Overview
overview
7Static
static
3dvorak-key...64.msi
windows10-2004-x64
7dvorak-key...64.msi
windows11-ltsc_2024-x64
7dvorak-key...86.msi
windows10-2004-x64
6dvorak-key...86.msi
windows11-ltsc_2024-x64
6dvorak-key...64.msi
windows10-2004-x64
6dvorak-key...64.msi
windows11-ltsc_2024-x64
6dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...up.exe
windows10-2004-x64
7dvorak-key...up.exe
windows11-ltsc_2024-x64
7dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target dvorak-keyboard/dvorak/Dvorak_i386.msi
- Size 112KB
- Sample260718-11ekssd15l
- SHA256 506c61a372cddc01468a41366cf6da6de200d1110ab15e234a1dc8a318130b84
- MD5 9a20cddb60034c5e9fa006262b2729a0
- SHA1 4c9b2b31a4af86fb6965e75b2deb35699a9f7441
- SHA512 dbd9c89f64aa609dd21214a5ac3ff4d4634b8b1ee947db7b706dc05579750eb7d30cb7f8cc1ab7ecac275b91778d615d71261ab4ea83e4ee4b67ff574b7b9e13
- SSDEEP 1536:Xx8fEfvIjL4vW5+VXJ3lIMW10i2AinCNvy/Faehp7:hjXIn4v4CPIMViRy/Eit
- TLSH T10AB35D07B7088333D5C20232452FD7E19F799CA84B728513A19EB2AD2CB2BD4E6B75D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4628 msiexec.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4628 msiexec.exe Token: SeIncreaseQuotaPrivilege 4628 msiexec.exe Token: SeSecurityPrivilege 5096 msiexec.exe Token: SeCreateTokenPrivilege 4628 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4628 msiexec.exe Token: SeLockMemoryPrivilege 4628 msiexec.exe Token: SeIncreaseQuotaPrivilege 4628 msiexec.exe Token: SeMachineAccountPrivilege 4628 msiexec.exe Token: SeTcbPrivilege 4628 msiexec.exe Token: SeSecurityPrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeLoadDriverPrivilege 4628 msiexec.exe Token: SeSystemProfilePrivilege 4628 msiexec.exe Token: SeSystemtimePrivilege 4628 msiexec.exe Token: SeProfSingleProcessPrivilege 4628 msiexec.exe Token: SeIncBasePriorityPrivilege 4628 msiexec.exe Token: SeCreatePagefilePrivilege 4628 msiexec.exe Token: SeCreatePermanentPrivilege 4628 msiexec.exe Token: SeBackupPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeShutdownPrivilege 4628 msiexec.exe Token: SeDebugPrivilege 4628 msiexec.exe Token: SeAuditPrivilege 4628 msiexec.exe Token: SeSystemEnvironmentPrivilege 4628 msiexec.exe Token: SeChangeNotifyPrivilege 4628 msiexec.exe Token: SeRemoteShutdownPrivilege 4628 msiexec.exe Token: SeUndockPrivilege 4628 msiexec.exe Token: SeSyncAgentPrivilege 4628 msiexec.exe Token: SeEnableDelegationPrivilege 4628 msiexec.exe Token: SeManageVolumePrivilege 4628 msiexec.exe Token: SeImpersonatePrivilege 4628 msiexec.exe Token: SeCreateGlobalPrivilege 4628 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4628 msiexec.exe 4628 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4628 msiexec.exe 5096 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\Dvorak_i386.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4628
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5096