Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
- Size 2.6MB
- Sample260422-pp46jae18j
- SHA256 aa8e23e6d0c01612756a148417f7fe1d344ab07f0106aedebe9ac776e61f043e
- MD5 043abaacbcde9065399cfd9ba085b6d6
- SHA1 45d72174e52ef9a756e4edee80bb273264b4716f
- SHA512 75a23fca283d53a40474bf5b50e3807700adbe60957c369fc36a44db4c57a843b04f3cef2ba2dfe9a5da9ce46792fc5f0439698a705760711e4cb8d546bc5e4d
- SSDEEP 49152:RTqHeX22PStNqf3gSoZJlR8YyCzP8Kr5hkczq2lKVG5P5wVVwsx33ijLXLYUvEJJ:4g2vFS8JlR8YyCzP8Kr5hkczq2lKVG5I
- TLSH T135D5D02273C5C37AD4A60E76986E41B11B76BC316B3546CF7358F23E08725A0867AF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3452 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 5076 msiexec.exe 6 5076 msiexec.exe 8 5076 msiexec.exe 10 5076 msiexec.exe 14 5076 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5076 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 4496 msiexec.exe Token: SeCreateTokenPrivilege 5076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5076 msiexec.exe Token: SeLockMemoryPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeMachineAccountPrivilege 5076 msiexec.exe Token: SeTcbPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 5076 msiexec.exe Token: SeTakeOwnershipPrivilege 5076 msiexec.exe Token: SeLoadDriverPrivilege 5076 msiexec.exe Token: SeSystemProfilePrivilege 5076 msiexec.exe Token: SeSystemtimePrivilege 5076 msiexec.exe Token: SeProfSingleProcessPrivilege 5076 msiexec.exe Token: SeIncBasePriorityPrivilege 5076 msiexec.exe Token: SeCreatePagefilePrivilege 5076 msiexec.exe Token: SeCreatePermanentPrivilege 5076 msiexec.exe Token: SeBackupPrivilege 5076 msiexec.exe Token: SeRestorePrivilege 5076 msiexec.exe Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeDebugPrivilege 5076 msiexec.exe Token: SeAuditPrivilege 5076 msiexec.exe Token: SeSystemEnvironmentPrivilege 5076 msiexec.exe Token: SeChangeNotifyPrivilege 5076 msiexec.exe Token: SeRemoteShutdownPrivilege 5076 msiexec.exe Token: SeUndockPrivilege 5076 msiexec.exe Token: SeSyncAgentPrivilege 5076 msiexec.exe Token: SeEnableDelegationPrivilege 5076 msiexec.exe Token: SeManageVolumePrivilege 5076 msiexec.exe Token: SeImpersonatePrivilege 5076 msiexec.exe Token: SeCreateGlobalPrivilege 5076 msiexec.exe Token: SeCreateTokenPrivilege 5076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5076 msiexec.exe Token: SeLockMemoryPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeMachineAccountPrivilege 5076 msiexec.exe Token: SeTcbPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 5076 msiexec.exe Token: SeTakeOwnershipPrivilege 5076 msiexec.exe Token: SeLoadDriverPrivilege 5076 msiexec.exe Token: SeSystemProfilePrivilege 5076 msiexec.exe Token: SeSystemtimePrivilege 5076 msiexec.exe Token: SeProfSingleProcessPrivilege 5076 msiexec.exe Token: SeIncBasePriorityPrivilege 5076 msiexec.exe Token: SeCreatePagefilePrivilege 5076 msiexec.exe Token: SeCreatePermanentPrivilege 5076 msiexec.exe Token: SeBackupPrivilege 5076 msiexec.exe Token: SeRestorePrivilege 5076 msiexec.exe Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeDebugPrivilege 5076 msiexec.exe Token: SeAuditPrivilege 5076 msiexec.exe Token: SeSystemEnvironmentPrivilege 5076 msiexec.exe Token: SeChangeNotifyPrivilege 5076 msiexec.exe Token: SeRemoteShutdownPrivilege 5076 msiexec.exe Token: SeUndockPrivilege 5076 msiexec.exe Token: SeSyncAgentPrivilege 5076 msiexec.exe Token: SeEnableDelegationPrivilege 5076 msiexec.exe Token: SeManageVolumePrivilege 5076 msiexec.exe Token: SeImpersonatePrivilege 5076 msiexec.exe Token: SeCreateGlobalPrivilege 5076 msiexec.exe Token: SeCreateTokenPrivilege 5076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5076 msiexec.exe Token: SeLockMemoryPrivilege 5076 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5076 msiexec.exe 5076 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4496 wrote to memory of 3452 4496 msiexec.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\IDGo800_Minidriver_v129\IDGo800_Minidriver_32.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 514E7E5B64DFE2EB5CC3E308E1A8937B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIBAFE.tmp
- Size 141KB
- SHA256 4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
- MD5 edb88affffd67bca3523b41d3e2e4810
- SHA1 0055b93907665fed56d22a7614a581a87d060ead
- SHA512 2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf
- SSDEEP 3072:Biaf8jGZY0WHkCKblNnRNE/I6CQQAMllgKtf5nY+M:L8jWY0WTcRNEw5QQpX9m
- TLSH T138E359117BE0C032E4AA2938193597755A3FB930AF74C6CB77650A6E4E70BD19E3A307
- MD5 SHA1 SHA512 SSDEEP TLSH