Analysis
- max time kernel
150s - max time network
119s - platform
windows11-21h2_x64 - resource
win11-20250905-en - resource tags
arch:x64arch:x86image:win11-20250905-enlocale:en-usos:windows11-21h2-x64system - submitted
14/10/2025, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
.GJYDMIª.msi
Resource
win10v2004-20250610-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
.GJYDMIª.msi
Resource
win11-20250905-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target .GJYDMIª.msi
- Size 8.4MB
- Sample251014-teekca1wbt
- SHA256 551863be2e92aa2d319a92cda72bc2123233ee3a7e965ee691fd70d88c21d772
- MD5 30596fbaee7619b1d20bf4afd231bd28
- SHA1 4031f1ec52418bc3ea6daaf10872cea846aad7de
- SHA512 ff01655cee277d000e492973509841e2d8970e7aca7a21d4807b319bbc1eb73a236150194fa7a277ce8929cac51eb813b4cef21bfd0619f12baafdbd182a6202
- SSDEEP 196608:MUwHMs5OjwTna0dQyC5ASPeSU15+I4qs0vczif4EZ/vI0hN1IMWxwwL:uz5owTabHPBw514D0kcBvI0hNxwL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ exename.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ exename.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ exename.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion exename.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion exename.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion exename.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion exename.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion exename.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion exename.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2910617350-3280892089-2510284752-1000\Software\Microsoft\Windows\CurrentVersion\Run\exename.exe = "C:\\ProgramData\\64E15EC580B377B973\\exename.exe" exename.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 7 pastebin.com 1 pastebin.com 2 pastebin.com 6 pastebin.com - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 4092 exename.exe 488 exename.exe 1268 exename.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7F08.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7C54.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7E4A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{5588CA6B-3D31-4096-B00D-306414FB9020} msiexec.exe File created C:\Windows\SystemTemp\~DFF99CD2C459B44481.TMP msiexec.exe File created C:\Windows\Installer\e577bcb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7DEB.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFA8989C3A12E09B1B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF63D3D813B6159D35.TMP msiexec.exe File created C:\Windows\Installer\e577bc7.msi msiexec.exe File created C:\Windows\SystemTemp\~DF62B808E667E9D117.TMP msiexec.exe File opened for modification C:\Windows\Installer\e577bc7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7E5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7E8A.tmp msiexec.exe - Executes dropped EXE 3 IoCs
pid Process 4092 exename.exe 488 exename.exe 1268 exename.exe - Loads dropped DLL 5 IoCs
pid Process 4220 MsiExec.exe 4220 MsiExec.exe 4220 MsiExec.exe 4220 MsiExec.exe 4220 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA exename.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA exename.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA exename.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4760 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exename.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exename.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exename.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4092 exename.exe 488 exename.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4952 msiexec.exe 4952 msiexec.exe 4092 exename.exe 4092 exename.exe 488 exename.exe 488 exename.exe 1268 exename.exe 1268 exename.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4760 msiexec.exe Token: SeIncreaseQuotaPrivilege 4760 msiexec.exe Token: SeSecurityPrivilege 4952 msiexec.exe Token: SeCreateTokenPrivilege 4760 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4760 msiexec.exe Token: SeLockMemoryPrivilege 4760 msiexec.exe Token: SeIncreaseQuotaPrivilege 4760 msiexec.exe Token: SeMachineAccountPrivilege 4760 msiexec.exe Token: SeTcbPrivilege 4760 msiexec.exe Token: SeSecurityPrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeLoadDriverPrivilege 4760 msiexec.exe Token: SeSystemProfilePrivilege 4760 msiexec.exe Token: SeSystemtimePrivilege 4760 msiexec.exe Token: SeProfSingleProcessPrivilege 4760 msiexec.exe Token: SeIncBasePriorityPrivilege 4760 msiexec.exe Token: SeCreatePagefilePrivilege 4760 msiexec.exe Token: SeCreatePermanentPrivilege 4760 msiexec.exe Token: SeBackupPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeShutdownPrivilege 4760 msiexec.exe Token: SeDebugPrivilege 4760 msiexec.exe Token: SeAuditPrivilege 4760 msiexec.exe Token: SeSystemEnvironmentPrivilege 4760 msiexec.exe Token: SeChangeNotifyPrivilege 4760 msiexec.exe Token: SeRemoteShutdownPrivilege 4760 msiexec.exe Token: SeUndockPrivilege 4760 msiexec.exe Token: SeSyncAgentPrivilege 4760 msiexec.exe Token: SeEnableDelegationPrivilege 4760 msiexec.exe Token: SeManageVolumePrivilege 4760 msiexec.exe Token: SeImpersonatePrivilege 4760 msiexec.exe Token: SeCreateGlobalPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe Token: SeRestorePrivilege 4952 msiexec.exe Token: SeTakeOwnershipPrivilege 4952 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4760 msiexec.exe 4760 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4092 exename.exe 488 exename.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4220 4952 msiexec.exe 79 PID 4952 wrote to memory of 4220 4952 msiexec.exe 79 PID 4952 wrote to memory of 4220 4952 msiexec.exe 79 PID 4952 wrote to memory of 4092 4952 msiexec.exe 80 PID 4952 wrote to memory of 4092 4952 msiexec.exe 80 PID 4952 wrote to memory of 4092 4952 msiexec.exe 80 PID 4092 wrote to memory of 1268 4092 exename.exe 84 PID 4092 wrote to memory of 1268 4092 exename.exe 84 PID 4092 wrote to memory of 1268 4092 exename.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\.GJYDMIª.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 343E087C1ED44792134EB3F0D83391F82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4220
-
-
C:\Users\Admin\AppData\Roaming\Leitor\Leitor Viw\exename.exe"C:\Users\Admin\AppData\Roaming\Leitor\Leitor Viw\exename.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\ProgramData\64E15EC580B377B973\exename.exe"C:\ProgramData\64E15EC580B377B973\exename.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
-
C:\ProgramData\64E15EC580B377B973\exename.exeC:\ProgramData\64E15EC580B377B973\exename.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:488
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Modify Registry
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e577bca.rbs
- Size 9KB
- SHA256 81b4118f78061c28002cda7a5e46b4ad288a9174dea0d5d9b489c953615ded25
- MD5 91d1e455d5ffdb3a0565ca725cba2d93
- SHA1 1ec90ddedcd707dfdc9bba93c0b6d2135cca3762
- SHA512 658b9119743d5ec452ba7909d934eccda24f0a1ce72dd06802fd646ed92b0310cd7824753ea3123ce24f3b8d778004c5e6390e9d3f7fd157f47aee3649d7ff4d
- SSDEEP 192:j6D+vHEilfYByMQXOERMQXO6W+2MH89Tfb/pUYdqGufHv99:j6Ss5QXIQXb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\64E15EC580B377B973\original_location.txt
- Size 62B
- SHA256 b4477e23b6f63405d364f968251446c74659897609240e971641802886f45225
- MD5 73223c482d4e02bcc5570771885f8844
- SHA1 75255db67d5e0b077c56e146f4902a5c27885a9e
- SHA512 b8abb071b0b8c820cf7048bd3755100ce269c3858ff291d94b39df729b0bea1af7222cb3bf2868dcfee3f8fd48cb32b2051000b5885b6fad58e77966a563f1b3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI77a7f.LOG
- Size 20KB
- SHA256 3eb9a34fb59017c24adc4460e7c4259a3efecb9b8dd08030159805e5d64a361d
- MD5 675dcabab27c208e4556b4c100cce5c9
- SHA1 94027f65665da48d687aeb8e5514df8d8c9b3509
- SHA512 44ecb396e11a20a453593297376dec1e98e866278eb1e5fbeb93b02b2d7eeee764814c12d6db18d45b244dfc75a9ab004f41efd6f6b6f39977f076837d616e84
- SSDEEP 192:cGM/PiM/PgJ5+DwaAWDft8xYxY7lzu8Kr2j4D6bbchj0c2:cGDzawaZfCxYxElzu8Kr2gWMj0c2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Leitor\Leitor Viw\exename.exe
- Size 7.3MB
- SHA256 ca49f2eaf6a2ad638ce7cf1453c9e2aef6b69e693b9f15496fbe6d563b53e8fd
- MD5 87bff01002f46e7fb5c75e407c734010
- SHA1 eac9f9eb604b5b559df49f296b9c5a1a45e44c55
- SHA512 527be43723a9839df67e3bbe0c2d32c394aa332582bfef44561e2cb95104705ccc087ca5af0756a97f00c8fdcef952928c534beb47c1cef611b0e60dd1a1b9d9
- SSDEEP 196608:rLjYMPi1DazEijtlEeIWxQX+AUMeARAwZiuy6sgEPGL0r5WF5:rvYMahxms+AP2+NsgEOLiU5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7C54.tmp
- Size 1019KB
- SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
- MD5 2330ebbe491c6026af5e8853f3692798
- SHA1 6c62d81f6c90046714705bec931815a908b760ac
- SHA512 81747ead7869f68e499a53537588d35485b5fd2b4505856cd589bca1f7296d971e78f3fd57a1c1d931dfe6c2668888b26eff49a96ecd740ecd1b271eb7058201
- SSDEEP 24576:T21SlOwxeXfwNTELVJh0lhSMXl3SG5vHqU4duDfCK:ToS9xeXf7LKnSG5vHqU4duDfCK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e577bc7.msi
- Size 8.4MB
- SHA256 551863be2e92aa2d319a92cda72bc2123233ee3a7e965ee691fd70d88c21d772
- MD5 30596fbaee7619b1d20bf4afd231bd28
- SHA1 4031f1ec52418bc3ea6daaf10872cea846aad7de
- SHA512 ff01655cee277d000e492973509841e2d8970e7aca7a21d4807b319bbc1eb73a236150194fa7a277ce8929cac51eb813b4cef21bfd0619f12baafdbd182a6202
- SSDEEP 196608:MUwHMs5OjwTna0dQyC5ASPeSU15+I4qs0vczif4EZ/vI0hN1IMWxwwL:uz5owTabHPBw514D0kcBvI0hNxwL
- MD5 SHA1 SHA512 SSDEEP