C9BFB252021ED3AF9E2A9DEB9294D5DCA7E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e590bb0.msi
- Size 2.9MB
- SHA256 b63d78664c7e53028f9d9e9d23c316a55a3980b32c4fb0181f82d34073e4a78a
- MD5 630bf52c11d8770aba43f5aa882fdb33
- SHA1 fffb9732e5d2e82a6ea618bf59b9f75e1082eeb1
- SHA512 e111db91382a0dda7a6f29b19c5d3052a39a4253e0cb7cbfb5eaa32efe1e3ec990f9b6ba73ba220b0ec7ca25b484c32fd9a843c8f1229af3d092194d46b4da8b
- SSDEEP 49152:5/Z1QQG9HYxnEh91tkZ/QJ0hnvFAtFnKaznrurannnU9k:5/7QF949EBtkZMcg3r9
- TLSH T1A8E52B636990204552B1A8FEAEBE5E7B784F340D1029958EFED31B86E51D6F84C03E1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 88d4047141f2af3461b56d7974c173f0169efe1a9736ac10096c317e807f6d5f
- MD5 83c4671d926be40c61b7b3c30ea47475
- SHA1 b163dadeba7bfc2a7a2932699958291a6c15861b
- SHA512 b0ad3e52c09e3234e2aa094139a3d1abe459ddd1b7bb4e7162becf7cf85d27805b037876f55155211bd6b7011634282eb32c7c9b0ad75e0cbdc1fa101afdbbbc
- SSDEEP 24576:+Fo3DMPPdoO/vvTL/ywuOC1Avb+EFbp90DIM9zw24LA6JZP+MohGenkfauM:YHM
- TLSH T1B757E22436F92210E7F79E3CA8F06A234D3A7D5B9C15DE8D45851B4E0822F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{9cfaea72-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{65d3fbe7-3d03-461d-a275-e11c9f43792b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 769380580ab5ffd230250deb86bc537d1a64b65441d6a215bd041b6cacb5f29f
- MD5 7473df5fff8a619bf8ad5b5a3273d263
- SHA1 5760a7c6b47d81445c77dcb28a814a0177396965
- SHA512 af1771c48a2c21fd3703d03b80df8c755d6dfdb5392d6c39e01398965b111f12193986e905f8320c8e277947f915c926b274994376b9efc1d09f61e8c14f41a3
- SSDEEP 96:FJO0laKvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:rO7Gb++uVm
- TLSH T18DD1981C1AF54311E2B3AB3229F18557A877B911EF33CB8E0198638E6670910F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH