Overview
overview
8Static
static
3CommunityT...vm.dll
windows10-2004-x64
1CommunityT...vm.dll
windows11-ltsc_2024-x64
1CoreOSC.dll
windows10-2004-x64
1CoreOSC.dll
windows11-ltsc_2024-x64
1DiscordRPC.dll
windows10-2004-x64
1DiscordRPC.dll
windows11-ltsc_2024-x64
1MagicChatbox.exe
windows10-2004-x64
1MagicChatbox.exe
windows11-ltsc_2024-x64
1MagicChatbox.exe
windows10-2004-x64
8MagicChatbox.exe
windows11-ltsc_2024-x64
1MagicChatboxAPI.dll
windows10-2004-x64
1MagicChatboxAPI.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....er.dll
windows10-2004-x64
1Microsoft....er.dll
windows11-ltsc_2024-x64
1Microsoft....on.dll
windows10-2004-x64
1Microsoft....on.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....on.dll
windows10-2004-x64
1Microsoft....on.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....cs.dll
windows10-2004-x64
1Microsoft....cs.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....ly.dll
windows10-2004-x64
1Microsoft....ly.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
299s - max time network
275s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CommunityToolkit.Mvvm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
CommunityToolkit.Mvvm.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
CoreOSC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
CoreOSC.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
DiscordRPC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
DiscordRPC.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
MagicChatbox.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
MagicChatbox.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
MagicChatbox.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
300 seconds
Behavioral task
behavioral10
Sample
MagicChatbox.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral11
Sample
MagicChatboxAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
MagicChatboxAPI.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Microsoft.Extensions.Configuration.Binder.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Microsoft.Extensions.Configuration.Binder.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Microsoft.Extensions.Configuration.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Microsoft.Extensions.Configuration.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
Microsoft.Extensions.Diagnostics.Abstractions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
Microsoft.Extensions.Diagnostics.Abstractions.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
Microsoft.Extensions.Diagnostics.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
Microsoft.Extensions.Diagnostics.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
Microsoft.Extensions.FileProviders.Abstractions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Microsoft.Extensions.FileProviders.Abstractions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Microsoft.Extensions.Hosting.Abstractions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
Microsoft.Extensions.Hosting.Abstractions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Microsoft.Extensions.Http.Polly.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
Microsoft.Extensions.Http.Polly.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target MagicChatbox.exe
- Size 307KB
- Sample260718-2b1bmsg16x
- SHA256 65e5faf771279015c11a2955b6d623c5fab971535a4ffca78e9812aa43767ee6
- MD5 134b51b641832d0b7f38b9460308d1f4
- SHA1 00b7ceae6230f34fed5502f185a12f5d53b64148
- SHA512 92f98cbe5c7b9f06d4896d185f88300ffe855e7e32de1b06ffefb8360f89b4d379c73b03c57a42d38448244d66bd0ee7c3ec9e72467e5df352d413a63c36f742
- SSDEEP 6144:eifl++Sb9fR6bgBkZXI39QVG1j1Nj7yeNM0urXKSXoa:/fI+S3DNQ0meirXxY
- TLSH T1E864D01833D8531EE2BEBB3AB8B1E2785334F952F866DB5A4870629C19723C45E407D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 25 4188 MagicChatbox.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation MagicChatbox.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation windowsdesktop-runtime-10.0.10-win-x64.99989801.exe - Executes dropped EXE 6 IoCs
pid Process 1808 windowsdesktop-runtime-10.0.10-win-x64.99989801.exe 4044 wixstdba.exe 2364 windowsdesktop-runtime-10.0.10-win-x64.exe 3924 windowsdesktop-runtime-10.0.10-win-x64.exe 3976 windowsdesktop-runtime-10.0.10-win-x64.exe 1948 wixstdba.exe - Loads dropped DLL 1 IoCs
pid Process 3952 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-10.0.10-win-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe msiexec.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt msiexec.exe File opened for modification C:\Program Files\dotnet\ThirdPartyNotices.txt msiexec.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt msiexec.exe File created C:\Program Files\dotnet\dotnet.exe msiexec.exe File opened for modification C:\Program Files\dotnet\ msiexec.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.10 (x64).swidtag windowsdesktop-runtime-10.0.10-win-x64.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\MSIE75D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF568.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149 msiexec.exe File created C:\Windows\Installer\e58e654.msi msiexec.exe File opened for modification C:\Windows\Installer\e58e654.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.99989801.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 14 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F} windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F} windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000" windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F} windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.10 (x64)" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\ = "{866BECDA-F284-473A-9E84-0CCE816BF06F}" windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.10 (x64)" windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.40.55332" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F} windowsdesktop-runtime-10.0.10-win-x64.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 4188 MagicChatbox.exe Token: SeShutdownPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeIncreaseQuotaPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSecurityPrivilege 2560 msiexec.exe Token: SeCreateTokenPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeLockMemoryPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeIncreaseQuotaPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeMachineAccountPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeTcbPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSecurityPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeTakeOwnershipPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeLoadDriverPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSystemProfilePrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSystemtimePrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeProfSingleProcessPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeIncBasePriorityPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeCreatePagefilePrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeCreatePermanentPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeBackupPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeRestorePrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeShutdownPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeDebugPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeAuditPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSystemEnvironmentPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeChangeNotifyPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeRemoteShutdownPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeUndockPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSyncAgentPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeEnableDelegationPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeManageVolumePrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeImpersonatePrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeCreateGlobalPrivilege 2364 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeBackupPrivilege 4676 dw20.exe Token: SeBackupPrivilege 4676 dw20.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4188 wrote to memory of 1808 4188 MagicChatbox.exe 96 PID 1808 wrote to memory of 4044 1808 windowsdesktop-runtime-10.0.10-win-x64.99989801.exe 97 PID 1808 wrote to memory of 2364 1808 windowsdesktop-runtime-10.0.10-win-x64.99989801.exe 98 PID 3924 wrote to memory of 3976 3924 windowsdesktop-runtime-10.0.10-win-x64.exe 102 PID 2560 wrote to memory of 3952 2560 msiexec.exe 104 PID 4188 wrote to memory of 4676 4188 MagicChatbox.exe 105 PID 3976 wrote to memory of 1948 3976 windowsdesktop-runtime-10.0.10-win-x64.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\MagicChatbox.exe"C:\Users\Admin\AppData\Local\Temp\MagicChatbox.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.99989801.exe"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.99989801.exe" "/install" "/quiet" "/norestart"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\wixstdba.exe"C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6A754FF2-A988-445B-B4A2-25ACF5B62B69} {AAD1CAB0-46DD-4B01-84D8-7A23CA9A4023}3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4044
-
-
C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{F6A78011-7003-488E-8CB9-7FA95BA50ACC} {134B89D4-59E7-480A-B278-406CAEF8A8F9} 18083⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 47922⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 19D418F4EC63DE13AECBE4093E472E822⤵
- Loads dropped DLL
PID:3952
-
-
C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260718232756.log" /quiet /install /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\TEMP\{2F93216E-CEFB-4395-A336-A6CF16C3DC89}\.ba\wixstdba.exe"C:\Windows\TEMP\{2F93216E-CEFB-4395-A336-A6CF16C3DC89}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9196C73F-0A7C-4E36-86BF-0F2812A28BC0} {6D8CEFCC-BA99-4706-8AAE-8CF24858A265}3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\dotnet\ThirdPartyNotices.txt
- Size 77KB
- SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
- MD5 0d8867a25ba926e6e40cd52ab3536b5c
- SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
- SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
- SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
- TLSH T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 163KB
- SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
- MD5 363603c51aa522bf21b2e8320a51c54e
- SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
- SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
- SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
- TLSH T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260718232756.log
- Size 22KB
- SHA256 dda7f4f37a93fa7b10375d503b78047e80c1f2e26f8da4e6818ee8069f450c0f
- MD5 206dae534a8e9acd9c708203adc1640e
- SHA1 920cde30d9f6b1d858c1031dfb8ff04e25165bdb
- SHA512 23abe8c1240a5cf6cb97b2e8241253deaee7a085672a8eef94ebee04e30e24e9f645159a7f0ce72be7f546ef598f27c9a978ecfe45973228d51128f9e5b8482e
- SSDEEP 384:OIEzk1loi05NQF5K35Kh5Ku5KxVgyg4IWdhd9UW+A:mgFU3UhUuUxj
- TLSH T140B201066DF496033C71925AE92E4B9CEFF6B409B25824F877F3010CA7A1C276E5E9D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260718232756_000_DotNetHost.log
- Size 4KB
- SHA256 f8faab146c8c029ad18beb74c44efe2885aee3bd29a1b58d5e73d9a341169719
- MD5 721ab1190043a938185f489e12429a58
- SHA1 4217383a74594dc86966ddbb0fbeb1f26458c399
- SHA512 5ebd7e324ac543570164fa9536dae8b646c7055585e3181238d006f12c88f7ad2e2ec6bd8c5b3ccdf18ded0df8b45853dc1c1145841e552e86f247c7c38ecbe5
- SSDEEP 96:YKt+05d2jyzdvZOOIjVKFZf8hiivPhDhlXhpHh8vlhp5hG2hUKFMth6:htV5doELOOIjVKFqhvhDhlh5hEh3hHhV
- TLSH T1DF811D2D1BE50948B1B3DB479AF780526633BCD75830DF0D22C5431A416B809A9EDBEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\DotNetHost
- Size 1012KB
- SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
- MD5 667bbe018d9a8052f0ed4d4b44a02ec8
- SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
- SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
- SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
- TLSH T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\DotNetHostFxr
- Size 1.1MB
- SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
- MD5 ecd6f2e85cdb3623db79832c198448b2
- SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
- SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
- SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
- TLSH T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\DotNetRuntime
- Size 28.2MB
- SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
- MD5 8fe07617a818797bf2170e4ca5f4bb95
- SHA1 126523726901f0a1129d9066c369f963f1ef5854
- SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
- SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
- TLSH T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\WindowsDesktopRuntime
- Size 28.8MB
- SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
- MD5 b76d067851e1d31cc6c6f00bd68d078b
- SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
- SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
- SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
- TLSH T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE75D.tmp
- Size 392KB
- SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
- MD5 f1fafe5c54813a5d7b60d08b859bd58b
- SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
- SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
- SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
- TLSH T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\BootstrapperApplicationData.xml
- Size 9KB
- SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
- MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
- SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
- SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
- SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
- TLSH T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\DotNetLogo_256x.png
- Size 2KB
- SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
- MD5 39aa52615723b782c92dec710caaec7f
- SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
- SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
- TLSH T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\dotnet.ico
- Size 44KB
- SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
- MD5 b8096652d9ec286709a2c863b244b110
- SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
- SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
- SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
- TLSH T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\thm.wxl
- Size 7KB
- SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
- MD5 8b2c667a8bbad3153068c0ed90df7ec4
- SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
- SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
- SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
- TLSH T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\thm.xml
- Size 11KB
- SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
- MD5 4329e418dc56b1386d7ea29a0dcfab5b
- SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
- SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
- SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
- TLSH T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.ba\wixstdba.exe
- Size 431KB
- SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
- MD5 0e88ffd2e737ac9b9a4241616838bc23
- SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
- SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
- SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
- TLSH T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A4AA3B8E-5BD7-409C-B162-A08B065B7135}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
- Size 967KB
- SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
- MD5 0f57602b1b78b077a5b0e996ef306a7d
- SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
- SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
- SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
- TLSH T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
- MD5 SHA1 SHA512 SSDEEP TLSH