Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zintall.8685330015.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
zintall.8685330015.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target zintall.8685330015.msi
- Size 8.4MB
- Sample260710-jsglragx4z
- SHA256 8abbff4cb88d70d3757ca2b0b4ebc390f44e222e3fd8b4547caa174d0d1123ce
- MD5 6e44b6eb31f2819a8d7b0076458b953c
- SHA1 565e4ea7fc82a1310d9dfd9c64892e328dbac26b
- SHA512 eb865b24936e9771ee3790abc35d8d1632033e0a5573014e1c11927b2a809f35b791dc55d12c49af5f35f39e9d85d14bce03a4bafb6ed7e4c71aea75c0933485
- SSDEEP 196608:wW8KWN8qU2wVw9esdIhyfcKqvEIZzgjNhIYPfNF1nvBYx5ZJQ:wfaqUnVpyzqcjNS8VnvMC
- TLSH T1929633ABFA8A92B0D05ADB7590C3B29F343D3FC48E704D16B5ED761D1D72A2419B2381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4736 MsiExec.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4736 MsiExec.exe 4 4736 MsiExec.exe 6 4736 MsiExec.exe 7 4736 MsiExec.exe 8 4736 MsiExec.exe 9 4736 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFAFFC0ED49F0E5B77.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI425E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI434A.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59404b.msi msiexec.exe File created C:\Windows\SystemTemp\~DF8D1EC4C956703042.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754} msiexec.exe File created C:\Windows\Installer\e59404b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1304 msiexec.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5572 msiexec.exe 5572 msiexec.exe 4736 MsiExec.exe 4736 MsiExec.exe 4736 MsiExec.exe 4736 MsiExec.exe 4736 MsiExec.exe 4736 MsiExec.exe 4736 MsiExec.exe 4736 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeShutdownPrivilege 1304 msiexec.exe Token: SeIncreaseQuotaPrivilege 1304 msiexec.exe Token: SeSecurityPrivilege 5572 msiexec.exe Token: SeCreateTokenPrivilege 1304 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1304 msiexec.exe Token: SeLockMemoryPrivilege 1304 msiexec.exe Token: SeIncreaseQuotaPrivilege 1304 msiexec.exe Token: SeMachineAccountPrivilege 1304 msiexec.exe Token: SeTcbPrivilege 1304 msiexec.exe Token: SeSecurityPrivilege 1304 msiexec.exe Token: SeTakeOwnershipPrivilege 1304 msiexec.exe Token: SeLoadDriverPrivilege 1304 msiexec.exe Token: SeSystemProfilePrivilege 1304 msiexec.exe Token: SeSystemtimePrivilege 1304 msiexec.exe Token: SeProfSingleProcessPrivilege 1304 msiexec.exe Token: SeIncBasePriorityPrivilege 1304 msiexec.exe Token: SeCreatePagefilePrivilege 1304 msiexec.exe Token: SeCreatePermanentPrivilege 1304 msiexec.exe Token: SeBackupPrivilege 1304 msiexec.exe Token: SeRestorePrivilege 1304 msiexec.exe Token: SeShutdownPrivilege 1304 msiexec.exe Token: SeDebugPrivilege 1304 msiexec.exe Token: SeAuditPrivilege 1304 msiexec.exe Token: SeSystemEnvironmentPrivilege 1304 msiexec.exe Token: SeChangeNotifyPrivilege 1304 msiexec.exe Token: SeRemoteShutdownPrivilege 1304 msiexec.exe Token: SeUndockPrivilege 1304 msiexec.exe Token: SeSyncAgentPrivilege 1304 msiexec.exe Token: SeEnableDelegationPrivilege 1304 msiexec.exe Token: SeManageVolumePrivilege 1304 msiexec.exe Token: SeImpersonatePrivilege 1304 msiexec.exe Token: SeCreateGlobalPrivilege 1304 msiexec.exe Token: SeBackupPrivilege 2592 vssvc.exe Token: SeRestorePrivilege 2592 vssvc.exe Token: SeAuditPrivilege 2592 vssvc.exe Token: SeRestorePrivilege 5572 msiexec.exe Token: SeTakeOwnershipPrivilege 5572 msiexec.exe Token: SeRestorePrivilege 5572 msiexec.exe Token: SeTakeOwnershipPrivilege 5572 msiexec.exe Token: SeRestorePrivilege 5572 msiexec.exe Token: SeTakeOwnershipPrivilege 5572 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1304 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1304 msiexec.exe 5572 msiexec.exe 4736 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5572 wrote to memory of 4736 5572 msiexec.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\zintall.8685330015.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1304
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D5D237825D3219D42EAC471F12CE2672 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4736
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI434A.tmp
- Size 8.4MB
- SHA256 9a30474cec20ea0fe60cff5a1c427c0d64619de206bbfc3195dac047526ed888
- MD5 c7a821f3bcc6b10c77d9ec2ca5c977b4
- SHA1 cfb8d50332f22ca6d8e9fcd9c0a56546e0cab511
- SHA512 8bf40b3ad422565573fbf2e6a16ce874da414f425b6f424ef72255e2aae6695452d1d55cf4568b49489c91e01aa77273b5678f35f3c3f46e90ebd27aee16d466
- SSDEEP 196608:aW8KWN8qU2wVw9esdIhUfcKqvEIZzgjNhIYPfNF1nvBYx5mJ0:afaqUnVpUzqcjNS8VnvMV
- TLSH T11A9633ABE68B91B0D05ADBB5D0C3B1AF343D3BC58D700D16F4EE6A1D5DB29281971341
- MD5 SHA1 SHA512 SSDEEP TLSH