Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 02:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zinst.6638258009.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
zinst.6638258009.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target zinst.6638258009.msi
- Size 7.1MB
- Sample260710-cqaxvsds51
- SHA256 14e2179b958008e38420039979a36f86b22e03e61b3e2cf96a4857ffa5e15977
- MD5 2075a48eb40a2d0ecd5a1d79bea9efd4
- SHA1 8985ef9d24f3138c94ca1228fdc716c40caed6ff
- SHA512 b790fa6dbe72e98f3fb3343251c186a0bf4a8d40ca6f3b62d141d9dbe979c9839451dd791b11d6e242504ed78df1bda5fba99ff86d464a481ac847b8d7681a43
- SSDEEP 196608:kSQqq7dqnujzZ4xXUxfUHnZmSYpS+stHbwi51Gg5VFgZxA:CP7ddjzZYUxf45HMi51G4VSxA
- TLSH T1577633497DC927B1D08BD370455371AD7CEA7FD2BB5B8C0A3EA436046E72A125B32B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2448 MsiExec.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2448 MsiExec.exe 4 2448 MsiExec.exe 6 2448 MsiExec.exe 7 2448 MsiExec.exe 8 2448 MsiExec.exe 9 2448 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI61DE.tmp msiexec.exe File created C:\Windows\Installer\e595faa.msi msiexec.exe File opened for modification C:\Windows\Installer\e595faa.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFBE840E80A8D8125F.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754} msiexec.exe File created C:\Windows\SystemTemp\~DF406893C820E6BBFD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6131.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1928 msiexec.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5888 msiexec.exe 5888 msiexec.exe 2448 MsiExec.exe 2448 MsiExec.exe 2448 MsiExec.exe 2448 MsiExec.exe 2448 MsiExec.exe 2448 MsiExec.exe 2448 MsiExec.exe 2448 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeShutdownPrivilege 1928 msiexec.exe Token: SeIncreaseQuotaPrivilege 1928 msiexec.exe Token: SeSecurityPrivilege 5888 msiexec.exe Token: SeCreateTokenPrivilege 1928 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1928 msiexec.exe Token: SeLockMemoryPrivilege 1928 msiexec.exe Token: SeIncreaseQuotaPrivilege 1928 msiexec.exe Token: SeMachineAccountPrivilege 1928 msiexec.exe Token: SeTcbPrivilege 1928 msiexec.exe Token: SeSecurityPrivilege 1928 msiexec.exe Token: SeTakeOwnershipPrivilege 1928 msiexec.exe Token: SeLoadDriverPrivilege 1928 msiexec.exe Token: SeSystemProfilePrivilege 1928 msiexec.exe Token: SeSystemtimePrivilege 1928 msiexec.exe Token: SeProfSingleProcessPrivilege 1928 msiexec.exe Token: SeIncBasePriorityPrivilege 1928 msiexec.exe Token: SeCreatePagefilePrivilege 1928 msiexec.exe Token: SeCreatePermanentPrivilege 1928 msiexec.exe Token: SeBackupPrivilege 1928 msiexec.exe Token: SeRestorePrivilege 1928 msiexec.exe Token: SeShutdownPrivilege 1928 msiexec.exe Token: SeDebugPrivilege 1928 msiexec.exe Token: SeAuditPrivilege 1928 msiexec.exe Token: SeSystemEnvironmentPrivilege 1928 msiexec.exe Token: SeChangeNotifyPrivilege 1928 msiexec.exe Token: SeRemoteShutdownPrivilege 1928 msiexec.exe Token: SeUndockPrivilege 1928 msiexec.exe Token: SeSyncAgentPrivilege 1928 msiexec.exe Token: SeEnableDelegationPrivilege 1928 msiexec.exe Token: SeManageVolumePrivilege 1928 msiexec.exe Token: SeImpersonatePrivilege 1928 msiexec.exe Token: SeCreateGlobalPrivilege 1928 msiexec.exe Token: SeBackupPrivilege 3340 vssvc.exe Token: SeRestorePrivilege 3340 vssvc.exe Token: SeAuditPrivilege 3340 vssvc.exe Token: SeRestorePrivilege 5888 msiexec.exe Token: SeTakeOwnershipPrivilege 5888 msiexec.exe Token: SeRestorePrivilege 5888 msiexec.exe Token: SeTakeOwnershipPrivilege 5888 msiexec.exe Token: SeRestorePrivilege 5888 msiexec.exe Token: SeTakeOwnershipPrivilege 5888 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1928 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1928 msiexec.exe 5888 msiexec.exe 2448 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5888 wrote to memory of 2448 5888 msiexec.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\zinst.6638258009.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1928
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CA1FAB2C43F183474B714B0B319CDB57 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI61DE.tmp
- Size 7.1MB
- SHA256 642e64ddadf3a668bb5227a81b23c2e0678cedfa2297a0b250442d6d3fc29f48
- MD5 056a186fb347feae883522bb4a97cbf6
- SHA1 33d71b6ffcd7965bd49a98adb9ab51990ed206ae
- SHA512 6fdad5ba5226b0944188dc9d69401c18716fa3f6c1c332a4c537286fbb8bfc94d30662e80a8a73f9dfd826489a1eed0d8d8c4dd7267863e6f446c019d2412ce4
- SSDEEP 196608:USQqq7dqnujzZ4xXUxfUHnCmSYpS+stHbwi51Gg5VFgZxAF:yP7ddjzZYUxf4UHMi51G4VSxAF
- TLSH T1407633892DCA23B0E08BD3705553756D7CE67BD2BA5B8C0A3DA427146F73A125F32B42
- MD5 SHA1 SHA512 SSDEEP TLSH