Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 10:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe
- Size 10.2MB
- Sample260703-mg45fsct7q
- SHA256 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9
- MD5 d18df04ebc7e5e18647072e21548e91f
- SHA1 1d5b7824e560b391e64c5201697a47ae1df55375
- SHA512 0e2bbf7dd459b32db68d457ad45e780ff071f297cc744796ffaa94327c8eb747ea1da188fb8cea758582bef8e9244980ec985bc10ee34f685c9be62cfce4c284
- SSDEEP 196608:4/X+12O+t2Xs5611utVa0Ltj5LPk/HcISXwcn703QgNhuvzaqEG:4/OF+t2c5611EVp8/zrT+EG
- TLSH T1F3B6D020724BC52BC56A01B1692CEE9F542CBF760B7154D7B7DC3E6E1AB48C21236E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 2296 MsiExec.exe 2296 MsiExec.exe 2296 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\N: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\X: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\J: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\R: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\U: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\Z: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\S: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\H: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\I: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\P: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\T: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\Y: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\V: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\W: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 5484 msiexec.exe Token: SeCreateTokenPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeAssignPrimaryTokenPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeLockMemoryPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeIncreaseQuotaPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeMachineAccountPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeTcbPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSecurityPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeTakeOwnershipPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeLoadDriverPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSystemProfilePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSystemtimePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeProfSingleProcessPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeIncBasePriorityPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreatePagefilePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreatePermanentPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeBackupPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeRestorePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeShutdownPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeDebugPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeAuditPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSystemEnvironmentPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeChangeNotifyPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeRemoteShutdownPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeUndockPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSyncAgentPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeEnableDelegationPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeManageVolumePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeImpersonatePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreateGlobalPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreateTokenPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeAssignPrimaryTokenPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeLockMemoryPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeIncreaseQuotaPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeMachineAccountPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeTcbPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSecurityPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeTakeOwnershipPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeLoadDriverPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSystemProfilePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSystemtimePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeProfSingleProcessPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeIncBasePriorityPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreatePagefilePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreatePermanentPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeBackupPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeRestorePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeShutdownPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeDebugPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeAuditPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSystemEnvironmentPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeChangeNotifyPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeRemoteShutdownPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeUndockPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeSyncAgentPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeEnableDelegationPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeManageVolumePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeImpersonatePrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreateGlobalPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeCreateTokenPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeAssignPrimaryTokenPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeLockMemoryPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeIncreaseQuotaPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe Token: SeMachineAccountPrivilege 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1436 0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5484 msiexec.exe 2296 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5484 wrote to memory of 2296 5484 msiexec.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe"C:\Users\Admin\AppData\Local\Temp\0baea71a10d9ae71f98dd22d95282886ecc153093d1dd5081d71efea3c3dbcc9.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1436
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3903B0AE4BA3A8660CFA93AD404ED6A0 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1436\dialog.jpg
- Size 12KB
- SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
- MD5 5f6253cff5a8b031bfb3b161079d0d86
- SHA1 7645b13610583fb67247c74cf5af08ff848079e7
- SHA512 d1fdc364bedf931512000fbf05e854d5aceccb48abb9ec49e68476a5dc2907267490290d92acbb267ffb7bdba9b7a1c88f1eb77830cf953443f4624995dabdc3
- SSDEEP 192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
- TLSH T1E8429E6D0FAAF167D61123F061F3AFFF2F677E020A9000915DC6E593EB501A10D6C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIBDED.tmp
- Size 554KB
- SHA256 bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
- MD5 3b171ce087bb799aafcbbd93bab27f71
- SHA1 7bd69efbc7797bdff5510830ca2cc817c8b86d08
- SHA512 7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38
- SSDEEP 6144:3C36NNwIFqS6ZjRjr+hCfK3oQJY4bGvNq9AOD+Zr5k9PmaI3xM:3C360SCj1rIoQJrUq9MR5SmaI3xM
- TLSH T11DC44A2036DAC526D56E05F02AAEDBAB512D7E754B3A54DBA3D81E2B04F08C35731F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIBFE2.tmp
- Size 634KB
- SHA256 7e8a898aa81d2a1b54832686ef545e37bdcd9e61a1157fc92a81997d9ee104ef
- MD5 6df981ff5fc51df9a7a2608ebfac9b23
- SHA1 1928f3f21de9855b5c50c058dd2a602f323a7b01
- SHA512 1176baa1ec8903b9df5f5b226f27aae7733c946624c5e4d37c8034f6a04ba31891e96d1b6da1de552ac0760fe861b5042a1576397647a494d29018f1b1905438
- SSDEEP 12288:mYc8wHgdldXPm6NqOQdcrI9pDs6HIQBeD6ARGVO0Agip5IbxYtdyD8rbyJ:mYvwHCqOqcwpg+IQBz2gE5IbxYtdfrbc
- TLSH T170D44A21319AC036D57D45B02A2CDEBB957D7B720BB644DBA7C86E3E18F08C21635E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\爱校对\爱校对插件 1.5.1\install\爱校对插件.msi
- Size 1.7MB
- SHA256 fd31fb1260aa66ec9d6ec405ebc980ad1bc4b4fd6cec7aa68eeb2ae22e76ddeb
- MD5 7568a4c035271c8f2b061cffdd0aa9ee
- SHA1 86e0e2d11b9762027419949253cb4dae6a271357
- SHA512 bcd443a7eee20f529684d1708130f5e14d8474ff855b74cc28d3eede83e361ff25121ec6efcb7490aa20f2c258347d4a30be21e92094d2f08a14cf8a4535cc15
- SSDEEP 49152:WON7jizoL5laI3xbY3RmI4C5IbxYtdfrbO:V0IYoI
- TLSH T137857B21B28BC522C57D01B6A52DEE6E5538BFB30B3540E7B7E43D6F48B08C25679E12
- MD5 SHA1 SHA512 SSDEEP TLSH