Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AdobeView-IN0287469283898.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdobeView-IN0287469283898.msi
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target AdobeView-IN0287469283898.msi
- Size 2.1MB
- Sample260517-ajnt2aev6q
- SHA256 043f65eccbb65c124aa43350b224be4d5448877aed8febe3e73fa1ba17399913
- MD5 75fb680ff24dc4a989fbb08285f22b5d
- SHA1 b58d5c856f293da5c19423d614755cdcab094e02
- SHA512 11c7908f6b8a3ca5e1b0157faee814941e1e631a0f547adffca6a0d55844b33a87841e1e7d9b89706814f50f5fb9caca659cb0cf7fb3a06b2ef7b7c1f3dc8c04
- SSDEEP 49152:6HHZLDQQRT1ilWE2ZxdMtpQZoYsXQ6OuqcNRj5BpXgGwpx1Gbm3:SL8s1SWEYdKSsXQ6YQR6GmbGbm
- TLSH T1D7A51226AD72356AD3C2C33C50A752B1DB72BC1087811697B10F72841EBF3966EBEB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1712 created 1348 1712 MsiExec.exe 52 - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 1 IoCs
pid Process 1712 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1712 MsiExec.exe 1712 MsiExec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e580c40.msi msiexec.exe File opened for modification C:\Windows\Installer\e580c40.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICBD.tmp msiexec.exe File created C:\Windows\Installer\MSICBD.dat MsiExec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e580c44.msi msiexec.exe File created C:\Windows\Installer\SourceHash{B8968A94-5E57-4AF1-A83D-CB2E4B06E2C0} msiexec.exe File opened for modification C:\Windows\Installer\MSI121D.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4636 msiexec.exe - Program crash 1 IoCs
pid pid_target Process 3112 3475 WerFault.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1736 timeout.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\CloudStore\\clstorprv.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\CredentialManager\\credprv.dll" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe 1712 MsiExec.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1712 MsiExec.exe 1712 MsiExec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1712 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 3328 msiexec.exe Token: SeCreateTokenPrivilege 4636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4636 msiexec.exe Token: SeLockMemoryPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeMachineAccountPrivilege 4636 msiexec.exe Token: SeTcbPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeLoadDriverPrivilege 4636 msiexec.exe Token: SeSystemProfilePrivilege 4636 msiexec.exe Token: SeSystemtimePrivilege 4636 msiexec.exe Token: SeProfSingleProcessPrivilege 4636 msiexec.exe Token: SeIncBasePriorityPrivilege 4636 msiexec.exe Token: SeCreatePagefilePrivilege 4636 msiexec.exe Token: SeCreatePermanentPrivilege 4636 msiexec.exe Token: SeBackupPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeDebugPrivilege 4636 msiexec.exe Token: SeAuditPrivilege 4636 msiexec.exe Token: SeSystemEnvironmentPrivilege 4636 msiexec.exe Token: SeChangeNotifyPrivilege 4636 msiexec.exe Token: SeRemoteShutdownPrivilege 4636 msiexec.exe Token: SeUndockPrivilege 4636 msiexec.exe Token: SeSyncAgentPrivilege 4636 msiexec.exe Token: SeEnableDelegationPrivilege 4636 msiexec.exe Token: SeManageVolumePrivilege 4636 msiexec.exe Token: SeImpersonatePrivilege 4636 msiexec.exe Token: SeCreateGlobalPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe Token: SeRestorePrivilege 3328 msiexec.exe Token: SeTakeOwnershipPrivilege 3328 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4636 msiexec.exe 4636 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3328 wrote to memory of 1712 3328 msiexec.exe 89 PID 1712 wrote to memory of 3112 1712 MsiExec.exe 90 PID 4536 wrote to memory of 820 4536 ComputerDefaults.exe 93 PID 820 wrote to memory of 368 820 conhost.exe 94 PID 368 wrote to memory of 1736 368 cmd.exe 95 PID 368 wrote to memory of 2644 368 cmd.exe 96
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1348
-
C:\Windows\System32\WerFault.exeC:\Windows\System32\WerFault.exe -u -p 3475 -s 22⤵
- Program crash
PID:3112 -
C:\Windows\System32\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\system32\conhost.exe"conhost.exe" --headless "C:\Users\Admin\AppData\Local\Temp\da97bd19.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\da97bd19.bat5⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak6⤵
- Delays execution with timeout.exe
PID:1736
-
-
C:\Windows\System32\WerFault.exe"C:\Windows\System32\WerFault.exe"6⤵PID:2644
-
-
-
-
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AdobeView-IN0287469283898.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4636
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0B2AA6E18220D0FB80CB5DB83D4800872⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1712
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e580c43.rbs
- Size 8KB
- SHA256 56fba81f3bc439efc6606371db6ea1b143151b5d7a5ed236f1aee39bb4134451
- MD5 b96ab266b840482c8898b1158fa0a98f
- SHA1 00391947e74e697858a0451f7b457498a31048a5
- SHA512 1f3eb418b8bbf00b83c1b3d9d6e37f6e514f668919fa936646f9e8d110ea20bc486a1c12ca41592fd4ce0e1f2bb716ec0fdebad6a28f2ad64256a719bf26c2ed
- SSDEEP 96:tl8VKJky8bDw17nJeLPkmkxmBvUgReD2sVCOThq3UgReD2sVCgjbVmCmcT80Thqa:tyfMJeRcZoGnZo+mQlkWPjpKe
- TLSH T1A1024341B710D2D2E6A65735DA4B27553BB3C2EAC351E3D744CE98240F23B8ADF69183
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICBD.tmp
- Size 425KB
- SHA256 faae1e5061a8b019f25f400737c4963b835af5d795760ae34faf31bbaa4c06b4
- MD5 aa1c5fb850f8d4908d84be54e262d6ac
- SHA1 72025b274c0c567070dcd35019b884adc37a8480
- SHA512 c16959ac19606c5843345c013024da545d979f9f9eae7d2722684f97f9ac6caabfe5c1d0f10429b54f1973d716273c1514024092968475baf0778cfaacdeb437
- SSDEEP 12288:PkHyw+71D+xE+ymDDBSC3Rkw1iECh+Ac2Z0hCs:PkHH+4xJyEDBSQRT1iE
- TLSH T14F948C5A9D72306ED3D1C33CA0A74271DB767811878117A7B20B42841EDF39ABEBEB51
- MD5 SHA1 SHA512 SSDEEP TLSH