Analysis
- max time kernel
21s - max time network
37s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 11:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NetExtender-10.2.0.299.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
40 seconds
Behavioral task
behavioral2
Sample
NetExtender-10.2.0.299.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
40 seconds
General
- Target NetExtender-10.2.0.299.msi
- Size 13.6MB
- Sample261102-ndmaxabt9n
- SHA256 8c7966cc31ae959e7487548bb771a6dd99af42b134ab612bb09a428020eda35b
- MD5 514d88ce601d6727c6c0e8659f377629
- SHA1 7eacb42e65756fdf4bc5a86678ed6c42753a383d
- SHA512 7aa8887e63ee59bfbcceac1c63b8599af4493d3f4ff7560b4194f9c29b55cbd376c9e3a0552757f703ae133f7e2a856571dafa5fcc770e1ec009e95a3c95433c
- SSDEEP 196608:S5ubQO/AHSf7+IrfPK2LB7RbHhR3asX2xuU4JmAtDqNSJ5qRZzfx:0O/AH67nPJdVbBhW4Jm2DqNW5qT
- TLSH T1DBE6C0C57A584075C5FB8234A90BA62BF6FABC110B71C6DF52A8774D2F373D14A29322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3512 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5032 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5032 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000de3438a4f689b710000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010de3438a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010de3438a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30de3438a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60de3438a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5032 msiexec.exe Token: SeIncreaseQuotaPrivilege 5032 msiexec.exe Token: SeSecurityPrivilege 4676 msiexec.exe Token: SeCreateTokenPrivilege 5032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5032 msiexec.exe Token: SeLockMemoryPrivilege 5032 msiexec.exe Token: SeIncreaseQuotaPrivilege 5032 msiexec.exe Token: SeMachineAccountPrivilege 5032 msiexec.exe Token: SeTcbPrivilege 5032 msiexec.exe Token: SeSecurityPrivilege 5032 msiexec.exe Token: SeTakeOwnershipPrivilege 5032 msiexec.exe Token: SeLoadDriverPrivilege 5032 msiexec.exe Token: SeSystemProfilePrivilege 5032 msiexec.exe Token: SeSystemtimePrivilege 5032 msiexec.exe Token: SeProfSingleProcessPrivilege 5032 msiexec.exe Token: SeIncBasePriorityPrivilege 5032 msiexec.exe Token: SeCreatePagefilePrivilege 5032 msiexec.exe Token: SeCreatePermanentPrivilege 5032 msiexec.exe Token: SeBackupPrivilege 5032 msiexec.exe Token: SeRestorePrivilege 5032 msiexec.exe Token: SeShutdownPrivilege 5032 msiexec.exe Token: SeDebugPrivilege 5032 msiexec.exe Token: SeAuditPrivilege 5032 msiexec.exe Token: SeSystemEnvironmentPrivilege 5032 msiexec.exe Token: SeChangeNotifyPrivilege 5032 msiexec.exe Token: SeRemoteShutdownPrivilege 5032 msiexec.exe Token: SeUndockPrivilege 5032 msiexec.exe Token: SeSyncAgentPrivilege 5032 msiexec.exe Token: SeEnableDelegationPrivilege 5032 msiexec.exe Token: SeManageVolumePrivilege 5032 msiexec.exe Token: SeImpersonatePrivilege 5032 msiexec.exe Token: SeCreateGlobalPrivilege 5032 msiexec.exe Token: SeCreateTokenPrivilege 5032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5032 msiexec.exe Token: SeLockMemoryPrivilege 5032 msiexec.exe Token: SeIncreaseQuotaPrivilege 5032 msiexec.exe Token: SeMachineAccountPrivilege 5032 msiexec.exe Token: SeTcbPrivilege 5032 msiexec.exe Token: SeSecurityPrivilege 5032 msiexec.exe Token: SeTakeOwnershipPrivilege 5032 msiexec.exe Token: SeLoadDriverPrivilege 5032 msiexec.exe Token: SeSystemProfilePrivilege 5032 msiexec.exe Token: SeSystemtimePrivilege 5032 msiexec.exe Token: SeProfSingleProcessPrivilege 5032 msiexec.exe Token: SeIncBasePriorityPrivilege 5032 msiexec.exe Token: SeCreatePagefilePrivilege 5032 msiexec.exe Token: SeCreatePermanentPrivilege 5032 msiexec.exe Token: SeBackupPrivilege 5032 msiexec.exe Token: SeRestorePrivilege 5032 msiexec.exe Token: SeShutdownPrivilege 5032 msiexec.exe Token: SeDebugPrivilege 5032 msiexec.exe Token: SeAuditPrivilege 5032 msiexec.exe Token: SeSystemEnvironmentPrivilege 5032 msiexec.exe Token: SeChangeNotifyPrivilege 5032 msiexec.exe Token: SeRemoteShutdownPrivilege 5032 msiexec.exe Token: SeUndockPrivilege 5032 msiexec.exe Token: SeSyncAgentPrivilege 5032 msiexec.exe Token: SeEnableDelegationPrivilege 5032 msiexec.exe Token: SeManageVolumePrivilege 5032 msiexec.exe Token: SeImpersonatePrivilege 5032 msiexec.exe Token: SeCreateGlobalPrivilege 5032 msiexec.exe Token: SeCreateTokenPrivilege 5032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5032 msiexec.exe Token: SeLockMemoryPrivilege 5032 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5032 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5032 msiexec.exe 4676 msiexec.exe 3512 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4676 wrote to memory of 3512 4676 msiexec.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NetExtender-10.2.0.299.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5032
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 5CC928717AB3EDF07DDAE28EB94CD2C6 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3512
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4164
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 203826E68ECC30618E78723D7B9E99ED2⤵PID:4844
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding BC58445564CB0EEB7ECFB4297BD640252⤵PID:4972
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 929D79539D314902BC8B07EC6E756B18 E Global\MSI00002⤵PID:5632
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B66688BCD6A46D2230C75A98A692540 E Global\MSI00002⤵PID:2384
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e596597.rbs
- Size 1.1MB
- SHA256 ecf522827bc13f118eed28c7991559b698aa31037455cd608aa281818d8b5030
- MD5 616ee79dc6d8bb63e73b986882614962
- SHA1 899793a1c23f85fe2fe530071b8b7505707deb43
- SHA512 12a2218c2d6d998152d933d16cf449da9f9523c0fefc85450a4d0b965fc3b51242e3f7292c8f4400adae04d6a482b02237bffff8532afa96949803ad06809346
- SSDEEP 24576:OmpY0C1Sl3wgdFFqWZmsKy49bHXnxLUF53mpY0C1Sl3wgdFFqWZmsKy49bHXnxLF:6Sl3wgdFFqWZmsKy4lXKNSl3wgdFFqWm
- TLSH T1A0359D217641C036D5AE01715929E73A18ADB9700FB019CBF7E85E7E9FF06D22B32A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI45B.tmp
- Size 4.9MB
- SHA256 fe97371c683d1e9670d50616d48fe2010426ee96376a1149f94e6c3780ef1aec
- MD5 9e49cd063617e0c314923f4de1acf123
- SHA1 28baf2d7e8660c014783e540177c0d2f593aa3c3
- SHA512 c6d0b4dcbb4bccea881303a81712adcb24beae586ffc61f03b871b0dac1280a83d9503de5a0995fb221be79be26ebb4c383545ee8b1fa14e9191b0f5acb02a9d
- SSDEEP 49152:U97s7QxVoYQ+BUmEYUbcPO/F8k1oX4xY1QCv2k7kC8yCNdTBuMe8kdPKxDmvYOrI:ofQJm/4xnokDrdINSJnayJ5qRgKzYxh
- TLSH T1B0368E4AA6BC41A5E577D23CC603464BE7F1BC051A72D74F01A9739E6F3B3618A1E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6CCB.tmp
- Size 543KB
- SHA256 72216601ac308ff0f7d704667ea45f449cf44d3e5d69e7767120727066577fa1
- MD5 d02525f29042c87ce412e705c3d0df7f
- SHA1 a266e18a5c5029156d15b017424c15494c40b4b5
- SHA512 8336d02fc1942e818e334b1ecc769032c1ef4d5f3dc48b6bab23f94de2370f7d812bf289935cfb0b32e64ca72bd829c4f76451a87243b4dae46f1531f62334da
- SSDEEP 12288:Wm2qYYnC1N9Sl3wgdFFqWZmsAP1rdFGj49w5B6XuAdXnxLUF5tBDj:WmpY0C1Sl3wgdFFqWZmsKy49bHXnxLUL
- TLSH T18CC49D217641C036D5AE01715929E73A18ADB9700FB019CBF7E85E7E9FF06D22B32A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 9a16d3c11c575398949fc1f834438a67480ad875e729ab43d85fe6c2596528f8
- MD5 121e5e71c9797c7350616e54a5637703
- SHA1 0a9a57cd4448324e58bd53f1c870308c4bce808b
- SHA512 f405d3410e1ab434f0bae4b14d1172ae72c49a9d61a6e6c54acd6a24738b228238adeaf720b1ab1fa63b3b5f42f618dc4e05d7187377fabebbb6f061b1b66d5e
- SSDEEP 24576:KFo3DMPfdoO/vvTL/SQuOCVAPbeEl7pd0josdzQ2YLAaJZP+sohm+nEf6OA:4HA
- TLSH T1B457C32436F92210E7F79E3DA8F06A27893A7D5B9C15DE8D05411B4E0822F71E872F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cb0145e9-7b4d-4aea-aca6-c7adf00a2f3a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8c717fe3b1ae007f612352391f7b8e519cee9c8416b93d015fb832a569e96f1a
- MD5 f3b8f37b03b636bd1ee00e70447b7da2
- SHA1 b54e37d6d36ffa29d7b50affe8c5b09f6c57c22b
- SHA512 dcff5e02b2755cda1b6643447044da910740e264211c3a36a36525c4ff58d1dfd85df55ed7a4fcf86a6af3f2af4944475a945cffc89948cdd7c5cc1e87419db6
- SSDEEP 96:FntLqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:lUb++uVmN
- TLSH T128D189185AF54711E2B3AB312DF18557A877B811EF33CB8E0198238E2631910F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH