Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer.msi
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Installer.msi
- Size 1.3MB
- Sample260705-xc4cgae15t
- SHA256 45415f110b7961eea726dd3b1c07ebed2bbc44d13e8d92d0d8bd1304ba145d73
- MD5 595eb28f84979f035375a35efe92c259
- SHA1 cc7b8f647406840c119aca58278b120534e8194e
- SHA512 7d170663771a355a7498f1a1bad8e6067366605a082734fac8dc26c21f82b2f09e007e57e3b3ad0c2b4d2068abb371187a32068646fc07ae43edb70e9bb7598b
- SSDEEP 24576:PET2+6lAvtemMo+yW5WIDg9coGOdz0iXN:Pw2BKbM8W5W9p77d
- TLSH T1E055AE57BE9104A5D4660E71C5B3B364AE36BC0433A0889A1379F13CCEFB6D0A57A7D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4312 rundll32.exe - Loads dropped DLL 6 IoCs
pid Process 4964 MsiExec.exe 4312 rundll32.exe 4312 rundll32.exe 4312 rundll32.exe 4312 rundll32.exe 4312 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5784 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5784 msiexec.exe Token: SeIncreaseQuotaPrivilege 5784 msiexec.exe Token: SeSecurityPrivilege 1540 msiexec.exe Token: SeCreateTokenPrivilege 5784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5784 msiexec.exe Token: SeLockMemoryPrivilege 5784 msiexec.exe Token: SeIncreaseQuotaPrivilege 5784 msiexec.exe Token: SeMachineAccountPrivilege 5784 msiexec.exe Token: SeTcbPrivilege 5784 msiexec.exe Token: SeSecurityPrivilege 5784 msiexec.exe Token: SeTakeOwnershipPrivilege 5784 msiexec.exe Token: SeLoadDriverPrivilege 5784 msiexec.exe Token: SeSystemProfilePrivilege 5784 msiexec.exe Token: SeSystemtimePrivilege 5784 msiexec.exe Token: SeProfSingleProcessPrivilege 5784 msiexec.exe Token: SeIncBasePriorityPrivilege 5784 msiexec.exe Token: SeCreatePagefilePrivilege 5784 msiexec.exe Token: SeCreatePermanentPrivilege 5784 msiexec.exe Token: SeBackupPrivilege 5784 msiexec.exe Token: SeRestorePrivilege 5784 msiexec.exe Token: SeShutdownPrivilege 5784 msiexec.exe Token: SeDebugPrivilege 5784 msiexec.exe Token: SeAuditPrivilege 5784 msiexec.exe Token: SeSystemEnvironmentPrivilege 5784 msiexec.exe Token: SeChangeNotifyPrivilege 5784 msiexec.exe Token: SeRemoteShutdownPrivilege 5784 msiexec.exe Token: SeUndockPrivilege 5784 msiexec.exe Token: SeSyncAgentPrivilege 5784 msiexec.exe Token: SeEnableDelegationPrivilege 5784 msiexec.exe Token: SeManageVolumePrivilege 5784 msiexec.exe Token: SeImpersonatePrivilege 5784 msiexec.exe Token: SeCreateGlobalPrivilege 5784 msiexec.exe Token: SeCreateTokenPrivilege 5784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5784 msiexec.exe Token: SeLockMemoryPrivilege 5784 msiexec.exe Token: SeIncreaseQuotaPrivilege 5784 msiexec.exe Token: SeMachineAccountPrivilege 5784 msiexec.exe Token: SeTcbPrivilege 5784 msiexec.exe Token: SeSecurityPrivilege 5784 msiexec.exe Token: SeTakeOwnershipPrivilege 5784 msiexec.exe Token: SeLoadDriverPrivilege 5784 msiexec.exe Token: SeSystemProfilePrivilege 5784 msiexec.exe Token: SeSystemtimePrivilege 5784 msiexec.exe Token: SeProfSingleProcessPrivilege 5784 msiexec.exe Token: SeIncBasePriorityPrivilege 5784 msiexec.exe Token: SeCreatePagefilePrivilege 5784 msiexec.exe Token: SeCreatePermanentPrivilege 5784 msiexec.exe Token: SeBackupPrivilege 5784 msiexec.exe Token: SeRestorePrivilege 5784 msiexec.exe Token: SeShutdownPrivilege 5784 msiexec.exe Token: SeDebugPrivilege 5784 msiexec.exe Token: SeAuditPrivilege 5784 msiexec.exe Token: SeSystemEnvironmentPrivilege 5784 msiexec.exe Token: SeChangeNotifyPrivilege 5784 msiexec.exe Token: SeRemoteShutdownPrivilege 5784 msiexec.exe Token: SeUndockPrivilege 5784 msiexec.exe Token: SeSyncAgentPrivilege 5784 msiexec.exe Token: SeEnableDelegationPrivilege 5784 msiexec.exe Token: SeManageVolumePrivilege 5784 msiexec.exe Token: SeImpersonatePrivilege 5784 msiexec.exe Token: SeCreateGlobalPrivilege 5784 msiexec.exe Token: SeCreateTokenPrivilege 5784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5784 msiexec.exe Token: SeLockMemoryPrivilege 5784 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5784 msiexec.exe 5784 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5784 msiexec.exe 1540 msiexec.exe 4964 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4964 1540 msiexec.exe 89 PID 4964 wrote to memory of 4312 4964 MsiExec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5784
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C89C8073145CEACAA671244E0A12B5A1 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC147.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698062 1 MSICustomActionDLL!MSICustomActionDLL.CustomActions.EntryPointOne3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4312
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIC147.tmp
- Size 254KB
- SHA256 06875058d4f40be9fb9d065bb4dbc29f67e80339ea261143d123d582c1481171
- MD5 efaa71c29a914094691c2582c657dc1f
- SHA1 f4c0093ead13091107ac8e3a971257bdbe66421f
- SHA512 9e34d5fcd9ba1522b62bd0efa642a9a49cba10515c2a857cea4a424edd9e8aaca084fa68bfc305cf48d404a2370a5068bfb09afd9a844d58c5735815ddd960f5
- SSDEEP 3072:RArbg5BxgracGnEnRQOl9WGPotUx9uY7iWhhlRZeUYxceHOwqk1w9Ak2WXNguP:RArbtraBqLlAG3u6LZTeHOwtiXNga
- TLSH T12B44BE10B6D48071F1BF2A381D34A6A44ABEBD605FB1DA8F57488A2E4F741D09B25F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC147.tmp-\CustomAction.config
- Size 1KB
- SHA256 5d6fd5049f33ac6b16ec0431787fa61c66630ba1916bb4c70f3f6b5844b74ecb
- MD5 8c22d283225f3bdb8e36522c359796f9
- SHA1 cec5168b62bc7d39930e0843a0a285c3d89ed23e
- SHA512 826550987a6140b870894c02c20f1c890e187c5919fc60f5fe3fe962fc87bfcc3879ee1de6141d679aa85f6cf52f8be88a9b23a8d43b8561b6b70baf138ada3e
- TLSH T19731018E4A44A77721312767ABED91C1DB79A1AB3C91811834DE99242F16968137338A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC147.tmp-\MSICustomActionDLL.dll
- Size 16KB
- SHA256 487aca2bbd630c8013ee1992dabb970058c9a737c2fffce0c0a45801408771cd
- MD5 732de0a3ddfeb4b5ad29387d3cbf66ee
- SHA1 8dbb7949c9577cf3019f64c6324e7ae5b1db7cc5
- SHA512 608c9930739d5301f80d2d6975ce151a31ee8b2767ddfd2e355612e8a642f0ddf471dde07d6a5b8a4ae319e461bcae0f48abe12aa08697ebb93931f61f46c5b7
- SSDEEP 192:vbm4NuTJt0oE5kkhMKtaK2VfTiuqwtjLdnlAyjlBbAIPGcD/aFy0mi9VDXHN:6JtvNOFaHfTXtjLdnWyjlBs8GckVrHN
- TLSH T1CD72E70877FC872AF5FF5F329C7242180A36FC566932DB5D2E88A50D5872E408A61B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC147.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 179KB
- SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
- MD5 1a5caea6734fdd07caa514c3f3fb75da
- SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
- SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
- SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
- TLSH T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH