036bb54a10cd237d3734f495f9dd901857a2612b5cc2746cddb4ae17028de1c4

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ver2022s/Ver2022S_i386.msi
Size 128KB
Sample260422-phlqlsbs3w
SHA256 036bb54a10cd237d3734f495f9dd901857a2612b5cc2746cddb4ae17028de1c4
MD5 83567604ee2fcc125a0d052eb1a1173f
SHA1 99f133f33a7ea7a2e15842ee4e6cb61c3f112a33
SHA512 892742f973649862843ba33b9887113139989f87f3b8fd5641ef3c92d9a8236f3cd74ba3052581c515d74446c1b50efde6d0b41b77827bd5f9b1c6f785a75256
SSDEEP 1536:nx8fEfvIjLQvkwoN+VXJ3lIMW10i2AinCNu0Vqqb:xjXInQv/oNCPIMViV
TLSH
T196D36C0777448333D5C20232852FE7E15F3A9CA84BB24553A19EB26D2CB1BD8E6B76D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2472	msiexec.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2472	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2472	msiexec.exe
Token: SeSecurityPrivilege	1492	msiexec.exe
Token: SeCreateTokenPrivilege	2472	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2472	msiexec.exe
Token: SeLockMemoryPrivilege	2472	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2472	msiexec.exe
Token: SeMachineAccountPrivilege	2472	msiexec.exe
Token: SeTcbPrivilege	2472	msiexec.exe
Token: SeSecurityPrivilege	2472	msiexec.exe
Token: SeTakeOwnershipPrivilege	2472	msiexec.exe
Token: SeLoadDriverPrivilege	2472	msiexec.exe
Token: SeSystemProfilePrivilege	2472	msiexec.exe
Token: SeSystemtimePrivilege	2472	msiexec.exe
Token: SeProfSingleProcessPrivilege	2472	msiexec.exe
Token: SeIncBasePriorityPrivilege	2472	msiexec.exe
Token: SeCreatePagefilePrivilege	2472	msiexec.exe
Token: SeCreatePermanentPrivilege	2472	msiexec.exe
Token: SeBackupPrivilege	2472	msiexec.exe
Token: SeRestorePrivilege	2472	msiexec.exe
Token: SeShutdownPrivilege	2472	msiexec.exe
Token: SeDebugPrivilege	2472	msiexec.exe
Token: SeAuditPrivilege	2472	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2472	msiexec.exe
Token: SeChangeNotifyPrivilege	2472	msiexec.exe
Token: SeRemoteShutdownPrivilege	2472	msiexec.exe
Token: SeUndockPrivilege	2472	msiexec.exe
Token: SeSyncAgentPrivilege	2472	msiexec.exe
Token: SeEnableDelegationPrivilege	2472	msiexec.exe
Token: SeManageVolumePrivilege	2472	msiexec.exe
Token: SeImpersonatePrivilege	2472	msiexec.exe
Token: SeCreateGlobalPrivilege	2472	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2472	msiexec.exe
2472	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ver2022s\Ver2022S_i386.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2472

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x000001F8E5DC0000-0x000001F8E5E96000-memory.dmp

Download

memory/2472-2-0x000001F8E5DC0000-0x000001F8E5E96000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads