Analysis
- user interaction
yes - max time kernel
72s - max time network
53s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 17:06
Behavioral task
behavioral1
Sample
driftaline-installer-v1.7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target driftaline-installer-v1.7.exe
- Size 46.9MB
- Sample260717-vmvf7sb16y
- SHA256 52843c8d893571bca8662044117859cbce081c633e5dbed7e47d92632b2582cd
- MD5 e3ddbf7b846cf68bf946b026a6b61aeb
- SHA1 ef2cb28dce000f31b45458e7d4d02dae875cfd1a
- SHA512 8a05b79fb078de3a7980f73f7ca28f3adc711620adb3d772508766e61f043de6674b986313603fd1c36f3cc22e4f0a39aad81e2250464d05c90924df2fe65e57
- SSDEEP 786432:/2oORo/s8XV81yiIB0UpBtFdhZ/1p2+4eIBhnCQAC4jQyVYpDh1q7sjow5reG0h5:/MRo/IyHeUpNZPvyTC6pDbqAjowWh5
- TLSH T188B7333FA15F3239F02E55367A77E119983B7761A0578C06D6E0C84CCF960712D3EAAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4932 driftaline-installer-v1.7.tmp 1864 HidHide_1.2.128_x64.exe - Loads dropped DLL 9 IoCs
pid Process 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: HidHide_1.2.128_x64.exe File opened (read-only) \??\T: HidHide_1.2.128_x64.exe File opened (read-only) \??\V: HidHide_1.2.128_x64.exe File opened (read-only) \??\W: HidHide_1.2.128_x64.exe File opened (read-only) \??\X: HidHide_1.2.128_x64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: HidHide_1.2.128_x64.exe File opened (read-only) \??\P: HidHide_1.2.128_x64.exe File opened (read-only) \??\S: HidHide_1.2.128_x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: HidHide_1.2.128_x64.exe File opened (read-only) \??\J: HidHide_1.2.128_x64.exe File opened (read-only) \??\K: HidHide_1.2.128_x64.exe File opened (read-only) \??\Q: HidHide_1.2.128_x64.exe File opened (read-only) \??\R: HidHide_1.2.128_x64.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: HidHide_1.2.128_x64.exe File opened (read-only) \??\L: HidHide_1.2.128_x64.exe File opened (read-only) \??\M: HidHide_1.2.128_x64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: HidHide_1.2.128_x64.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: HidHide_1.2.128_x64.exe File opened (read-only) \??\O: HidHide_1.2.128_x64.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: HidHide_1.2.128_x64.exe File opened (read-only) \??\U: HidHide_1.2.128_x64.exe File opened (read-only) \??\Y: HidHide_1.2.128_x64.exe File opened (read-only) \??\Z: HidHide_1.2.128_x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HidHide_1.2.128_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language driftaline-installer-v1.7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language driftaline-installer-v1.7.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/6024-0-0x0000000000310000-0x00000000003F7000-memory.dmp innosetup behavioral2/memory/6024-8-0x0000000000310000-0x00000000003F7000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4932 driftaline-installer-v1.7.tmp 4932 driftaline-installer-v1.7.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1028 msiexec.exe Token: SeCreateTokenPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeAssignPrimaryTokenPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeLockMemoryPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeIncreaseQuotaPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeMachineAccountPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeTcbPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSecurityPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeTakeOwnershipPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeLoadDriverPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSystemProfilePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSystemtimePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeProfSingleProcessPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeIncBasePriorityPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreatePagefilePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreatePermanentPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeBackupPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeRestorePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeShutdownPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeDebugPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeAuditPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSystemEnvironmentPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeChangeNotifyPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeRemoteShutdownPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeUndockPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSyncAgentPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeEnableDelegationPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeManageVolumePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeImpersonatePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreateGlobalPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreateTokenPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeAssignPrimaryTokenPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeLockMemoryPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeIncreaseQuotaPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeMachineAccountPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeTcbPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSecurityPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeTakeOwnershipPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeLoadDriverPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSystemProfilePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSystemtimePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeProfSingleProcessPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeIncBasePriorityPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreatePagefilePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreatePermanentPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeBackupPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeRestorePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeShutdownPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeDebugPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeAuditPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSystemEnvironmentPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeChangeNotifyPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeRemoteShutdownPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeUndockPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeSyncAgentPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeEnableDelegationPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeManageVolumePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeImpersonatePrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreateGlobalPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeCreateTokenPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeAssignPrimaryTokenPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeLockMemoryPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeIncreaseQuotaPrivilege 1864 HidHide_1.2.128_x64.exe Token: SeMachineAccountPrivilege 1864 HidHide_1.2.128_x64.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4932 driftaline-installer-v1.7.tmp 1864 HidHide_1.2.128_x64.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1028 msiexec.exe 4856 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 6024 wrote to memory of 4932 6024 driftaline-installer-v1.7.exe 89 PID 4932 wrote to memory of 1864 4932 driftaline-installer-v1.7.tmp 91 PID 1028 wrote to memory of 4856 1028 msiexec.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\driftaline-installer-v1.7.exe"C:\Users\Admin\AppData\Local\Temp\driftaline-installer-v1.7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\is-XX6X5PTRJL.tmp\driftaline-installer-v1.7.tmp"C:\Users\Admin\AppData\Local\Temp\is-XX6X5PTRJL.tmp\driftaline-installer-v1.7.tmp" /SL5="$200254,47899244,887296,C:\Users\Admin\AppData\Local\Temp\driftaline-installer-v1.7.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\is-4USTNUDJR4.tmp\HidHide_1.2.128_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-4USTNUDJR4.tmp\HidHide_1.2.128_x64.exe" /norestart3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1864
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15EA88B30708FA8EC0B9715DB3ED650A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4856
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.2.128\install\89E08F6\HidHide.msi
- Size 2.9MB
- SHA256 13b1b29666d0beacf1d3bea8d4d1b503e9c746b5612196b62b52f91a5929fecc
- MD5 5bffe356a0f3419367edbf2f71e1d6f7
- SHA1 372b09b2e61bc8d374ceeb0ece47968256d24e42
- SHA512 e8da11a5501e8624ec9f4b33eb78586aeca5d832bd214090111ed828aa0c5d484c4770a1374f5704de3930b2c1855f2befa4d48f3c39874103e26ac4e03c8c7e
- SSDEEP 49152:ZwfZ5gLL3TLKTf0256NZ4Ylh1Vz53sWIGvN/nJEYVuB55SHawNh:k6LTLu+1V7/nJEYsN
- TLSH T1E5E57B21B287C036D56D0172A92CEE6F5138BF731B3154E7BBE83E6E48B48C25635E16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\DriftAline\DriftAline.exe
- Size 6.9MB
- SHA256 e98e9dd3bec5816c3365e977fbff97c4c0aad0f683a45e2d9e7d85da1955901e
- MD5 106939196450a16a83ecc1d306d9ab9e
- SHA1 f18256715757ba26e767286caada775710e50380
- SHA512 c45f07e3827cb67bc6e74bd49318b111896ea1155bc3f258fb2013e3241bf2917990df7e8f10d292c08ca771a9112aa29bfcfbbae491566da807f9adccb386da
- SSDEEP 196608:Y4pOdsTEbcIuE3jNIbW9kENEu8QulsuXY+57:1OCTrPGhDEbQgsuI+
- TLSH T173762317B350826DF1578A7CC6678B05E233B420A71383CB325E9A2ACF6B7E45D75389
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1864\banner.jpg
- Size 4KB
- SHA256 be83c8592906fd9651634b0823a2f45abe96aae082674568944c639b5b4a95dc
- MD5 d5a55a78cd38f45256807c7851619b7d
- SHA1 9d8269120d1d096e9ab0192348f3b8f81f5f73d9
- SHA512 959e7410e3006cfef9d14315e8741e34b6e81c4f9160c5d66f3abd77ce72f55f907ab3a0e500780b5c0e0e017e8639f135cc258976b4ab4b9d1aaed6242ce9f1
- SSDEEP 96:gf2mCSVa8l5M3QXr1yFk1Erk/Sp3ErJE97KT6Avg+y5rls/Xx:I88oAXQk1Erk/Sp3ErcAvBy/wh
- TLSH T10D916E7FBAC02317E9C6CA6A3DAE8017561108F168F0E63508CFCDD3D93919B596A1E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1864\dialog.jpg
- Size 12KB
- SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
- MD5 5f6253cff5a8b031bfb3b161079d0d86
- SHA1 7645b13610583fb67247c74cf5af08ff848079e7
- SHA512 d1fdc364bedf931512000fbf05e854d5aceccb48abb9ec49e68476a5dc2907267490290d92acbb267ffb7bdba9b7a1c88f1eb77830cf953443f4624995dabdc3
- SSDEEP 192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
- TLSH T1E8429E6D0FAAF167D61123F061F3AFFF2F677E020A9000915DC6E593EB501A10D6C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID21C.tmp
- Size 587KB
- SHA256 42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0
- MD5 cadbcf6f5a0199ecc0220ce23a860d89
- SHA1 073c149d68916520aea882e588ab9a5ae083d75a
- SHA512 cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc
- SSDEEP 12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
- TLSH T1CED44921369AC036D56D05B02DACDBAB516EBE764B3658DBA3D81E3B85F08C25331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID5FC.tmp
- Size 709KB
- SHA256 1e84a4da22cb64ab037afa6ca184e080463dd870d6db2f42dda2414fd2311caf
- MD5 16427fa171bd703839d252c580c42cd0
- SHA1 268ec6c390d5fba3af0d3ca55ecfc65d9e232906
- SHA512 52e2b47b6f461d85a689243c89c91151cd643952cd64fa0efb00522a4de3d4ffefd09adbeb524ed664b9da0fd141ebcd5a12d780debd79741626183ae837c77c
- SSDEEP 12288:OuYFjg26D559YpR0FeANNnJuXtmy6/EJg3LQxPmJPsJZTPt55dkHawNf:OhgzVNngEyOE+3LkuJkJ9155dkHawNf
- TLSH T111F45B21719AC03AE57D41F13A3CDE6BA17D7B720BB214DB6BC45E7A18B48C21631E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-4USTNUDJR4.tmp\HidHide_1.2.128_x64.exe
- Size 5.0MB
- SHA256 285394f26359b66011462c36976636d3f203a83de6ebd5dff8980b602312470d
- MD5 691ae25161f0e2784cb6d0a75777221c
- SHA1 7ca68ee089ea766eb333bf7039f6dba4006cfb1f
- SHA512 3d251ac708a8a145a6d40053f34081a2732f3aa860b6bf527b99f5d9501078f1d82ea3bbe58048917ad289b8db20ddd104cca942b4dc77f6ec64348f45dd3d88
- SSDEEP 98304:X6cyw5opl/YabL+DvmR84v/hyI8oL97pI9Xms9phXq:qcywI4g5vc6dgXmkY
- TLSH T1B336AE31764AC43BD66205B0196C9A9F92287F321BB654C7B3CC2E6E1BB44C31736E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-XX6X5PTRJL.tmp\driftaline-installer-v1.7.tmp
- Size 4.2MB
- SHA256 c64cc82d5637aab901c3624947996d4db0e63494452895b9ab15da36ff9aeade
- MD5 122b417477f7714dc91397c5bf5d7488
- SHA1 07c0203c57a0ad9b2da4dbcfe152dd3fab269169
- SHA512 a288628d1197414200416d38a9d3afdb78e73a41458d9f6a99dfea5bb730adcc4e445879253568d81f4b25786273e727e07b0d75b897a9b1f449658f161d2cfc
- SSDEEP 98304:WYU5hnuOajWwMPdCpepI3GrwrA+Jt333C9V:2xuHjWfZIzMV
- TLSH T1C1168F03B388753EE4571A3A583FA284983F7A213A26CD4F6BF40D5C8F396416D2A757
- MD5 SHA1 SHA512 SSDEEP TLSH