Analysis
- max time kernel
299s - max time network
300s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
详细介绍表.jpg.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
详细介绍表.jpg.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
300 seconds
General
- Target 详细介绍表.jpg.msi
- Size 4.2MB
- Sample261110-gdfd2agt4k
- SHA256 4b1faa451d5ebb896e51f8beca2c06550e1ecab8c70090052126fdf215dd61d2
- MD5 d68880c24072ee1afdfb77d2ee1ff4c9
- SHA1 27d5f8062a7ca1af526dd5c6abc0e7c2988e4d5a
- SHA512 a71f1887037558a643db5660216526627444c7aab2f1b0d2a0a2d1c0f008195ae069f750d679f529ef2ae7cf6a600cc7b80c5ef67f3020b746fc99e53e328f28
- SSDEEP 98304:mIwePN9Fjjv7Xfv1ZGxeznbV9jWNLs2qIowdjfMEJa7KOuYNddw:tzN9Fjj7yejbVFCowhfzaducW
- TLSH T1F8162219B3E418EEE07682B6C4938520FF797D0C3360956F4BA5796D1F3A69434BBB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FanControl.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FanControl.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FanControl.exe - Executes dropped EXE 2 IoCs
pid Process 1672 FanControl.exe 2164 FanControl.exe - Loads dropped DLL 8 IoCs
pid Process 2572 MsiExec.exe 2572 MsiExec.exe 2572 MsiExec.exe 1672 FanControl.exe 1672 FanControl.exe 4432 MsiExec.exe 2164 FanControl.exe 2164 FanControl.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 920 icacls.exe 2032 icacls.exe -
resource yara_rule behavioral1/files/0x000700000002444b-22.dat themida behavioral1/memory/1672-34-0x0000000180000000-0x000000018091B000-memory.dmp themida behavioral1/memory/1672-131-0x0000000180000000-0x000000018091B000-memory.dmp themida behavioral1/memory/2164-132-0x0000000180000000-0x000000018091B000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FanControl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FanControl.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File opened for modification C:\Windows\System32\qbcore_debug.log FanControl.exe File opened for modification C:\Windows\System32\qbcore_debug.log FanControl.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 1672 FanControl.exe 2164 FanControl.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e59196a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1A25.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1B20.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1C5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1DD3.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59196a.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{35646D68-0514-4064-B4C2-9799EE0B418A} msiexec.exe File created C:\Windows\Installer\e59196c.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5076 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain FanControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname FanControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain FanControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname FanControl.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ FanControl.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ FanControl.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86D64653415046044B2C7999EEB014A8\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\ProductName = "FanControl" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\PackageCode = "23F200752DDF7414EBE21D2981929D4C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\PackageName = "详细介绍表.jpg.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings mspaint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86D64653415046044B2C7999EEB014A8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E4D3C2B7A6F1098CBED1F325476986E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E4D3C2B7A6F1098CBED1F325476986E\86D64653415046044B2C7999EEB014A8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 452 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 msiexec.exe 3856 msiexec.exe 4652 mspaint.exe 4652 mspaint.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 1672 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe 2164 FanControl.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1672 FanControl.exe 2164 FanControl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 3856 msiexec.exe Token: SeCreateTokenPrivilege 5076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5076 msiexec.exe Token: SeLockMemoryPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeMachineAccountPrivilege 5076 msiexec.exe Token: SeTcbPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 5076 msiexec.exe Token: SeTakeOwnershipPrivilege 5076 msiexec.exe Token: SeLoadDriverPrivilege 5076 msiexec.exe Token: SeSystemProfilePrivilege 5076 msiexec.exe Token: SeSystemtimePrivilege 5076 msiexec.exe Token: SeProfSingleProcessPrivilege 5076 msiexec.exe Token: SeIncBasePriorityPrivilege 5076 msiexec.exe Token: SeCreatePagefilePrivilege 5076 msiexec.exe Token: SeCreatePermanentPrivilege 5076 msiexec.exe Token: SeBackupPrivilege 5076 msiexec.exe Token: SeRestorePrivilege 5076 msiexec.exe Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeDebugPrivilege 5076 msiexec.exe Token: SeAuditPrivilege 5076 msiexec.exe Token: SeSystemEnvironmentPrivilege 5076 msiexec.exe Token: SeChangeNotifyPrivilege 5076 msiexec.exe Token: SeRemoteShutdownPrivilege 5076 msiexec.exe Token: SeUndockPrivilege 5076 msiexec.exe Token: SeSyncAgentPrivilege 5076 msiexec.exe Token: SeEnableDelegationPrivilege 5076 msiexec.exe Token: SeManageVolumePrivilege 5076 msiexec.exe Token: SeImpersonatePrivilege 5076 msiexec.exe Token: SeCreateGlobalPrivilege 5076 msiexec.exe Token: SeBackupPrivilege 2824 vssvc.exe Token: SeRestorePrivilege 2824 vssvc.exe Token: SeAuditPrivilege 2824 vssvc.exe Token: SeBackupPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeBackupPrivilege 2460 srtasks.exe Token: SeRestorePrivilege 2460 srtasks.exe Token: SeSecurityPrivilege 2460 srtasks.exe Token: SeTakeOwnershipPrivilege 2460 srtasks.exe Token: SeBackupPrivilege 2460 srtasks.exe Token: SeRestorePrivilege 2460 srtasks.exe Token: SeSecurityPrivilege 2460 srtasks.exe Token: SeTakeOwnershipPrivilege 2460 srtasks.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe Token: SeTakeOwnershipPrivilege 3856 msiexec.exe Token: SeRestorePrivilege 3856 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5076 msiexec.exe 5076 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4652 mspaint.exe 3484 OpenWith.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3856 wrote to memory of 2460 3856 msiexec.exe 96 PID 3856 wrote to memory of 2572 3856 msiexec.exe 98 PID 2572 wrote to memory of 2032 2572 MsiExec.exe 99 PID 2572 wrote to memory of 920 2572 MsiExec.exe 101 PID 2572 wrote to memory of 452 2572 MsiExec.exe 103 PID 3856 wrote to memory of 1672 3856 msiexec.exe 106 PID 3856 wrote to memory of 4432 3856 msiexec.exe 107 PID 4432 wrote to memory of 4664 4432 MsiExec.exe 108 PID 4348 wrote to memory of 4652 4348 explorer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\详细介绍表.jpg.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 512EED2C340084CEC1E59B20F4785CED E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe" /inheritance:r /grant:r *S-1-5-32-544:(F) /grant:r *S-1-5-32-545:(RX)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2032
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\Users\Admin\AppData\Roaming\FanControl\qbcore.dll" /inheritance:r /grant:r *S-1-5-32-544:(F) /grant:r *S-1-5-32-545:(RX)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:920
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TN "FanControl" /XML "C:\Users\Admin\AppData\Roaming\FanControl\FanControlTask.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:452
-
-
-
C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe"C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1672
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8F81A76FC4A0DAC4E67E11E3B13478192⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\photo_2026-11-05_17-00-56.jpg"3⤵
- System Location Discovery: System Language Discovery
PID:4664
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exeC:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2164
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\photo_2026-11-05_17-00-56.jpg" /ForceBootstrapPaint3D2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4652
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:1880
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3484
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Debugger Evasion
1File and Directory Permissions Modification
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59196b.rbs
- Size 7KB
- SHA256 7ecdceacb58439834ca3b0d87b2bd8583624284827ebac05d44d55ce536997e5
- MD5 3fac8aafe48b26e34bcb05928ec3ea59
- SHA1 109188bc6c9f0811bd315cfd38a94e3fef5f6928
- SHA512 7e044b42990a0ba163aa80aea3d01cd20889ff82daffe33bec66a76f700de16df498551b7022714cfbb1cdf4036ce6357e4f76457d1eba7efb645e65ef1a6aed
- SSDEEP 96:7GiAXQrwkoIK1f13e5cThvLThvv1UqlTCsThqVUqlTC6jwDh8ThqThv2OThqgHNB:7cXFneOVvOMOInMObHMPsMpg
- TLSH T10BF163067241C2D2F59E03B2C7072B983766E7E9A740AB0F089C94243F477896F555CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\photo_2026-11-05_17-00-56.jpg
- Size 103KB
- SHA256 5445c2280cf86b4e4e1fb7f5b223c2a15232279f3a6a6cb2dafbffe37b4e29fa
- MD5 6adb62d69e14419ecedee69975ee4d0f
- SHA1 63dfd4617ccf6525f20f77c2a602c47db47bdc73
- SHA512 1789fc5dadcd21b75f6378243c1e0103465362d93243fc4f45078a7aaae2c7e2ac47820df73036a1a568dd21945258ccff55b95ebf72bceb3972de64d721f13c
- SSDEEP 1536:edo371KCYtGhi7+s0Dws302jMLVdfKpjapTZCUGqcnEPhmdmMC/L9LeDKor0+zl2:r7Amu10DJCRptCtqcEPwnxpzle49M
- TLSH T1E7A302AB31A2DA50F456017C7AC508E6F3BC3C4F4448792A1284BEC3FBB956FA250DD5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe
- Size 610KB
- SHA256 7e07a64d95b1669008014a9c594a253021f01ab0f54ec6268bde1fb743e6cec7
- MD5 58bfd83c05176914e23f8dc19a09d989
- SHA1 0677fef4d9196f37fb0de67a4197776d8589b48a
- SHA512 0da0bf87c5a90f95ac184e4f3409f11487fec257cf0281d154dbb6869fd961df83684676cf0ffb68559525e4cd251ef0ca9a5d04cae9705254e433344d6eb747
- SSDEEP 6144:p/dIyr9zoMUCqQpfhnwWM6hUd5PTLYQd4KR7pNLRLsoQKW0YQgmA21FeSJtzd6:LINMUqlhnwz6hUfTnooLWAx/eSB6
- TLSH T1CFD41986B2A406E8E2B69B3C8A26C445D6717DA64761D6CFE12437761F37BE20D3F304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\FanControlTask.xml
- Size 1KB
- SHA256 8c5d3ad506233f9d5e65b079ec0bcbdc102ccdbeca16020c38af92ca50d92eed
- MD5 cdb8bb4e3dd556efbb2c0121463c27a4
- SHA1 511b5fe5444ed43840c77b555930dc8fbbe02ed5
- SHA512 a3a1da094c084315da99f2c9da194717acda3e6a741cb7c4ceef7c1c748ed0703c3110a5cec0ff2901ad8abe50045dc9b32406c42ed9b7f6c8134f9df626283a
- TLSH T1F4212154ACC0F2176176822AE7419A82EF37976307A68034F8CC4E3B3FF91493113427
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\qbcore.dll
- Size 3.4MB
- SHA256 79c1df69f8c4c5aebce5f5f065d280753c86febcfbbfd116f4f1d547587657bd
- MD5 a6445e3311ae4d9086c254d289e888ea
- SHA1 ac82c4eceb6eb4025573c634623bc684a7d9de7c
- SHA512 d5a8255d458c140c9a98daede2ad960c1f88e1cb201f4da1c5e18a9da7bfd66b069956064bd5ef8043586e5224e9f4b4acbc980af9f52dd2fff28b3f666e6362
- SSDEEP 98304:19I1bhhqq8YwvfI/D9nUXIttrT8bs7Tglf8:19E3nf9nUXUx8bOTgB8
- TLSH T1A0F53379B9A9DAE5EC0565F667230CC14FE96393940092263F9B8092DF9B13AFCFD500
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\temp.log
- Size 1KB
- SHA256 abafdbd2f15950e0d21345115e1f4158acdb8796a323737bab3e97962a0adc45
- MD5 77d1125758db0b19d04e0cd25e06550d
- SHA1 1b1cddb3f5d4e66199612f6cb563aa65ef51f16d
- SHA512 ff7b13234849d91488677cd2e1c982fb66a4f61caecb81c12e92b2ea944395d21a05abf046dfa84227f011e6e641806dac60a5c46350bf0f4cdce6e3a5e45553
- TLSH T1C231C7C9FA2F954490BDE72634377E6CAC2191548A4B3F11E5BC1DB1CB4DA6253E4005
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\vcruntime140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1B20.tmp
- Size 413KB
- SHA256 0d7eb1693fd67f17d98be69c8b1fa93ff4d309ee12ad518df9fd6585d906b0ff
- MD5 7f9612ceabc6f403743c0b7e9bd6e593
- SHA1 7618d4efcb6ec8f95ade129684525c6f36907c08
- SHA512 079c5bf70914287186f0983d23e665234f92d2640cd52d82fceaba87b0852925b63b5f9510c351e82bc2e11b418a2813069b336ac2db09a1c1d0079124b63cad
- SSDEEP 6144:8vjGcZ7bhbeK0Kmq1nc3zYlRSmVZN8DgjG8YOCURq:GjGobA59USmVZMgjG8YAw
- TLSH T146945B29B3E418EDE4B682B6C5A78034FF75744D332095AF8BA4956D1F3B6A430BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59196a.msi
- Size 4.2MB
- SHA256 4b1faa451d5ebb896e51f8beca2c06550e1ecab8c70090052126fdf215dd61d2
- MD5 d68880c24072ee1afdfb77d2ee1ff4c9
- SHA1 27d5f8062a7ca1af526dd5c6abc0e7c2988e4d5a
- SHA512 a71f1887037558a643db5660216526627444c7aab2f1b0d2a0a2d1c0f008195ae069f750d679f529ef2ae7cf6a600cc7b80c5ef67f3020b746fc99e53e328f28
- SSDEEP 98304:mIwePN9Fjjv7Xfv1ZGxeznbV9jWNLs2qIowdjfMEJa7KOuYNddw:tzN9Fjj7yejbVFCowhfzaducW
- TLSH T1F8162219B3E418EEE07682B6C4938520FF797D0C3360956F4BA5796D1F3A69434BBB02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log
- Size 64KB
- SHA256 ef3e52450dd6a8425373819e1788fe881702bc9a2b55ae9bf34f74e5f15415a3
- MD5 a54a8a87bce3e282c16c2e35c496a37d
- SHA1 644da5bd13f9a92e8fb85b4712e86c39a26f4adf
- SHA512 8fe557e3a0fa09cd37bc9d669d160eb83d0edf716f6e5c0998c9f9cc8c50eab4d946bb01595587a880b92164bcfdcd1dfb448f0f3811ac48711ef3ad7688759a
- SSDEEP 6:S4QD/vBXhYDhP5c23qC59hYDhP5c23qC5FotUilO+B:S4sx6Ph6CX6Ph6CwVlOW
- TLSH T128539703821608F2CC358C3D6C4AA3004B39F80439C88311008852ACEEC23253FB1CF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\qbcore_debug.log
- Size 618B
- SHA256 ab9eb6ea886c73262b84d066cccd0e5331932abf3d82a18201fa589083374d75
- MD5 a2c8839b6689729e72d287eb7280df44
- SHA1 46cd1bba85ccfa265789b83addfcca09ca4e8efe
- SHA512 ba0746d9963f18f58dce3e58a18453063162547bbf65666c92e1bb67751910af4ccd784ae80fc184f4c65eeca5efd3f6d46c3ddafb5994deea79a9b29101ab77
- TLSH T1E3F0AF2069AFC71EDA92C093EF23A4CD40C97E756FD75202C64A195D30A6CF4B622802
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 80150aa4f91b4dc14c7ecb1a132a391fabbaf186bcd4949956348f6d14f12182
- MD5 0e768e9ee1e39e0b15243f705da4c008
- SHA1 efc42e734a2acdcb24b2ad6149d157714403ad9c
- SHA512 2ce246cf4b793474bae714488696159574bb8d32d4db423121d231d6892ae778ba851ea8c7a3839178c5d137dc2722ecb6a9f91d27d27af64fa537fba25b3e87
- SSDEEP 24576:Tu8m+1zNdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:F
- TLSH T19D47C52437F92240E7F79E3D6CF06A2389397D579C169E8D05421B4E0921BB1E8B2F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{129e2e39-89fa-4686-b1b7-292375b2f95f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 26eb4a40868683f7fad1379f332b8e5a69b0f20735585b7c329b58efd67b96e8
- MD5 c45c4507bb5ca19dac84f7ee05f68272
- SHA1 5c8b95d492987266a5d36e2389e8a8dc43304bbd
- SHA512 0284a26ee2d8d6c635cba5c5a00e51f84421ff396d0987d7ce516d18ce6027db67b9bfcd2a21e47d5bb6d297850b83b102611180c90a114c3c5f66a3f38e19f3
- SSDEEP 96:FgnuPcYZvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:CnSb++ZVm
- TLSH T137D199085AF54711E2B3AB7229F14557A877B911EF33CB8E0298638E2670910F835F5F
- MD5 SHA1 SHA512 SSDEEP TLSH