Overview
overview
7Static
static
3Elcomsoft ...on.rar
windows10-2004-x64
1Elcomsoft ...on.rar
windows11-21h2-x64
1Elcomsoft ...Me.txt
windows10-2004-x64
1Elcomsoft ...Me.txt
windows11-21h2-x64
3Elcomsoft ...ml.dll
windows10-2004-x64
3Elcomsoft ...ml.dll
windows11-21h2-x64
3Elcomsoft ...ne.dll
windows10-2004-x64
3Elcomsoft ...ne.dll
windows11-21h2-x64
3Elcomsoft ...en.msi
windows10-2004-x64
7Elcomsoft ...en.msi
windows11-21h2-x64
7Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition.rar
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition.rar
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/ReadMe.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/ReadMe.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/Registration_Modules/elcom_xml.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/Registration_Modules/elcom_xml.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/Registration_Modules/onlyone.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/Registration_Modules/onlyone.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/archpr_setup_en.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/archpr_setup_en.msi
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition/archpr_setup_en.msi
- Size 36.7MB
- Sample260511-b2bg4acy3m
- SHA256 2c221ef570ef4dd2741a5ceba1d61ee8624f772130db9bfe600872b452a2f157
- MD5 f414795976e22fa3214eb2ddcff1b13e
- SHA1 420bf07b1c69b759cc574e8d172a35390a8e83e7
- SHA512 be224c80e8f10cd2c1dd08b38ff42a44daa6c0af05b2cf8d79651876e5fd872792e2dc27eab12ffc107094d245c0956ac57a97f2d365e88cd23cc11fdf9e2fa2
- SSDEEP 786432:oigB3zNmbGJQ4ExcGBuIq0y/zCquOnuxXuTqftQYKajXPiQoN+SfaZc2VJ:QBjNmaEeGBuInyWBJXuOFrmQoNHfaZc
- TLSH T1D1873353A651C274E9920934C627EEF063BAAD35C79054BB2A40FDC43E366D0A737B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4144 MsiExec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 4944 msiexec.exe 9 4944 msiexec.exe 11 4944 msiexec.exe 13 4944 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4944 msiexec.exe Token: SeIncreaseQuotaPrivilege 4944 msiexec.exe Token: SeSecurityPrivilege 1664 msiexec.exe Token: SeCreateTokenPrivilege 4944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4944 msiexec.exe Token: SeLockMemoryPrivilege 4944 msiexec.exe Token: SeIncreaseQuotaPrivilege 4944 msiexec.exe Token: SeMachineAccountPrivilege 4944 msiexec.exe Token: SeTcbPrivilege 4944 msiexec.exe Token: SeSecurityPrivilege 4944 msiexec.exe Token: SeTakeOwnershipPrivilege 4944 msiexec.exe Token: SeLoadDriverPrivilege 4944 msiexec.exe Token: SeSystemProfilePrivilege 4944 msiexec.exe Token: SeSystemtimePrivilege 4944 msiexec.exe Token: SeProfSingleProcessPrivilege 4944 msiexec.exe Token: SeIncBasePriorityPrivilege 4944 msiexec.exe Token: SeCreatePagefilePrivilege 4944 msiexec.exe Token: SeCreatePermanentPrivilege 4944 msiexec.exe Token: SeBackupPrivilege 4944 msiexec.exe Token: SeRestorePrivilege 4944 msiexec.exe Token: SeShutdownPrivilege 4944 msiexec.exe Token: SeDebugPrivilege 4944 msiexec.exe Token: SeAuditPrivilege 4944 msiexec.exe Token: SeSystemEnvironmentPrivilege 4944 msiexec.exe Token: SeChangeNotifyPrivilege 4944 msiexec.exe Token: SeRemoteShutdownPrivilege 4944 msiexec.exe Token: SeUndockPrivilege 4944 msiexec.exe Token: SeSyncAgentPrivilege 4944 msiexec.exe Token: SeEnableDelegationPrivilege 4944 msiexec.exe Token: SeManageVolumePrivilege 4944 msiexec.exe Token: SeImpersonatePrivilege 4944 msiexec.exe Token: SeCreateGlobalPrivilege 4944 msiexec.exe Token: SeCreateTokenPrivilege 4944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4944 msiexec.exe Token: SeLockMemoryPrivilege 4944 msiexec.exe Token: SeIncreaseQuotaPrivilege 4944 msiexec.exe Token: SeMachineAccountPrivilege 4944 msiexec.exe Token: SeTcbPrivilege 4944 msiexec.exe Token: SeSecurityPrivilege 4944 msiexec.exe Token: SeTakeOwnershipPrivilege 4944 msiexec.exe Token: SeLoadDriverPrivilege 4944 msiexec.exe Token: SeSystemProfilePrivilege 4944 msiexec.exe Token: SeSystemtimePrivilege 4944 msiexec.exe Token: SeProfSingleProcessPrivilege 4944 msiexec.exe Token: SeIncBasePriorityPrivilege 4944 msiexec.exe Token: SeCreatePagefilePrivilege 4944 msiexec.exe Token: SeCreatePermanentPrivilege 4944 msiexec.exe Token: SeBackupPrivilege 4944 msiexec.exe Token: SeRestorePrivilege 4944 msiexec.exe Token: SeShutdownPrivilege 4944 msiexec.exe Token: SeDebugPrivilege 4944 msiexec.exe Token: SeAuditPrivilege 4944 msiexec.exe Token: SeSystemEnvironmentPrivilege 4944 msiexec.exe Token: SeChangeNotifyPrivilege 4944 msiexec.exe Token: SeRemoteShutdownPrivilege 4944 msiexec.exe Token: SeUndockPrivilege 4944 msiexec.exe Token: SeSyncAgentPrivilege 4944 msiexec.exe Token: SeEnableDelegationPrivilege 4944 msiexec.exe Token: SeManageVolumePrivilege 4944 msiexec.exe Token: SeImpersonatePrivilege 4944 msiexec.exe Token: SeCreateGlobalPrivilege 4944 msiexec.exe Token: SeCreateTokenPrivilege 4944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4944 msiexec.exe Token: SeLockMemoryPrivilege 4944 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4944 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1664 wrote to memory of 4144 1664 msiexec.exe 87
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Elcomsoft Advanced Archive Password Recovery v4.66.266 Enterprise Edition\archpr_setup_en.msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 917459A87DF8DFA0FBC3D45F33EC8092 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4144
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIC02E.tmp
- Size 114KB
- SHA256 880250537de4bae83d9be495664b982d87b3e3b281a34f349b031a956f75c132
- MD5 a2c572fe4450f94d5ced16fc6fe30410
- SHA1 83921e50829901a6709fd41f2553974d476af373
- SHA512 d6eca983653d2b3b5bf79af5d3f15ba1b34151eb6f6663e428db03a86695553fc7fe0f44eab4bd96223368e3a6633ac6b581271937079b34bd78f2ac3f768deb
- SSDEEP 3072:j/v5nsrtaPLRsn909A+oKeKP62Q1IIII74N5lG3vMvNK:rSrtN9tKeKPs1IIII+G3UE
- TLSH T121B37C11B580C432E09914BE815AC7728F3A79715BB898C3FFD159AA8F613D2EB3534B
- MD5 SHA1 SHA512 SSDEEP TLSH