0465a93456c6e13333344eec1bae15c6b86992acf7874768464ca12e47e2283b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ver2022s/Ver2022S_ia64.msi
Size 128KB
Sample260422-phlqlsbs3w
SHA256 0465a93456c6e13333344eec1bae15c6b86992acf7874768464ca12e47e2283b
MD5 3d1e0a9585f45413e5536d6bcd31eefa
SHA1 33a8bcbcaadc0f40e2ef7e63d05f1fa73752114d
SHA512 64d027cae49166e356f2a586876dc2e0dadbdc50ee2f74a161c5895cac54d2f3128aa75c4147129d49d2e6aa00f71dfa9656eb86280df618c05fdf8c0ce0ddb0
SSDEEP 1536:qx8fEfvIjL0vog+VXJ3lIMW10i2AinCNu0Vd:kjXIn0vogCPIMViB
TLSH
T107D35C1777048333D5C20232452FD7E29F3A9CA84B724613A19EB26D2CB2BD4E6B76D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3956	msiexec.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	3448	msiexec.exe
Token: SeCreateTokenPrivilege	3956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3956	msiexec.exe
Token: SeLockMemoryPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeMachineAccountPrivilege	3956	msiexec.exe
Token: SeTcbPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeLoadDriverPrivilege	3956	msiexec.exe
Token: SeSystemProfilePrivilege	3956	msiexec.exe
Token: SeSystemtimePrivilege	3956	msiexec.exe
Token: SeProfSingleProcessPrivilege	3956	msiexec.exe
Token: SeIncBasePriorityPrivilege	3956	msiexec.exe
Token: SeCreatePagefilePrivilege	3956	msiexec.exe
Token: SeCreatePermanentPrivilege	3956	msiexec.exe
Token: SeBackupPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeDebugPrivilege	3956	msiexec.exe
Token: SeAuditPrivilege	3956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3956	msiexec.exe
Token: SeChangeNotifyPrivilege	3956	msiexec.exe
Token: SeRemoteShutdownPrivilege	3956	msiexec.exe
Token: SeUndockPrivilege	3956	msiexec.exe
Token: SeSyncAgentPrivilege	3956	msiexec.exe
Token: SeEnableDelegationPrivilege	3956	msiexec.exe
Token: SeManageVolumePrivilege	3956	msiexec.exe
Token: SeImpersonatePrivilege	3956	msiexec.exe
Token: SeCreateGlobalPrivilege	3956	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3956	msiexec.exe
3956	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ver2022s\Ver2022S_ia64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3448-1-0x0000028380EF0000-0x000002838101A000-memory.dmp

Download

memory/3448-7-0x0000028380EF0000-0x000002838101A000-memory.dmp

Download

memory/3956-0-0x0000021612220000-0x000002161234A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads