Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ToDesk_Lite-x64.6.3.4.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ToDesk_Lite-x64.6.3.4.msi
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target ToDesk_Lite-x64.6.3.4.msi
- Size 24.1MB
- Sample260628-ctafhaez2n
- SHA256 0cb1d3623ab8dd0e3647a6769fc9d793499745e055a8d5c90a1ce97ba7de14fd
- MD5 e38fbe11fbabf72746033de296353bb4
- SHA1 ffdb8e5ce1c326ede832024e29c6232a0f1bf0f0
- SHA512 510bc4a99b105a74b814092a7b2f9d9ef4fc98505594ea1e3b9577adb5466b4d790f242c62fbdfb18c41cd2e5d58c1269b7397f82372e1468466251dc2c7a575
- SSDEEP 786432:KuJSY0IRnuMoWg/pA8xebjPFOprNr50BvBt:Ku07yu6g/aEfY
- TLSH T111472321759EC132FA6F06B15629EA2AE43C7DF20B7404EBA3E4F94966704C25335F93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3456 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3456 msiexec.exe Token: SeIncreaseQuotaPrivilege 3456 msiexec.exe Token: SeSecurityPrivilege 2420 msiexec.exe Token: SeCreateTokenPrivilege 3456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3456 msiexec.exe Token: SeLockMemoryPrivilege 3456 msiexec.exe Token: SeIncreaseQuotaPrivilege 3456 msiexec.exe Token: SeMachineAccountPrivilege 3456 msiexec.exe Token: SeTcbPrivilege 3456 msiexec.exe Token: SeSecurityPrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeLoadDriverPrivilege 3456 msiexec.exe Token: SeSystemProfilePrivilege 3456 msiexec.exe Token: SeSystemtimePrivilege 3456 msiexec.exe Token: SeProfSingleProcessPrivilege 3456 msiexec.exe Token: SeIncBasePriorityPrivilege 3456 msiexec.exe Token: SeCreatePagefilePrivilege 3456 msiexec.exe Token: SeCreatePermanentPrivilege 3456 msiexec.exe Token: SeBackupPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeShutdownPrivilege 3456 msiexec.exe Token: SeDebugPrivilege 3456 msiexec.exe Token: SeAuditPrivilege 3456 msiexec.exe Token: SeSystemEnvironmentPrivilege 3456 msiexec.exe Token: SeChangeNotifyPrivilege 3456 msiexec.exe Token: SeRemoteShutdownPrivilege 3456 msiexec.exe Token: SeUndockPrivilege 3456 msiexec.exe Token: SeSyncAgentPrivilege 3456 msiexec.exe Token: SeEnableDelegationPrivilege 3456 msiexec.exe Token: SeManageVolumePrivilege 3456 msiexec.exe Token: SeImpersonatePrivilege 3456 msiexec.exe Token: SeCreateGlobalPrivilege 3456 msiexec.exe Token: SeCreateTokenPrivilege 3456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3456 msiexec.exe Token: SeLockMemoryPrivilege 3456 msiexec.exe Token: SeIncreaseQuotaPrivilege 3456 msiexec.exe Token: SeMachineAccountPrivilege 3456 msiexec.exe Token: SeTcbPrivilege 3456 msiexec.exe Token: SeSecurityPrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeLoadDriverPrivilege 3456 msiexec.exe Token: SeSystemProfilePrivilege 3456 msiexec.exe Token: SeSystemtimePrivilege 3456 msiexec.exe Token: SeProfSingleProcessPrivilege 3456 msiexec.exe Token: SeIncBasePriorityPrivilege 3456 msiexec.exe Token: SeCreatePagefilePrivilege 3456 msiexec.exe Token: SeCreatePermanentPrivilege 3456 msiexec.exe Token: SeBackupPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeShutdownPrivilege 3456 msiexec.exe Token: SeDebugPrivilege 3456 msiexec.exe Token: SeAuditPrivilege 3456 msiexec.exe Token: SeSystemEnvironmentPrivilege 3456 msiexec.exe Token: SeChangeNotifyPrivilege 3456 msiexec.exe Token: SeRemoteShutdownPrivilege 3456 msiexec.exe Token: SeUndockPrivilege 3456 msiexec.exe Token: SeSyncAgentPrivilege 3456 msiexec.exe Token: SeEnableDelegationPrivilege 3456 msiexec.exe Token: SeManageVolumePrivilege 3456 msiexec.exe Token: SeImpersonatePrivilege 3456 msiexec.exe Token: SeCreateGlobalPrivilege 3456 msiexec.exe Token: SeCreateTokenPrivilege 3456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3456 msiexec.exe Token: SeLockMemoryPrivilege 3456 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3456 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3456 msiexec.exe 2420 msiexec.exe 2992 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2992 2420 msiexec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ToDesk_Lite-x64.6.3.4.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3456
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D1D10C9178C1198BE0DA0BA0580AFC2E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI3A6F.tmp
- Size 1005KB
- SHA256 7b3a4e3e3f58fa49164d49b14bc10c13a9d734846956c8a7a433c8bb6c82d983
- MD5 0606e1a2fe0d72593405cafeb945c740
- SHA1 641e8cfea8d2203d3127b49939b1ed5f1c97dc9e
- SHA512 696152be48a1256c5eda545b8759671117a7b55e49723b437b6ee258a3b568b9440f1592e4abf4eb1aa878e960cc721bdbc55f2a48d77bb1b3315b75cc15946a
- SSDEEP 24576:uADREF4f3fy4UpBxQnWh0lhSMXlI5G17n:uADREFClUDxuj45G17n
- TLSH T138257D203A89C436E56D05B3193D9B6BA13E797A0B7154CB93D8BE5A2DB00C2533DF93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3F67.tmp
- Size 894KB
- SHA256 1a42e41b6c284aeb55d9ac8a28bc7fb50b98008d6a04464d73ebe8d200662ce0
- MD5 713c5d0c1b98583f3638212f91f9b99e
- SHA1 2845ae2516d94e05c8ae305b2f83a452a7e10117
- SHA512 1cdfd877a950733a12506002a885364842883adfc589c6fb6d06b894848e256b017308dd0939523a82497e7f1b33e6552f0bd5b469727f7fc0290a3eb3915d76
- SSDEEP 24576:gSGBHv6d7cW+Vcn8Ngh0lhSMXlhGybo4SaWq:HGKacn8nRGSo4SaWq
- TLSH T166157D70359EC076F26E01B0277DCFBBE11D69760BB544DBA3E8AD2A5AB04C21235E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3FE5.tmp
- Size 1.1MB
- SHA256 54626f0b9e6ffe57d232afb49b2d8b96c9598e23a518e4e1f21cb5e04c9087df
- MD5 ea0a2238a66b880e946878dc43a10e0b
- SHA1 6e120d4745928cfc6a3ac120982ea6fb0a5187c1
- SHA512 8b4179b10c3c307a002e82f6a2efb489fac3e241ae364cd2b0131ae135d2498111803a72da5826cbb1423d8fdbfae7534cf91d35e31bbc17eb9ebf5cfb31f417
- SSDEEP 24576:47Hxx8xHMkGC0SBiqHSTOhis10BaIUbzIsEYINDbGUg04j00sS9xB9aVCFGa4:ei8w5HSTOhis10BKbzIzYIxbGUt4j00e
- TLSH T15A450921687C4772EF6F1AB09616D12AF96C75D21BE808FB82E4D685B7311C36331F92
- MD5 SHA1 SHA512 SSDEEP TLSH