Analysis
- max time kernel
299s - max time network
301s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
详细介绍表.jpg.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
详细介绍表.jpg.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
300 seconds
General
- Target 详细介绍表.jpg.msi
- Size 4.2MB
- Sample261110-gdfd2agt4k
- SHA256 4b1faa451d5ebb896e51f8beca2c06550e1ecab8c70090052126fdf215dd61d2
- MD5 d68880c24072ee1afdfb77d2ee1ff4c9
- SHA1 27d5f8062a7ca1af526dd5c6abc0e7c2988e4d5a
- SHA512 a71f1887037558a643db5660216526627444c7aab2f1b0d2a0a2d1c0f008195ae069f750d679f529ef2ae7cf6a600cc7b80c5ef67f3020b746fc99e53e328f28
- SSDEEP 98304:mIwePN9Fjjv7Xfv1ZGxeznbV9jWNLs2qIowdjfMEJa7KOuYNddw:tzN9Fjj7yejbVFCowhfzaducW
- TLSH T1F8162219B3E418EEE07682B6C4938520FF797D0C3360956F4BA5796D1F3A69434BBB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FanControl.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FanControl.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FanControl.exe - Executes dropped EXE 2 IoCs
pid Process 4104 FanControl.exe 4596 FanControl.exe - Loads dropped DLL 8 IoCs
pid Process 1244 MsiExec.exe 1244 MsiExec.exe 1244 MsiExec.exe 3328 MsiExec.exe 4104 FanControl.exe 4104 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 3068 icacls.exe 3716 icacls.exe -
resource yara_rule behavioral2/files/0x000d00000001c4f9-22.dat themida behavioral2/memory/4104-36-0x0000000180000000-0x000000018091B000-memory.dmp themida behavioral2/memory/4596-40-0x0000000180000000-0x000000018091B000-memory.dmp themida behavioral2/memory/4104-105-0x0000000180000000-0x000000018091B000-memory.dmp themida behavioral2/memory/4596-106-0x0000000180000000-0x000000018091B000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FanControl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FanControl.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\qbcore_debug.log FanControl.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 4104 FanControl.exe 4596 FanControl.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e599c27.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA0AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA300.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE482CC8691301D34.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA224.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA497.tmp msiexec.exe File created C:\Windows\Installer\e599c29.msi msiexec.exe File created C:\Windows\SystemTemp\~DF02D68192ED609848.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF0F88AE58A119E4CD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA167.tmp msiexec.exe File created C:\Windows\Installer\e599c27.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{35646D68-0514-4064-B4C2-9799EE0B418A} msiexec.exe File opened for modification C:\Windows\qbcore_debug.log FanControl.exe File created C:\Windows\SystemTemp\~DF6F276397BA502DA3.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 996 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname FanControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain FanControl.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe - Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 FanControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ FanControl.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\ProductName = "FanControl" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\PackageName = "详细介绍表.jpg.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86D64653415046044B2C7999EEB014A8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\PackageCode = "23F200752DDF7414EBE21D2981929D4C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E4D3C2B7A6F1098CBED1F325476986E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E4D3C2B7A6F1098CBED1F325476986E\86D64653415046044B2C7999EEB014A8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86D64653415046044B2C7999EEB014A8\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86D64653415046044B2C7999EEB014A8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2372 schtasks.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 5252 msiexec.exe 5252 msiexec.exe 3092 mspaint.exe 3092 mspaint.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe 4596 FanControl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4104 FanControl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 996 msiexec.exe Token: SeIncreaseQuotaPrivilege 996 msiexec.exe Token: SeSecurityPrivilege 5252 msiexec.exe Token: SeCreateTokenPrivilege 996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 996 msiexec.exe Token: SeLockMemoryPrivilege 996 msiexec.exe Token: SeIncreaseQuotaPrivilege 996 msiexec.exe Token: SeMachineAccountPrivilege 996 msiexec.exe Token: SeTcbPrivilege 996 msiexec.exe Token: SeSecurityPrivilege 996 msiexec.exe Token: SeTakeOwnershipPrivilege 996 msiexec.exe Token: SeLoadDriverPrivilege 996 msiexec.exe Token: SeSystemProfilePrivilege 996 msiexec.exe Token: SeSystemtimePrivilege 996 msiexec.exe Token: SeProfSingleProcessPrivilege 996 msiexec.exe Token: SeIncBasePriorityPrivilege 996 msiexec.exe Token: SeCreatePagefilePrivilege 996 msiexec.exe Token: SeCreatePermanentPrivilege 996 msiexec.exe Token: SeBackupPrivilege 996 msiexec.exe Token: SeRestorePrivilege 996 msiexec.exe Token: SeShutdownPrivilege 996 msiexec.exe Token: SeDebugPrivilege 996 msiexec.exe Token: SeAuditPrivilege 996 msiexec.exe Token: SeSystemEnvironmentPrivilege 996 msiexec.exe Token: SeChangeNotifyPrivilege 996 msiexec.exe Token: SeRemoteShutdownPrivilege 996 msiexec.exe Token: SeUndockPrivilege 996 msiexec.exe Token: SeSyncAgentPrivilege 996 msiexec.exe Token: SeEnableDelegationPrivilege 996 msiexec.exe Token: SeManageVolumePrivilege 996 msiexec.exe Token: SeImpersonatePrivilege 996 msiexec.exe Token: SeCreateGlobalPrivilege 996 msiexec.exe Token: SeBackupPrivilege 5860 vssvc.exe Token: SeRestorePrivilege 5860 vssvc.exe Token: SeAuditPrivilege 5860 vssvc.exe Token: SeBackupPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe Token: SeTakeOwnershipPrivilege 5252 msiexec.exe Token: SeRestorePrivilege 5252 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 996 msiexec.exe 996 msiexec.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 996 msiexec.exe 5252 msiexec.exe 1244 MsiExec.exe 3328 MsiExec.exe 5292 explorer.exe 3092 mspaint.exe 3092 mspaint.exe 3092 mspaint.exe 3092 mspaint.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5252 wrote to memory of 4380 5252 msiexec.exe 94 PID 5252 wrote to memory of 1244 5252 msiexec.exe 96 PID 1244 wrote to memory of 3716 1244 MsiExec.exe 97 PID 1244 wrote to memory of 3068 1244 MsiExec.exe 99 PID 1244 wrote to memory of 2372 1244 MsiExec.exe 101 PID 5252 wrote to memory of 3328 5252 msiexec.exe 103 PID 5252 wrote to memory of 4104 5252 msiexec.exe 104 PID 3328 wrote to memory of 4860 3328 MsiExec.exe 105 PID 5292 wrote to memory of 3092 5292 explorer.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\详细介绍表.jpg.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:996
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4380
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 5BC7702083069BBDF285D85BEDFCAC64 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe" /inheritance:r /grant:r *S-1-5-32-544:(F) /grant:r *S-1-5-32-545:(RX)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\Users\Admin\AppData\Roaming\FanControl\qbcore.dll" /inheritance:r /grant:r *S-1-5-32-544:(F) /grant:r *S-1-5-32-545:(RX)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TN "FanControl" /XML "C:\Users\Admin\AppData\Roaming\FanControl\FanControlTask.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2372
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4B5AB7533B5F20BFA80F86F30B4D3A372⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\photo_2026-11-05_17-00-56.jpg"3⤵
- System Location Discovery: System Language Discovery
PID:4860
-
-
-
C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe"C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:4104
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5860
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\photo_2026-11-05_17-00-56.jpg"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3092
-
-
C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exeC:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
PID:1548
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Debugger Evasion
1File and Directory Permissions Modification
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e599c28.rbs
- Size 7KB
- SHA256 3bca2a66a305baac92a1a7e4652a3b778f9f1b07d0016daaec9a6a674a1295e0
- MD5 9761354dd3398cb8e744bb9876572d80
- SHA1 049ce9b058a998a6b15488e91b2fb23eb65b8e5a
- SHA512 883094814e9bcb5548c7232ca61fff18f5932cdca41731d2025572451f399c62bb8bda9f48d04088c00e0dcf7b45d1638cc38168d50f188e5aada84f1b538b17
- SSDEEP 96:xGiDXuhwkoIK1f1OCLThvXThvv1UqlTCsThqVUqlTC6jwDh8ThqThv2OThqgHtaw:x3Xj+CV5vOMOInMObHUPsMpg
- TLSH T1F6F162467242C2D2F59E07B2C7072BA83766E7E9A340A70F0C9D94243F867886F595CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\photo_2026-11-05_17-00-56.jpg
- Size 103KB
- SHA256 5445c2280cf86b4e4e1fb7f5b223c2a15232279f3a6a6cb2dafbffe37b4e29fa
- MD5 6adb62d69e14419ecedee69975ee4d0f
- SHA1 63dfd4617ccf6525f20f77c2a602c47db47bdc73
- SHA512 1789fc5dadcd21b75f6378243c1e0103465362d93243fc4f45078a7aaae2c7e2ac47820df73036a1a568dd21945258ccff55b95ebf72bceb3972de64d721f13c
- SSDEEP 1536:edo371KCYtGhi7+s0Dws302jMLVdfKpjapTZCUGqcnEPhmdmMC/L9LeDKor0+zl2:r7Amu10DJCRptCtqcEPwnxpzle49M
- TLSH T1E7A302AB31A2DA50F456017C7AC508E6F3BC3C4F4448792A1284BEC3FBB956FA250DD5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\FanControl.exe
- Size 610KB
- SHA256 7e07a64d95b1669008014a9c594a253021f01ab0f54ec6268bde1fb743e6cec7
- MD5 58bfd83c05176914e23f8dc19a09d989
- SHA1 0677fef4d9196f37fb0de67a4197776d8589b48a
- SHA512 0da0bf87c5a90f95ac184e4f3409f11487fec257cf0281d154dbb6869fd961df83684676cf0ffb68559525e4cd251ef0ca9a5d04cae9705254e433344d6eb747
- SSDEEP 6144:p/dIyr9zoMUCqQpfhnwWM6hUd5PTLYQd4KR7pNLRLsoQKW0YQgmA21FeSJtzd6:LINMUqlhnwz6hUfTnooLWAx/eSB6
- TLSH T1CFD41986B2A406E8E2B69B3C8A26C445D6717DA64761D6CFE12437761F37BE20D3F304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\FanControlTask.xml
- Size 1KB
- SHA256 8c5d3ad506233f9d5e65b079ec0bcbdc102ccdbeca16020c38af92ca50d92eed
- MD5 cdb8bb4e3dd556efbb2c0121463c27a4
- SHA1 511b5fe5444ed43840c77b555930dc8fbbe02ed5
- SHA512 a3a1da094c084315da99f2c9da194717acda3e6a741cb7c4ceef7c1c748ed0703c3110a5cec0ff2901ad8abe50045dc9b32406c42ed9b7f6c8134f9df626283a
- TLSH T1F4212154ACC0F2176176822AE7419A82EF37976307A68034F8CC4E3B3FF91493113427
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\VCRUNTIME140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\qbcore.dll
- Size 3.4MB
- SHA256 79c1df69f8c4c5aebce5f5f065d280753c86febcfbbfd116f4f1d547587657bd
- MD5 a6445e3311ae4d9086c254d289e888ea
- SHA1 ac82c4eceb6eb4025573c634623bc684a7d9de7c
- SHA512 d5a8255d458c140c9a98daede2ad960c1f88e1cb201f4da1c5e18a9da7bfd66b069956064bd5ef8043586e5224e9f4b4acbc980af9f52dd2fff28b3f666e6362
- SSDEEP 98304:19I1bhhqq8YwvfI/D9nUXIttrT8bs7Tglf8:19E3nf9nUXUx8bOTgB8
- TLSH T1A0F53379B9A9DAE5EC0565F667230CC14FE96393940092263F9B8092DF9B13AFCFD500
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FanControl\temp.log
- Size 1KB
- SHA256 abafdbd2f15950e0d21345115e1f4158acdb8796a323737bab3e97962a0adc45
- MD5 77d1125758db0b19d04e0cd25e06550d
- SHA1 1b1cddb3f5d4e66199612f6cb563aa65ef51f16d
- SHA512 ff7b13234849d91488677cd2e1c982fb66a4f61caecb81c12e92b2ea944395d21a05abf046dfa84227f011e6e641806dac60a5c46350bf0f4cdce6e3a5e45553
- TLSH T1C231C7C9FA2F954490BDE72634377E6CAC2191548A4B3F11E5BC1DB1CB4DA6253E4005
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIA167.tmp
- Size 413KB
- SHA256 0d7eb1693fd67f17d98be69c8b1fa93ff4d309ee12ad518df9fd6585d906b0ff
- MD5 7f9612ceabc6f403743c0b7e9bd6e593
- SHA1 7618d4efcb6ec8f95ade129684525c6f36907c08
- SHA512 079c5bf70914287186f0983d23e665234f92d2640cd52d82fceaba87b0852925b63b5f9510c351e82bc2e11b418a2813069b336ac2db09a1c1d0079124b63cad
- SSDEEP 6144:8vjGcZ7bhbeK0Kmq1nc3zYlRSmVZN8DgjG8YOCURq:GjGobA59USmVZMgjG8YAw
- TLSH T146945B29B3E418EDE4B682B6C5A78034FF75744D332095AF8BA4956D1F3B6A430BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e599c29.msi
- Size 4.2MB
- SHA256 4b1faa451d5ebb896e51f8beca2c06550e1ecab8c70090052126fdf215dd61d2
- MD5 d68880c24072ee1afdfb77d2ee1ff4c9
- SHA1 27d5f8062a7ca1af526dd5c6abc0e7c2988e4d5a
- SHA512 a71f1887037558a643db5660216526627444c7aab2f1b0d2a0a2d1c0f008195ae069f750d679f529ef2ae7cf6a600cc7b80c5ef67f3020b746fc99e53e328f28
- SSDEEP 98304:mIwePN9Fjjv7Xfv1ZGxeznbV9jWNLs2qIowdjfMEJa7KOuYNddw:tzN9Fjj7yejbVFCowhfzaducW
- TLSH T1F8162219B3E418EEE07682B6C4938520FF797D0C3360956F4BA5796D1F3A69434BBB02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\qbcore_debug.log
- Size 309B
- SHA256 46bf77529a9004ee06eb0a129139efb2a05b242c71b81d71cef98bd23eefbac8
- MD5 d460fe17ad1ef730cde3c575dfd63472
- SHA1 86b86355bd5e0023740f008194f2e75ed9db69c1
- SHA512 3086ce4139898fd139e0c83519cf0fbdb179b360307b03bc9710862f845cd12f893b85ebe466ae63575fd6952a92853f2cd091738b34f169b5627af59bf76c42
- TLSH T11EE0C22169AFC71EDA92C093EF23B4CD40D97E756FD71201C60A099D70A6CF4B722802
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\qbcore_debug.log
- Size 309B
- SHA256 83ec8d9c620705bea597c6dd307d4be3c97fa8d85df7d00d9d8826b0436812ed
- MD5 b9cf3a77d712ac7f80e56de5c554b7c3
- SHA1 62acea50a7c73e7117d89d8579a56289cf5539a1
- SHA512 d91447f739c2906b8acd6e85028e9b7efe372c80f5020816e5bfd72391f3d452ff8c58e212b78695212423b4b75ae460d8934b5f5254593d7ad3319bfd28e803
- TLSH T1E0E0C22069AFC31EDA82C093EF23B4CD40C97F755FD71201C60A1A5D3096CF4B622902
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 b2c98a9982c06339f37e8fc7737e22a9cb485d67d016285b825b3efb18a96c3d
- MD5 358f23b3192d6aec1849b8392a841ab6
- SHA1 925a600b01305684d48b99493cc2fbf80c39c614
- SHA512 966eb970adda993ce47ec06ad1a4b88c4ab7c389dc0e9265956eec538ac7e827d2ff50cf08f6e11f88ccfb8008fab33c4c5d3b7de0b9ec9229e4cc84456703c6
- SSDEEP 24576:RFo3DMPQdoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKes:8HM
- TLSH T15D57042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8a835318-178f-490f-86e4-1fc9af536d9f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 62a898e546316fa2a56f7afd2e1377ca0575a7f9934f7502900b3f5c8fa26475
- MD5 d75fc1aecf4a9cc641142d677705ead2
- SHA1 cb04ea155b81220a53e8bba696ac77902273ef12
- SHA512 98157a00526bbbb6582f5f0291ec0d65c167226d56e7eed366c52df51c1d83a32984ffbdb9843bd60d909ee18e05601fcf87361f683b0643ef3f15e31d06aa86
- SSDEEP 96:Fnf0uPF+vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:lf0bb++uVm
- TLSH T126D198085AF54711E2B3AB3128F18557A837B911EF33CB8E0198238E6630910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH