Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
InneaBACnetExplorerFESetup.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
InneaBACnetExplorerFESetup.msi
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target InneaBACnetExplorerFESetup.msi
- Size 9.8MB
- Sample260507-pf13hsdv2w
- SHA256 76e499de12a59bafcecda200d59d01bd80ad99cdfb040d94ad587c771ddeef46
- MD5 cb5737178357cb4c39b6bdf6d2ac55d1
- SHA1 76730142249f78b2e6d1d160bb93fbf41ab56178
- SHA512 8bf7a49774944e6ea434ba861f16ac93957ed2ae16ddbd19c94e1a8e59a8f3b1c31ecd0a390d5bf4b7c1654a1c95f5a6235d2e76d68c8f53f71b800ec526ada4
- SSDEEP 196608:eTzQvZ4uG0bdpTE8HYMq/IULEVlgdh5DEFEuzaPimh356q6gEp3aIp:OzADbdpT9PWvEV+142uzaPiySkI
- TLSH T1C5A62306F9EDA937D52362302F8001368B6AAE790B3B80F9FC5571465779960CFB7B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
pid Process 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe 892 MsiExec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6072 msiexec.exe 3 6072 msiexec.exe 4 6072 msiexec.exe 5 6072 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6072 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 6072 msiexec.exe Token: SeIncreaseQuotaPrivilege 6072 msiexec.exe Token: SeSecurityPrivilege 1788 msiexec.exe Token: SeCreateTokenPrivilege 6072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6072 msiexec.exe Token: SeLockMemoryPrivilege 6072 msiexec.exe Token: SeIncreaseQuotaPrivilege 6072 msiexec.exe Token: SeMachineAccountPrivilege 6072 msiexec.exe Token: SeTcbPrivilege 6072 msiexec.exe Token: SeSecurityPrivilege 6072 msiexec.exe Token: SeTakeOwnershipPrivilege 6072 msiexec.exe Token: SeLoadDriverPrivilege 6072 msiexec.exe Token: SeSystemProfilePrivilege 6072 msiexec.exe Token: SeSystemtimePrivilege 6072 msiexec.exe Token: SeProfSingleProcessPrivilege 6072 msiexec.exe Token: SeIncBasePriorityPrivilege 6072 msiexec.exe Token: SeCreatePagefilePrivilege 6072 msiexec.exe Token: SeCreatePermanentPrivilege 6072 msiexec.exe Token: SeBackupPrivilege 6072 msiexec.exe Token: SeRestorePrivilege 6072 msiexec.exe Token: SeShutdownPrivilege 6072 msiexec.exe Token: SeDebugPrivilege 6072 msiexec.exe Token: SeAuditPrivilege 6072 msiexec.exe Token: SeSystemEnvironmentPrivilege 6072 msiexec.exe Token: SeChangeNotifyPrivilege 6072 msiexec.exe Token: SeRemoteShutdownPrivilege 6072 msiexec.exe Token: SeUndockPrivilege 6072 msiexec.exe Token: SeSyncAgentPrivilege 6072 msiexec.exe Token: SeEnableDelegationPrivilege 6072 msiexec.exe Token: SeManageVolumePrivilege 6072 msiexec.exe Token: SeImpersonatePrivilege 6072 msiexec.exe Token: SeCreateGlobalPrivilege 6072 msiexec.exe Token: SeCreateTokenPrivilege 6072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6072 msiexec.exe Token: SeLockMemoryPrivilege 6072 msiexec.exe Token: SeIncreaseQuotaPrivilege 6072 msiexec.exe Token: SeMachineAccountPrivilege 6072 msiexec.exe Token: SeTcbPrivilege 6072 msiexec.exe Token: SeSecurityPrivilege 6072 msiexec.exe Token: SeTakeOwnershipPrivilege 6072 msiexec.exe Token: SeLoadDriverPrivilege 6072 msiexec.exe Token: SeSystemProfilePrivilege 6072 msiexec.exe Token: SeSystemtimePrivilege 6072 msiexec.exe Token: SeProfSingleProcessPrivilege 6072 msiexec.exe Token: SeIncBasePriorityPrivilege 6072 msiexec.exe Token: SeCreatePagefilePrivilege 6072 msiexec.exe Token: SeCreatePermanentPrivilege 6072 msiexec.exe Token: SeBackupPrivilege 6072 msiexec.exe Token: SeRestorePrivilege 6072 msiexec.exe Token: SeShutdownPrivilege 6072 msiexec.exe Token: SeDebugPrivilege 6072 msiexec.exe Token: SeAuditPrivilege 6072 msiexec.exe Token: SeSystemEnvironmentPrivilege 6072 msiexec.exe Token: SeChangeNotifyPrivilege 6072 msiexec.exe Token: SeRemoteShutdownPrivilege 6072 msiexec.exe Token: SeUndockPrivilege 6072 msiexec.exe Token: SeSyncAgentPrivilege 6072 msiexec.exe Token: SeEnableDelegationPrivilege 6072 msiexec.exe Token: SeManageVolumePrivilege 6072 msiexec.exe Token: SeImpersonatePrivilege 6072 msiexec.exe Token: SeCreateGlobalPrivilege 6072 msiexec.exe Token: SeCreateTokenPrivilege 6072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6072 msiexec.exe Token: SeLockMemoryPrivilege 6072 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 6072 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1788 wrote to memory of 892 1788 msiexec.exe 80
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\InneaBACnetExplorerFESetup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6072
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8C1A00BE7054C1DA2EA1D1C4C316E014 U2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:892
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI25226\EmbeddedUI.config
- Size 980B
- SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
- MD5 c9c40af1656f8531eaa647caceb1e436
- SHA1 907837497508de13d5a7e60697fc9d050e327e19
- SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
- TLSH T1E2111C2C85E4F92B9A325A533A208896EFB0A1B2A174510CB09FBA170F720CE8257325
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI25226\InneaBACnetExplorerSetup.exe
- Size 79KB
- SHA256 625d998bc99fbdbd0149ed7f0cc116582f8c271960dd854a986e147b9367c34d
- MD5 3136536f5991b06d9d0507a234be0d9d
- SHA1 5567c8ae1494e257c041f771a19d5f28993e012d
- SHA512 0851447e31b874336d737753e927073984fa87a1ee7db45f4f287ccb176b45809048a2471d503f806f2586043d1c4eb0fbfc2ce4b019f592a1cd1f3dfee5f10e
- SSDEEP 1536:+gfcpxKe3xybhlcE3jGn3b8EGQ1BcfyaiJA85y8527MoyF8bf:3ExKey3jQ9GQIynA8c8527jN
- TLSH T11483B30033BD5E27E5FE5AF92A7124410BF5F65E6516F7DC8CCA21DE21E2F004A90AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI25226\Microsoft.Deployment.WindowsInstaller.dll
- Size 179KB
- SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
- MD5 1a5caea6734fdd07caa514c3f3fb75da
- SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
- SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
- SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
- TLSH T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI25226\WixSharp.UI.CA.dll
- Size 739KB
- SHA256 f9123c171ab7d4d222b0016e54b8056d991c26ae8614fceb371445b52cab8fc1
- MD5 037fcbcc077f72f456b82d83cfb44af8
- SHA1 8a21b283ae280e9650607a25719991b41c857f62
- SHA512 a1137627798db3f8b6eeac5f6bdc48e4473d3ae65b8467125b1f8e73470472ffb1b0f0146e5eac3f8e90596d72eaf8bdc91c88787c823d9f7cd179367a427753
- SSDEEP 12288:unBaimuFjoBUQlU+6CGl5oMKm4kmCwASFDhyU7H5wXnsBSBs9c/XYF0LTbYbSBqG:MGLBRalCMz4km3gUlwXGSBUn2/bYbSBh
- TLSH T1E8F41211B6998033E5BB173C0934E6604C7FBE609FB0C99F6788952A4E706D19B15FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI25226\WixSharp.UI.dll
- Size 239KB
- SHA256 5bf6bc1eec23c4434c37e32707b138946106b8e702f98e1f9cae5e249da83863
- MD5 2ca4255418970b0f02f4195190913197
- SHA1 ba48f26fc7a05f5955c750d893c52903971579ae
- SHA512 e6abeb4ea2786e759d489b7961ca5721cdedfa3325d53ee0c4405570ac8d7d16ad9fa4c1e4be66911502ef776a20929747cecdcbdeff5030fd437fa2bf692f3d
- SSDEEP 3072:i5PZ2lRPtOkxcTr+b1GNRfDhuC/uCqplBb7/nSej8A07w:IKe/+bspP/uCqplBb7/nSej8A
- TLSH T17E34F909BBE85A2BCA67A1702F4100558762A26F473AC1F8FC5540DE92C6F11CEFBB57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI25226\WixSharp.dll
- Size 425KB
- SHA256 7eea616ea886145913c13d239f3e0ead58ace3a226e5aa330e67bbdd16673510
- MD5 ea800f52639d12279a3e602e43a07636
- SHA1 e997386cc618aed516169111ba3ca7ceae91783d
- SHA512 33d46c6980743eb319b74bf89c300c5b886a960c222efcb2e66339b4eb7467cbf6546deef28a34ab09c4ed2c170efe76f38e4bc724603485e5e776d8e0457ccf
- SSDEEP 6144:hAtMKl6H4MbBrKXWSVJdTc+ciJ/WE/OWBbFR5zqOy:aSKQ/FWXWAJxbtP/tFD
- TLSH T114943B012FFC9A24E2BF5BB8F8B1251A4776F8175472F70D5ACA64DD1E66B00B800B67
- MD5 SHA1 SHA512 SSDEEP TLSH