Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AdobeView-IN0287469283898.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdobeView-IN0287469283898.msi
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target AdobeView-IN0287469283898.msi
- Size 2.1MB
- Sample260517-ajnt2aev6q
- SHA256 043f65eccbb65c124aa43350b224be4d5448877aed8febe3e73fa1ba17399913
- MD5 75fb680ff24dc4a989fbb08285f22b5d
- SHA1 b58d5c856f293da5c19423d614755cdcab094e02
- SHA512 11c7908f6b8a3ca5e1b0157faee814941e1e631a0f547adffca6a0d55844b33a87841e1e7d9b89706814f50f5fb9caca659cb0cf7fb3a06b2ef7b7c1f3dc8c04
- SSDEEP 49152:6HHZLDQQRT1ilWE2ZxdMtpQZoYsXQ6OuqcNRj5BpXgGwpx1Gbm3:SL8s1SWEYdKSsXQ6YQR6GmbGbm
- TLSH T1D7A51226AD72356AD3C2C33C50A752B1DB72BC1087811697B10F72841EBF3966EBEB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1232 created 1020 1232 MsiExec.exe 52 - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 1 IoCs
pid Process 1232 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1232 MsiExec.exe 1232 MsiExec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIEF51.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF4D1.tmp msiexec.exe File created C:\Windows\Installer\e57eed8.msi msiexec.exe File created C:\Windows\Installer\MSIEF51.dat MsiExec.exe File created C:\Windows\SystemTemp\~DFF2F420030654A92C.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B8968A94-5E57-4AF1-A83D-CB2E4B06E2C0} msiexec.exe File created C:\Windows\SystemTemp\~DF795B53EB4A1D57C7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4BB36046345B2756.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF285BC69679733E62.TMP msiexec.exe File created C:\Windows\Installer\e57eed4.msi msiexec.exe File opened for modification C:\Windows\Installer\e57eed4.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3384 msiexec.exe - Program crash 1 IoCs
pid pid_target Process 1768 3475 WerFault.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\CloudStore\\clstorprv.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\CredentialManager\\credprv.dll" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1232 MsiExec.exe 1232 MsiExec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1232 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3384 msiexec.exe Token: SeIncreaseQuotaPrivilege 3384 msiexec.exe Token: SeSecurityPrivilege 2404 msiexec.exe Token: SeCreateTokenPrivilege 3384 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3384 msiexec.exe Token: SeLockMemoryPrivilege 3384 msiexec.exe Token: SeIncreaseQuotaPrivilege 3384 msiexec.exe Token: SeMachineAccountPrivilege 3384 msiexec.exe Token: SeTcbPrivilege 3384 msiexec.exe Token: SeSecurityPrivilege 3384 msiexec.exe Token: SeTakeOwnershipPrivilege 3384 msiexec.exe Token: SeLoadDriverPrivilege 3384 msiexec.exe Token: SeSystemProfilePrivilege 3384 msiexec.exe Token: SeSystemtimePrivilege 3384 msiexec.exe Token: SeProfSingleProcessPrivilege 3384 msiexec.exe Token: SeIncBasePriorityPrivilege 3384 msiexec.exe Token: SeCreatePagefilePrivilege 3384 msiexec.exe Token: SeCreatePermanentPrivilege 3384 msiexec.exe Token: SeBackupPrivilege 3384 msiexec.exe Token: SeRestorePrivilege 3384 msiexec.exe Token: SeShutdownPrivilege 3384 msiexec.exe Token: SeDebugPrivilege 3384 msiexec.exe Token: SeAuditPrivilege 3384 msiexec.exe Token: SeSystemEnvironmentPrivilege 3384 msiexec.exe Token: SeChangeNotifyPrivilege 3384 msiexec.exe Token: SeRemoteShutdownPrivilege 3384 msiexec.exe Token: SeUndockPrivilege 3384 msiexec.exe Token: SeSyncAgentPrivilege 3384 msiexec.exe Token: SeEnableDelegationPrivilege 3384 msiexec.exe Token: SeManageVolumePrivilege 3384 msiexec.exe Token: SeImpersonatePrivilege 3384 msiexec.exe Token: SeCreateGlobalPrivilege 3384 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe Token: SeRestorePrivilege 2404 msiexec.exe Token: SeTakeOwnershipPrivilege 2404 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3384 msiexec.exe 3384 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1232 2404 msiexec.exe 81 PID 1232 wrote to memory of 1768 1232 MsiExec.exe 82
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1020
-
C:\Windows\System32\WerFault.exeC:\Windows\System32\WerFault.exe -u -p 3475 -s 22⤵
- Program crash
PID:1768
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AdobeView-IN0287469283898.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3384
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1C7E96F8BE4766C4D35B4649AFB59FA62⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1232
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57eed7.rbs
- Size 8KB
- SHA256 840950a6a878c50b6f5a3d41a296ba4f8ba3a09c61fbed8086a222a242e3b96d
- MD5 98d1389f88c95de1c995705259c70c06
- SHA1 ca16c471f78312b29059471f9986ea1bbbb706a1
- SHA512 f0b176da464c0e76b2d5938d517e32f91d6c7d5411f39a5b1139a141c7dec7ad2deca3f708c7979123e29ddf28c0aec93f89d177b4d1add7df93a3428d794c5f
- SSDEEP 96:il8VKJky8OK1UUnYC4akvUgReD2sVCOThq3UgReD2sVCgjbAiXT80ThqoHy8sWYY:iyfTYCmcZoGnZo+2QlKvPjpB2
- TLSH T1A0026281B610CAE2E96A2B34C6472B153BB6D2DAD341E38704CE94250F27FC9CF5D5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEF51.tmp
- Size 425KB
- SHA256 faae1e5061a8b019f25f400737c4963b835af5d795760ae34faf31bbaa4c06b4
- MD5 aa1c5fb850f8d4908d84be54e262d6ac
- SHA1 72025b274c0c567070dcd35019b884adc37a8480
- SHA512 c16959ac19606c5843345c013024da545d979f9f9eae7d2722684f97f9ac6caabfe5c1d0f10429b54f1973d716273c1514024092968475baf0778cfaacdeb437
- SSDEEP 12288:PkHyw+71D+xE+ymDDBSC3Rkw1iECh+Ac2Z0hCs:PkHH+4xJyEDBSQRT1iE
- TLSH T14F948C5A9D72306ED3D1C33CA0A74271DB767811878117A7B20B42841EDF39ABEBEB51
- MD5 SHA1 SHA512 SSDEEP TLSH