Analysis
- max time kernel
28s - max time network
25s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/06/2026, 23:17
General
- Target bootstrapper/bootstrapper.msi
- Size 25.3MB
- Sample260628-29sdpag13k
- SHA256 221a35020d7e9107469ff05d71a9f6bc470ba90e06e8bef0dc7a7057a88ccd2b
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bootstrapper\bootstrapper.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow