Analysis
- user interaction
yes - max time kernel
14s - max time network
5s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
9fe5df.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
9fe5df.msi
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 9fe5df.msi
- Size 34.8MB
- Sample260604-spdkcshv7v
- SHA256 95fa8601a7195411f5d0685bb650f239b2831d9939456c8d3ae8e286c85b1746
- MD5 36819fafd676bd283033bec0a4cb64d2
- SHA1 312b14a4793c2fead5d785b296f5308f443cd0a3
- SHA512 4b96c0693c15d8c7c3a509efe5a8f9c9dedf534ba305ce74e7135312837d114093a1531776d32905f7da7adf27134985ea6ada5e0f19af0d8c32d8a2656ce29f
- SSDEEP 786432:JUMGYqHOm58rL10RQYiDlvjNnUpf2kocdNmv395qO:7GYqu1XbYqvjifrogEvt5z
- TLSH T10587CE0EA859069CC169813045BE92D67E217C5F0B3013DF2692BE2FAE3E6D155F9BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 3392 MsiExec.exe 3392 MsiExec.exe 3392 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2156 msiexec.exe 3 2156 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2156 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2156 msiexec.exe Token: SeIncreaseQuotaPrivilege 2156 msiexec.exe Token: SeSecurityPrivilege 3448 msiexec.exe Token: SeCreateTokenPrivilege 2156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2156 msiexec.exe Token: SeLockMemoryPrivilege 2156 msiexec.exe Token: SeIncreaseQuotaPrivilege 2156 msiexec.exe Token: SeMachineAccountPrivilege 2156 msiexec.exe Token: SeTcbPrivilege 2156 msiexec.exe Token: SeSecurityPrivilege 2156 msiexec.exe Token: SeTakeOwnershipPrivilege 2156 msiexec.exe Token: SeLoadDriverPrivilege 2156 msiexec.exe Token: SeSystemProfilePrivilege 2156 msiexec.exe Token: SeSystemtimePrivilege 2156 msiexec.exe Token: SeProfSingleProcessPrivilege 2156 msiexec.exe Token: SeIncBasePriorityPrivilege 2156 msiexec.exe Token: SeCreatePagefilePrivilege 2156 msiexec.exe Token: SeCreatePermanentPrivilege 2156 msiexec.exe Token: SeBackupPrivilege 2156 msiexec.exe Token: SeRestorePrivilege 2156 msiexec.exe Token: SeShutdownPrivilege 2156 msiexec.exe Token: SeDebugPrivilege 2156 msiexec.exe Token: SeAuditPrivilege 2156 msiexec.exe Token: SeSystemEnvironmentPrivilege 2156 msiexec.exe Token: SeChangeNotifyPrivilege 2156 msiexec.exe Token: SeRemoteShutdownPrivilege 2156 msiexec.exe Token: SeUndockPrivilege 2156 msiexec.exe Token: SeSyncAgentPrivilege 2156 msiexec.exe Token: SeEnableDelegationPrivilege 2156 msiexec.exe Token: SeManageVolumePrivilege 2156 msiexec.exe Token: SeImpersonatePrivilege 2156 msiexec.exe Token: SeCreateGlobalPrivilege 2156 msiexec.exe Token: SeCreateTokenPrivilege 2156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2156 msiexec.exe Token: SeLockMemoryPrivilege 2156 msiexec.exe Token: SeIncreaseQuotaPrivilege 2156 msiexec.exe Token: SeMachineAccountPrivilege 2156 msiexec.exe Token: SeTcbPrivilege 2156 msiexec.exe Token: SeSecurityPrivilege 2156 msiexec.exe Token: SeTakeOwnershipPrivilege 2156 msiexec.exe Token: SeLoadDriverPrivilege 2156 msiexec.exe Token: SeSystemProfilePrivilege 2156 msiexec.exe Token: SeSystemtimePrivilege 2156 msiexec.exe Token: SeProfSingleProcessPrivilege 2156 msiexec.exe Token: SeIncBasePriorityPrivilege 2156 msiexec.exe Token: SeCreatePagefilePrivilege 2156 msiexec.exe Token: SeCreatePermanentPrivilege 2156 msiexec.exe Token: SeBackupPrivilege 2156 msiexec.exe Token: SeRestorePrivilege 2156 msiexec.exe Token: SeShutdownPrivilege 2156 msiexec.exe Token: SeDebugPrivilege 2156 msiexec.exe Token: SeAuditPrivilege 2156 msiexec.exe Token: SeSystemEnvironmentPrivilege 2156 msiexec.exe Token: SeChangeNotifyPrivilege 2156 msiexec.exe Token: SeRemoteShutdownPrivilege 2156 msiexec.exe Token: SeUndockPrivilege 2156 msiexec.exe Token: SeSyncAgentPrivilege 2156 msiexec.exe Token: SeEnableDelegationPrivilege 2156 msiexec.exe Token: SeManageVolumePrivilege 2156 msiexec.exe Token: SeImpersonatePrivilege 2156 msiexec.exe Token: SeCreateGlobalPrivilege 2156 msiexec.exe Token: SeCreateTokenPrivilege 2156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2156 msiexec.exe Token: SeLockMemoryPrivilege 2156 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3448 wrote to memory of 3392 3448 msiexec.exe 82
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9fe5df.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2156
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 02A372B7ACCCFECAE5E84D5118A072B7 C2⤵
- Loads dropped DLL
PID:3392
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI48BC.tmp
- Size 390KB
- SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
- MD5 e8dc682f2c486075c6aba658971a62cc
- SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
- SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
- SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
- TLSH T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI490B.tmp
- Size 6.2MB
- SHA256 309119278eff0aa925be60e78dbe39a58f79bed7d711010042c3f3f58b29ceb0
- MD5 378eb6c9c1e7e57821b407cf9c394c66
- SHA1 957c4219f197b72c2b7124f704a79b8fb19f3cd6
- SHA512 61e07a1bc6da6038b665ad4027ddfdde29d2214f401c0e16bfe049b65ac8482741a12d86595f8a7a744e1fcf949ac6bce6137c92f4a0aafa1d8f8715a4d9b457
- SSDEEP 49152:s49/mGE5URXXol+uUKB2byihycAbiqs4UDTzdE65Eq2fvjyKmCikKlK1KMAG2+Dr:s49JoSAsDTREgmAG2+r
- TLSH T13A663917ECA518E9C0AED1318A669656BB32BC481B3123D73B50F6383F76BD069BD344
- MD5 SHA1 SHA512 SSDEEP TLSH