Analysis
- max time kernel
149s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target IDGo800_Minidriver_v129/IDGo800_Minidriver_32.msi
- Size 2.6MB
- Sample260422-pp46jae18j
- SHA256 aa8e23e6d0c01612756a148417f7fe1d344ab07f0106aedebe9ac776e61f043e
- MD5 043abaacbcde9065399cfd9ba085b6d6
- SHA1 45d72174e52ef9a756e4edee80bb273264b4716f
- SHA512 75a23fca283d53a40474bf5b50e3807700adbe60957c369fc36a44db4c57a843b04f3cef2ba2dfe9a5da9ce46792fc5f0439698a705760711e4cb8d546bc5e4d
- SSDEEP 49152:RTqHeX22PStNqf3gSoZJlR8YyCzP8Kr5hkczq2lKVG5P5wVVwsx33ijLXLYUvEJJ:4g2vFS8JlR8YyCzP8Kr5hkczq2lKVG5I
- TLSH T135D5D02273C5C37AD4A60E76986E41B11B76BC316B3546CF7358F23E08725A0867AF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2904 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3476 msiexec.exe 3 3476 msiexec.exe 4 3476 msiexec.exe 5 3476 msiexec.exe 6 3476 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3476 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3476 msiexec.exe Token: SeIncreaseQuotaPrivilege 3476 msiexec.exe Token: SeSecurityPrivilege 4644 msiexec.exe Token: SeCreateTokenPrivilege 3476 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3476 msiexec.exe Token: SeLockMemoryPrivilege 3476 msiexec.exe Token: SeIncreaseQuotaPrivilege 3476 msiexec.exe Token: SeMachineAccountPrivilege 3476 msiexec.exe Token: SeTcbPrivilege 3476 msiexec.exe Token: SeSecurityPrivilege 3476 msiexec.exe Token: SeTakeOwnershipPrivilege 3476 msiexec.exe Token: SeLoadDriverPrivilege 3476 msiexec.exe Token: SeSystemProfilePrivilege 3476 msiexec.exe Token: SeSystemtimePrivilege 3476 msiexec.exe Token: SeProfSingleProcessPrivilege 3476 msiexec.exe Token: SeIncBasePriorityPrivilege 3476 msiexec.exe Token: SeCreatePagefilePrivilege 3476 msiexec.exe Token: SeCreatePermanentPrivilege 3476 msiexec.exe Token: SeBackupPrivilege 3476 msiexec.exe Token: SeRestorePrivilege 3476 msiexec.exe Token: SeShutdownPrivilege 3476 msiexec.exe Token: SeDebugPrivilege 3476 msiexec.exe Token: SeAuditPrivilege 3476 msiexec.exe Token: SeSystemEnvironmentPrivilege 3476 msiexec.exe Token: SeChangeNotifyPrivilege 3476 msiexec.exe Token: SeRemoteShutdownPrivilege 3476 msiexec.exe Token: SeUndockPrivilege 3476 msiexec.exe Token: SeSyncAgentPrivilege 3476 msiexec.exe Token: SeEnableDelegationPrivilege 3476 msiexec.exe Token: SeManageVolumePrivilege 3476 msiexec.exe Token: SeImpersonatePrivilege 3476 msiexec.exe Token: SeCreateGlobalPrivilege 3476 msiexec.exe Token: SeCreateTokenPrivilege 3476 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3476 msiexec.exe Token: SeLockMemoryPrivilege 3476 msiexec.exe Token: SeIncreaseQuotaPrivilege 3476 msiexec.exe Token: SeMachineAccountPrivilege 3476 msiexec.exe Token: SeTcbPrivilege 3476 msiexec.exe Token: SeSecurityPrivilege 3476 msiexec.exe Token: SeTakeOwnershipPrivilege 3476 msiexec.exe Token: SeLoadDriverPrivilege 3476 msiexec.exe Token: SeSystemProfilePrivilege 3476 msiexec.exe Token: SeSystemtimePrivilege 3476 msiexec.exe Token: SeProfSingleProcessPrivilege 3476 msiexec.exe Token: SeIncBasePriorityPrivilege 3476 msiexec.exe Token: SeCreatePagefilePrivilege 3476 msiexec.exe Token: SeCreatePermanentPrivilege 3476 msiexec.exe Token: SeBackupPrivilege 3476 msiexec.exe Token: SeRestorePrivilege 3476 msiexec.exe Token: SeShutdownPrivilege 3476 msiexec.exe Token: SeDebugPrivilege 3476 msiexec.exe Token: SeAuditPrivilege 3476 msiexec.exe Token: SeSystemEnvironmentPrivilege 3476 msiexec.exe Token: SeChangeNotifyPrivilege 3476 msiexec.exe Token: SeRemoteShutdownPrivilege 3476 msiexec.exe Token: SeUndockPrivilege 3476 msiexec.exe Token: SeSyncAgentPrivilege 3476 msiexec.exe Token: SeEnableDelegationPrivilege 3476 msiexec.exe Token: SeManageVolumePrivilege 3476 msiexec.exe Token: SeImpersonatePrivilege 3476 msiexec.exe Token: SeCreateGlobalPrivilege 3476 msiexec.exe Token: SeCreateTokenPrivilege 3476 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3476 msiexec.exe Token: SeLockMemoryPrivilege 3476 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3476 msiexec.exe 3476 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4644 wrote to memory of 2904 4644 msiexec.exe 80
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\IDGo800_Minidriver_v129\IDGo800_Minidriver_32.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3476
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6DAE7AEB60856F0D66053E0DA2D35ED5 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2904
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIF8A8.tmp
- Size 141KB
- SHA256 4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
- MD5 edb88affffd67bca3523b41d3e2e4810
- SHA1 0055b93907665fed56d22a7614a581a87d060ead
- SHA512 2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf
- SSDEEP 3072:Biaf8jGZY0WHkCKblNnRNE/I6CQQAMllgKtf5nY+M:L8jWY0WTcRNEw5QQpX9m
- TLSH T138E359117BE0C032E4AA2938193597755A3FB930AF74C6CB77650A6E4E70BD19E3A307
- MD5 SHA1 SHA512 SSDEEP TLSH