Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 02:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51922537f0b00fbd9a369c1baf0632a4ef6abe6040c9dd7b4b16fefa3ea71cc6.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
51922537f0b00fbd9a369c1baf0632a4ef6abe6040c9dd7b4b16fefa3ea71cc6.msi
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target 51922537f0b00fbd9a369c1baf0632a4ef6abe6040c9dd7b4b16fefa3ea71cc6.msi
- Size 14.9MB
- Sample260522-cls8mscv2p
- SHA256 51922537f0b00fbd9a369c1baf0632a4ef6abe6040c9dd7b4b16fefa3ea71cc6
- MD5 6f23c7c72c8a4ad23829cd63877385cd
- SHA1 4f0636a8b741e97e9a5138d902e9a24fcaa6b26e
- SHA512 0b5a7b9d8647f636f84c948082db5ce3f79bb64c36413e3799aab6cadba6e5638a3082d2ed8b7ee5f2aff981f1e7b52ff99297dbff4b2826327e5deb31a49110
- SSDEEP 49152:6oIuuWcFXRGDWfmIpXvL6fCDw17L+sfYdSSUwW70lhq61huOiVIEsylwM4DW5WjX:dCWcFXRG
- TLSH T1BEF62320AE983E7ED1A9C23860AF8E05B7B16C824724E9EF039134971E7F7D44677E15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4332 created 1096 4332 MsiExec.exe 52 - Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF MsiExec.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ MsiExec.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ MsiExec.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ MsiExec.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions MsiExec.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools MsiExec.exe - Looks for VMWare services registry key. 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci MsiExec.exe - Looks for Xen service registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn MsiExec.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 2 IoCs
pid Process 4332 MsiExec.exe 4332 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 716 taskhostw.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4332 set thread context of 716 4332 MsiExec.exe 84 - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5838fd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF6228254C54AFB431.TMP msiexec.exe File created C:\Windows\Installer\e5838fd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI39A9.tmp msiexec.exe File created C:\Windows\Installer\e583901.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI682D.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF13FD2E6781099E9.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{9FF59C07-044E-4396-8EF6-F5CB655EB521} msiexec.exe File created C:\Windows\SystemTemp\~DFA315045D4AE7C223.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF37A34E67C08534AE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF67742A256E72AB55.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFEA7AB2C820E58EA6.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI439D.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFDBE630E8D3F9A92E.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4000 msiexec.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3516 timeout.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\AudioService\\audiosrv.dll" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ThreadingModel = "Both" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4332 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4000 msiexec.exe Token: SeIncreaseQuotaPrivilege 4000 msiexec.exe Token: SeSecurityPrivilege 3268 msiexec.exe Token: SeCreateTokenPrivilege 4000 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4000 msiexec.exe Token: SeLockMemoryPrivilege 4000 msiexec.exe Token: SeIncreaseQuotaPrivilege 4000 msiexec.exe Token: SeMachineAccountPrivilege 4000 msiexec.exe Token: SeTcbPrivilege 4000 msiexec.exe Token: SeSecurityPrivilege 4000 msiexec.exe Token: SeTakeOwnershipPrivilege 4000 msiexec.exe Token: SeLoadDriverPrivilege 4000 msiexec.exe Token: SeSystemProfilePrivilege 4000 msiexec.exe Token: SeSystemtimePrivilege 4000 msiexec.exe Token: SeProfSingleProcessPrivilege 4000 msiexec.exe Token: SeIncBasePriorityPrivilege 4000 msiexec.exe Token: SeCreatePagefilePrivilege 4000 msiexec.exe Token: SeCreatePermanentPrivilege 4000 msiexec.exe Token: SeBackupPrivilege 4000 msiexec.exe Token: SeRestorePrivilege 4000 msiexec.exe Token: SeShutdownPrivilege 4000 msiexec.exe Token: SeDebugPrivilege 4000 msiexec.exe Token: SeAuditPrivilege 4000 msiexec.exe Token: SeSystemEnvironmentPrivilege 4000 msiexec.exe Token: SeChangeNotifyPrivilege 4000 msiexec.exe Token: SeRemoteShutdownPrivilege 4000 msiexec.exe Token: SeUndockPrivilege 4000 msiexec.exe Token: SeSyncAgentPrivilege 4000 msiexec.exe Token: SeEnableDelegationPrivilege 4000 msiexec.exe Token: SeManageVolumePrivilege 4000 msiexec.exe Token: SeImpersonatePrivilege 4000 msiexec.exe Token: SeCreateGlobalPrivilege 4000 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4000 msiexec.exe 4000 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3268 wrote to memory of 4332 3268 msiexec.exe 81 PID 4332 wrote to memory of 2892 4332 MsiExec.exe 82 PID 4332 wrote to memory of 716 4332 MsiExec.exe 84 PID 4332 wrote to memory of 716 4332 MsiExec.exe 84 PID 2892 wrote to memory of 3516 2892 cmd.exe 85 PID 2892 wrote to memory of 3992 2892 cmd.exe 86
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1096
-
C:\Windows\System32\taskhostw.exetaskhostw.exe Install $(Arg0)2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:716
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\51922537f0b00fbd9a369c1baf0632a4ef6abe6040c9dd7b4b16fefa3ea71cc6.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4000
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 18FCB10526C4768C2753A28BA9783CE52⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\System32\cmd.execmd.exe /c timeout /t 3 /nobreak >nul && msiexec /x "{9FF59C07-044E-4396-8EF6-F5CB655EB521}" /qn3⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak4⤵
- Delays execution with timeout.exe
PID:3516
-
-
C:\Windows\system32\msiexec.exemsiexec /x "{9FF59C07-044E-4396-8EF6-F5CB655EB521}" /qn4⤵PID:3992
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583900.rbs
- Size 8KB
- SHA256 4a3af9be7aac69f015f59a9add802033cab71363624edb0c895a4346c7a1b146
- MD5 50e00864b8400fcaedc248fa6d546064
- SHA1 b017fe25c9fccf00fa8d9130f0f907d23b51d2bf
- SHA512 613d74dad9f69fd51cc212f10600fd2c1c828b880ef786c88576b8c16b513b7897384b744e67d65798a2da7f6af05cdca7cf1c6edb346647d2e00fcc6904851e
- SSDEEP 96:2nDpEvDph1jnYCA0CeUyGeD2SKCOThqLUyGeD2SKCgjTTw5aDpSThqzHrDp2rr/E:2KYCuxCZG7CZIEZcc80puL
- TLSH T13402004172A097D1E8A937B4C70F17683BB2D3DBDA91630B0C8D90286F13B8CEB59596
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e583904.rbs
- Size 8KB
- SHA256 69b8f4f574fccc6b3a72d3a8f31534ade0388c63496929c35d50084afd64b596
- MD5 56bffa62aa8f72745378fd50b5a3a36c
- SHA1 1232e513a2335276b5011e4ab6982e11998c448f
- SHA512 1223639b3d3927b953bf36faa338b35d5b91c17afddfd7e190da774effe1f809b03a8c4e1fdfbf6acc73000cd324628aea0cdc8aa019e2e1e315dc8d32f8b3ce
- SSDEEP 96:JnDpEvDpOsqZ5n8RpceD3xjzi8RpPeD3xIjTtM2w5b5GDpPzvDpz9LIuoalBtEDz:JtIRdxPRmxQZbn4sweOa+xT
- TLSH T118020E0172A083D2EDA63B75C61B17643FA3D3DBDB959307188D60286F12B8CFB991D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI39A9.tmp
- Size 14.9MB
- SHA256 91d4470a4f3d629996d6c9bbe606b41ed169c3425c9335c224eea5942ee0340a
- MD5 0ab4146f36e57623e1e4a25839ac2315
- SHA1 0066516aa92e29af23b20f6855b2f29de4c73d3f
- SHA512 319b9f63e87effdff4853ae1d934202572fa879c17fad20056cf265bb0c48790c567b1274d3ec97586f25f3ad9a8229e885392ac40715f75f2ae599600d0c503
- SSDEEP 49152:yoIuuWcFXRGDWfmIpXvL6fCDw17L+sfYdSSUwW70lhq61huOiVIEsylw64DW5WjK:1CWcFXRG
- TLSH T1B5F62320AE983E7ED2A9C23D60AF4E05B7B16C824324E9EF039124971E7F7D44677E15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e583901.msi
- Size 14.9MB
- SHA256 51922537f0b00fbd9a369c1baf0632a4ef6abe6040c9dd7b4b16fefa3ea71cc6
- MD5 6f23c7c72c8a4ad23829cd63877385cd
- SHA1 4f0636a8b741e97e9a5138d902e9a24fcaa6b26e
- SHA512 0b5a7b9d8647f636f84c948082db5ce3f79bb64c36413e3799aab6cadba6e5638a3082d2ed8b7ee5f2aff981f1e7b52ff99297dbff4b2826327e5deb31a49110
- SSDEEP 49152:6oIuuWcFXRGDWfmIpXvL6fCDw17L+sfYdSSUwW70lhq61huOiVIEsylwM4DW5WjX:dCWcFXRG
- TLSH T1BEF62320AE983E7ED1A9C23860AF8E05B7B16C824724E9EF039134971E7F7D44677E15
- MD5 SHA1 SHA512 SSDEEP TLSH