Resubmissions
13/05/2026, 16:24
260513-twvmwsgt4m30/04/2026, 05:11
260430-fvp45aex2m630/04/2026, 04:47
260430-fehecaew6k4Analysis
- user interaction
yes - max time kernel
898s - max time network
404s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
30/04/2026, 04:47
General
- Target MSI Center_2.0.69.0.exe
- Size 538.5MB
- Sample260430-fehecaew6k
- SHA256 4cd13415c781867625932228d072c94dd215b2af7e02a4e173fe64ea29bd7989
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MSI Center_2.0.69.0.exe"C:\Users\Admin\AppData\Local\Temp\MSI Center_2.0.69.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UG071.tmp\MSI Center_2.0.69.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-UG071.tmp\MSI Center_2.0.69.0.tmp" /SL5="$50270,564071023,140800,C:\Users\Admin\AppData\Local\Temp\MSI Center_2.0.69.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im DCv2.exe /t3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSI Center_2.0.69.0.tmp
memory/1424-24-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-141-0x0000000000C50000-0x0000000001252000-memory.dmp
memory/1424-7-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-257-0x0000000000C50000-0x0000000001252000-memory.dmp
memory/1424-13-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-160-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-16-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-156-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-152-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-25-0x0000000000C50000-0x0000000001252000-memory.dmp
memory/1424-12-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-28-0x0000000000400000-0x0000000000577000-memory.dmp
memory/1424-17-0x0000000000C50000-0x0000000001252000-memory.dmp
memory/3056-135-0x0000000002350000-0x0000000002952000-memory.dmp
memory/3056-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/3056-15-0x0000000002350000-0x0000000002952000-memory.dmp
memory/3056-14-0x0000000000400000-0x000000000042D000-memory.dmp
memory/3056-255-0x0000000002350000-0x0000000002952000-memory.dmp
memory/3056-0-0x0000000000400000-0x000000000042D000-memory.dmp