Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi
- Size 26.9MB
- Sample261102-vbc3sabw2w
- SHA256 28101588832b45d2f3feb29a7831f10a6199aed0a0311314e206e087ebf3b397
- MD5 e2a39cb484f71d0fea860f141896440b
- SHA1 0b4501409f255c64de09f1f74e76c3b356734804
- SHA512 4a5b356e32c8f90910fa32d8d2ca515031b5d06a6dd0ef756c38d6f8422fe81ee47dc6f454b14fa3241d45b9c5cd857861972c29103fcedfa47afbb1ef229a15
- SSDEEP 786432:PnmaEWR8+f+cDroWACnSjHXh1LL5YKe/64xJc:PWn+f+gfArX3LiPE
- TLSH T1BE5733177C848938C5578F7196F58B094B877C242B605D6B323CB75AEAF36F82A385E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 264 MsiExec.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 3084 icacls.exe 5560 icacls.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\GoNavi\.gonavi-msi-install msiexec.exe File created C:\Program Files\GoNavi\GoNavi.exe msiexec.exe File created C:\Program Files\GoNavi\LICENSE.txt msiexec.exe File created C:\Program Files\GoNavi\NOTICE.txt msiexec.exe File created C:\Program Files\GoNavi\apply-brand-icon.ps1 msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{4F0473E8-1378-438D-9A33-9768FEE67F26}\GoNaviIcon msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_dzx4qmub.nr1.psm1 powershell.exe File created C:\Windows\SystemTemp\~DFE3E6D1D4B864A32E.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{4F0473E8-1378-438D-9A33-9768FEE67F26} msiexec.exe File created C:\Windows\SystemTemp\~DF28353B835956667E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5884D5DC411ADFA6.TMP msiexec.exe File created C:\Windows\Installer\e5a01f5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF1820FAF9D2FAC93F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI773.tmp msiexec.exe File created C:\Windows\Installer\e5a01f7.msi msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_mmis2w3v.rf1.ps1 powershell.exe File opened for modification C:\Windows\Installer\e5a01f5.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{4F0473E8-1378-438D-9A33-9768FEE67F26}\GoNaviIcon msiexec.exe -
pid Process 244 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4156 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 44 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E3740F48731D834A9337986EF6EF762 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\ProductName = "GoNavi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\PackageName = "GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F2FB6DDCE1DE54340ABACDBDE751BF32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E3740F48731D834A9337986EF6EF762\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\PackageCode = "5D00E993240403E4C868667E4301D722" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Version = "4278190140" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\ProductIcon = "C:\\Windows\\Installer\\{4F0473E8-1378-438D-9A33-9768FEE67F26}\\GoNaviIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F2FB6DDCE1DE54340ABACDBDE751BF32\8E3740F48731D834A9337986EF6EF762 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 980 msiexec.exe 980 msiexec.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4156 msiexec.exe Token: SeIncreaseQuotaPrivilege 4156 msiexec.exe Token: SeSecurityPrivilege 980 msiexec.exe Token: SeCreateTokenPrivilege 4156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4156 msiexec.exe Token: SeLockMemoryPrivilege 4156 msiexec.exe Token: SeIncreaseQuotaPrivilege 4156 msiexec.exe Token: SeMachineAccountPrivilege 4156 msiexec.exe Token: SeTcbPrivilege 4156 msiexec.exe Token: SeSecurityPrivilege 4156 msiexec.exe Token: SeTakeOwnershipPrivilege 4156 msiexec.exe Token: SeLoadDriverPrivilege 4156 msiexec.exe Token: SeSystemProfilePrivilege 4156 msiexec.exe Token: SeSystemtimePrivilege 4156 msiexec.exe Token: SeProfSingleProcessPrivilege 4156 msiexec.exe Token: SeIncBasePriorityPrivilege 4156 msiexec.exe Token: SeCreatePagefilePrivilege 4156 msiexec.exe Token: SeCreatePermanentPrivilege 4156 msiexec.exe Token: SeBackupPrivilege 4156 msiexec.exe Token: SeRestorePrivilege 4156 msiexec.exe Token: SeShutdownPrivilege 4156 msiexec.exe Token: SeDebugPrivilege 4156 msiexec.exe Token: SeAuditPrivilege 4156 msiexec.exe Token: SeSystemEnvironmentPrivilege 4156 msiexec.exe Token: SeChangeNotifyPrivilege 4156 msiexec.exe Token: SeRemoteShutdownPrivilege 4156 msiexec.exe Token: SeUndockPrivilege 4156 msiexec.exe Token: SeSyncAgentPrivilege 4156 msiexec.exe Token: SeEnableDelegationPrivilege 4156 msiexec.exe Token: SeManageVolumePrivilege 4156 msiexec.exe Token: SeImpersonatePrivilege 4156 msiexec.exe Token: SeCreateGlobalPrivilege 4156 msiexec.exe Token: SeCreateTokenPrivilege 4156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4156 msiexec.exe Token: SeLockMemoryPrivilege 4156 msiexec.exe Token: SeIncreaseQuotaPrivilege 4156 msiexec.exe Token: SeMachineAccountPrivilege 4156 msiexec.exe Token: SeTcbPrivilege 4156 msiexec.exe Token: SeSecurityPrivilege 4156 msiexec.exe Token: SeTakeOwnershipPrivilege 4156 msiexec.exe Token: SeLoadDriverPrivilege 4156 msiexec.exe Token: SeSystemProfilePrivilege 4156 msiexec.exe Token: SeSystemtimePrivilege 4156 msiexec.exe Token: SeProfSingleProcessPrivilege 4156 msiexec.exe Token: SeIncBasePriorityPrivilege 4156 msiexec.exe Token: SeCreatePagefilePrivilege 4156 msiexec.exe Token: SeCreatePermanentPrivilege 4156 msiexec.exe Token: SeBackupPrivilege 4156 msiexec.exe Token: SeRestorePrivilege 4156 msiexec.exe Token: SeShutdownPrivilege 4156 msiexec.exe Token: SeDebugPrivilege 4156 msiexec.exe Token: SeAuditPrivilege 4156 msiexec.exe Token: SeSystemEnvironmentPrivilege 4156 msiexec.exe Token: SeChangeNotifyPrivilege 4156 msiexec.exe Token: SeRemoteShutdownPrivilege 4156 msiexec.exe Token: SeUndockPrivilege 4156 msiexec.exe Token: SeSyncAgentPrivilege 4156 msiexec.exe Token: SeEnableDelegationPrivilege 4156 msiexec.exe Token: SeManageVolumePrivilege 4156 msiexec.exe Token: SeImpersonatePrivilege 4156 msiexec.exe Token: SeCreateGlobalPrivilege 4156 msiexec.exe Token: SeCreateTokenPrivilege 4156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4156 msiexec.exe Token: SeLockMemoryPrivilege 4156 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4156 msiexec.exe 4156 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4156 msiexec.exe 980 msiexec.exe 264 MsiExec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 980 wrote to memory of 264 980 msiexec.exe 90 PID 980 wrote to memory of 960 980 msiexec.exe 96 PID 980 wrote to memory of 3084 980 msiexec.exe 98 PID 980 wrote to memory of 5560 980 msiexec.exe 100 PID 980 wrote to memory of 244 980 msiexec.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4156
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 71768A5B36CA76138A64433191E10AA7 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:264
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:960
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoNavi.lnk" /grant *S-1-5-32-545:M2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3084
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\Users\Public\Desktop\GoNavi.lnk" /grant *S-1-5-32-545:M2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:5560
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\GoNavi\apply-brand-icon.ps1" -ApplicationDataFolder "C:\Users\Admin\AppData\Roaming\." -StartMenuShortcut "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoNavi.lnk" -DesktopShortcut "C:\Users\Public\Desktop\GoNavi.lnk"2⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:244
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a01f6.rbs
- Size 8KB
- SHA256 1b4ac30d66d4911d0c31e594fc66a0632223e39780161e18a95ee269657158bd
- MD5 01d440e9bfacd74aa85951486ac26e21
- SHA1 39a28dadd2fc7f2084ffd5bebe81b4fed7f6400f
- SHA512 aa76cec0c6833c9d69cdea8bfc6a11e5a59a71f265a27e09b726b0939007f761720fcfeb1b06cbea0986bf01bbf50196ff07a552caaf3fa7ae6b1e85ec3204f8
- SSDEEP 96:SmWn0slA7T4k4Pm2YCD3WxUTEqCsTlrUTEqC6j+zdOTlVSs5e5Whwhc0CCghplji:ToJl24A2YCCqA5I6A5yBia0BYpE
- TLSH T1E1021006BB0085E3ED951B3CCB1B6B2937A3C6D8C315530F46CDE1681F527496F6C1AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GoNavi\apply-brand-icon.ps1
- Size 22KB
- SHA256 63bacd353d59a4343437a5c259164f888b5f37f714d2449436e263003ac4aa98
- MD5 85b5d9c7a7744e870e0aaef20c754b65
- SHA1 56e7679b0c807c03bd89244ddacc818b63aeed0b
- SHA512 74facafd71157c03741f399a162fb7271286fae5141d220502595c54af7482bd94956a9720690866affe3657a4c03e84a3f37c3469a963074cbff28110c0b030
- SSDEEP 384:AOTFvm45aHsxaA/UhNuxCyYmMAdMnuR6klaZMcEMUXQOlcK+:p9m45aHskA/UhNuYyYPAdMnuMuaQQL9
- TLSH T106A2C626B505A2B11DB31375D9CA5455EB1300AB45FB9D38BEDE834C2FB140883BAF9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoNavi.lnk
- Size 1KB
- SHA256 3236cb5311241d70997a8831f0be0b6742b3e09eb4f17d423dc92fbf276d15b1
- MD5 8b0ab626a37eb2a41c7736eaea0bd30c
- SHA1 70ace908c5a02df9250cf0dbafe4476131609341
- SHA512 019e9cd4fa35902a917724b62e2e9e1b8d288ce106a00979b5659f1872947a7a524156eac9a93bee67c47bf60e4cbd0bd40af6cebe9c0ffe53e4fea34f94fb22
- TLSH T10E41CB308FB50A7EF3B3CB396D6166559632F947E9004F3A419641850920642DEE9F3B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~oNavi.tmp
- Size 1KB
- SHA256 ca24ae6b39f1a560ddc592f2af67562ec70e98727e803ec260abd326d9a6cb2f
- MD5 465544e989cf82167a4bd2046ebd5106
- SHA1 b43dbecd9e6f92092b57e7735d769a98156ba50a
- SHA512 1bf3a77a4583965252a38ff098f44eee79adc93f378c772e29c7f330a7d3cb1dace1a6b37b5ac01d3e3eb8a76aaef372fbf58578bea45c2ef6f2d3c63605f6ce
- TLSH T1A1419D308FB5067EF2B38B396D6166565632FD87E9004F3A419541850924642DEE9F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIACA1.tmp
- Size 155KB
- SHA256 f506eb822c6438d752323a1b252885208a178a2c0ad41333fc498b3402bc82d3
- MD5 2edeb4cbd8dc4cb4e53a736e8f4dc656
- SHA1 34a8e5adb830446fb687d0b8e960f8261848f967
- SHA512 caefcc73748f4c8584e645ead0761b156869d69047047db2ef199ef3891bf696fe68554615b0bc2bb266eaf2f85065d8cbf711c0590025ce77232474e099e1ef
- SSDEEP 3072:7LKxfjVI402ARONicMAD6xyui9+SCbrDAWAE/8Y:7LIJmtd/ADO3Vf
- TLSH T181F37C1B77A500BBE5B38278C9A34A45F772B8551B608BEF03A442761F273D19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\GoNavi.lnk
- Size 1KB
- SHA256 9c504a8099ff90db36eb2d44de160f2ec4e526c325d7c61f5b62922b9700868c
- MD5 a59b79e1022af3cc9162dae5cdcd82ce
- SHA1 1958deb2e2ed560c271c4b913013ca872bd210d1
- SHA512 3a9529e7fb54290ffa9c10ad6dca2b4aff1ba77476b182ae333b4d813e3a17fd17219b4a80218dc2f4a2b2bddf1055ce38e62e784dd0c3a056ff3d156cc0a70c
- TLSH T1CA319B308EB5057EF7B3D73A6D6167569632F847E9004F3B418641850960682DEE9F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\~oNavi.tmp
- Size 1KB
- SHA256 149573c306a0c3fcb29e8d51fb67d695db518a67d222388f656b1ae0a964e5e3
- MD5 ada3633a6a3709f2a557bd15bd684511
- SHA1 00ef789bbef381c300ea10664fdf47512a1376db
- SHA512 788c3260306918d315e2a5293b9a2229218c1e0a3602b612f2ba1463fc4e61782ab60557e7487592d4b05c5054a7e29be03eb48ded30ac2d349015c16c26802c
- TLSH T19D41CD308EB5057EF6B3CB396D6066565232FC87E9004F3B418641850920682DEE8F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a01f7.msi
- Size 26.9MB
- SHA256 28101588832b45d2f3feb29a7831f10a6199aed0a0311314e206e087ebf3b397
- MD5 e2a39cb484f71d0fea860f141896440b
- SHA1 0b4501409f255c64de09f1f74e76c3b356734804
- SHA512 4a5b356e32c8f90910fa32d8d2ca515031b5d06a6dd0ef756c38d6f8422fe81ee47dc6f454b14fa3241d45b9c5cd857861972c29103fcedfa47afbb1ef229a15
- SSDEEP 786432:PnmaEWR8+f+cDroWACnSjHXh1LL5YKe/64xJc:PWn+f+gfArX3LiPE
- TLSH T1BE5733177C848938C5578F7196F58B094B877C242B605D6B323CB75AEAF36F82A385E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0dbfb31344be11fb53aa2ca8cd0217738f71a8d5ad28564ec7516b058e368c3a
- MD5 df82ecc269091cdacad834695234a3cf
- SHA1 869e937e91b1d9c35375a7eccb386b41aefac19c
- SHA512 4ac76afdd6d171125b27e1f832ffafb46da9292b1b84ade7a52dec89c77e1ff125c0eaa421417c27da14d40b89893b8dc471ce1cd0f195664aa4aa6fb56f7888
- SSDEEP 24576:IFo3DMPldoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:sHI
- TLSH T1FA57B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{62a1df05-a269-4bad-bb52-0fca104b4602}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8897c3f56003221ed1e61fbea805fa76ee0a2d27990b784ed0c6f0d1125a67e8
- MD5 8ddd7021125a5253fcc9e6959f30e410
- SHA1 f7c424dd69a7bcc2aefe4c70b910382b589fe2a3
- SHA512 c0acff917992f51f9a7a144cf7c4e7b2514135a895face3ee0804a8d09639f64ec339461effe8183f7958e79bcac5f654223685ee3c2c2234d402541cf616936
- SSDEEP 96:F+PNZ7vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:YPjb++uVm
- TLSH T11ED198085AF54711E2B3AB3228F18557A477B911FF33CB8E0198238E6630910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH