Analysis
- user interaction
yes - max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BBSAKv1.9.2_Installer.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
BBSAKv1.9.2_Installer.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target BBSAKv1.9.2_Installer.msi
- Size 1.3MB
- Sample260721-wyncpszshs
- SHA256 f7dfc6796763a5bece671610081314f533aae6d7ed944a38119feac25f5ab8ed
- MD5 75abe984688fef846ab7af0f36dd6e73
- SHA1 8d1b525728668555bf1494cd40c27dc8065f9af3
- SHA512 bb4ff812ebbe5f371aac2c049e8af3fa7da4f2f1d4ef854e49b85d6d82f5429ac59a338db75f8aa26d1ff7dd82496ca6b1ee06c6a2ab3e5a40b6d0b58f7eff13
- SSDEEP 24576:Wi2G1n9AGyaBlE+0UsvTSiJF261LuVqLyiiT6WCRjEVydeC6QlyilChllk:Wi2G19HBlEvpvTLJF269q6zk7C6nyCy
- TLSH T15B55E12037C6DB31C1C321B4926EA7204679AC203B65CD8372D43BDE6971BE1AF6579B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 4716 MsiExec.exe 4716 MsiExec.exe 1816 MsiExec.exe 1816 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\BBSAK\Language.txt msiexec.exe File created C:\Program Files (x86)\BBSAK\BBSAK.exe msiexec.exe File created C:\Program Files (x86)\BBSAK\javaloader.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF29BADBEA14B1B29C.TMP msiexec.exe File created C:\Windows\Installer\e59b5d9.msi msiexec.exe File opened for modification C:\Windows\Installer\e59b5d9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF0FD44213B1A3A470.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBDBA.tmp msiexec.exe File created C:\Windows\Installer\e59b5db.msi msiexec.exe File created C:\Windows\SystemTemp\~DF672E6BD3E072D2CB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB7CD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBCA0.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF3560C2DB30A08B27.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B23F12D4-17DE-453A-B1F4-55E501FE0EBF} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3124 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2304 msiexec.exe 2304 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3124 msiexec.exe Token: SeIncreaseQuotaPrivilege 3124 msiexec.exe Token: SeSecurityPrivilege 2304 msiexec.exe Token: SeCreateTokenPrivilege 3124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3124 msiexec.exe Token: SeLockMemoryPrivilege 3124 msiexec.exe Token: SeIncreaseQuotaPrivilege 3124 msiexec.exe Token: SeMachineAccountPrivilege 3124 msiexec.exe Token: SeTcbPrivilege 3124 msiexec.exe Token: SeSecurityPrivilege 3124 msiexec.exe Token: SeTakeOwnershipPrivilege 3124 msiexec.exe Token: SeLoadDriverPrivilege 3124 msiexec.exe Token: SeSystemProfilePrivilege 3124 msiexec.exe Token: SeSystemtimePrivilege 3124 msiexec.exe Token: SeProfSingleProcessPrivilege 3124 msiexec.exe Token: SeIncBasePriorityPrivilege 3124 msiexec.exe Token: SeCreatePagefilePrivilege 3124 msiexec.exe Token: SeCreatePermanentPrivilege 3124 msiexec.exe Token: SeBackupPrivilege 3124 msiexec.exe Token: SeRestorePrivilege 3124 msiexec.exe Token: SeShutdownPrivilege 3124 msiexec.exe Token: SeDebugPrivilege 3124 msiexec.exe Token: SeAuditPrivilege 3124 msiexec.exe Token: SeSystemEnvironmentPrivilege 3124 msiexec.exe Token: SeChangeNotifyPrivilege 3124 msiexec.exe Token: SeRemoteShutdownPrivilege 3124 msiexec.exe Token: SeUndockPrivilege 3124 msiexec.exe Token: SeSyncAgentPrivilege 3124 msiexec.exe Token: SeEnableDelegationPrivilege 3124 msiexec.exe Token: SeManageVolumePrivilege 3124 msiexec.exe Token: SeImpersonatePrivilege 3124 msiexec.exe Token: SeCreateGlobalPrivilege 3124 msiexec.exe Token: SeCreateTokenPrivilege 3124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3124 msiexec.exe Token: SeLockMemoryPrivilege 3124 msiexec.exe Token: SeIncreaseQuotaPrivilege 3124 msiexec.exe Token: SeMachineAccountPrivilege 3124 msiexec.exe Token: SeTcbPrivilege 3124 msiexec.exe Token: SeSecurityPrivilege 3124 msiexec.exe Token: SeTakeOwnershipPrivilege 3124 msiexec.exe Token: SeLoadDriverPrivilege 3124 msiexec.exe Token: SeSystemProfilePrivilege 3124 msiexec.exe Token: SeSystemtimePrivilege 3124 msiexec.exe Token: SeProfSingleProcessPrivilege 3124 msiexec.exe Token: SeIncBasePriorityPrivilege 3124 msiexec.exe Token: SeCreatePagefilePrivilege 3124 msiexec.exe Token: SeCreatePermanentPrivilege 3124 msiexec.exe Token: SeBackupPrivilege 3124 msiexec.exe Token: SeRestorePrivilege 3124 msiexec.exe Token: SeShutdownPrivilege 3124 msiexec.exe Token: SeDebugPrivilege 3124 msiexec.exe Token: SeAuditPrivilege 3124 msiexec.exe Token: SeSystemEnvironmentPrivilege 3124 msiexec.exe Token: SeChangeNotifyPrivilege 3124 msiexec.exe Token: SeRemoteShutdownPrivilege 3124 msiexec.exe Token: SeUndockPrivilege 3124 msiexec.exe Token: SeSyncAgentPrivilege 3124 msiexec.exe Token: SeEnableDelegationPrivilege 3124 msiexec.exe Token: SeManageVolumePrivilege 3124 msiexec.exe Token: SeImpersonatePrivilege 3124 msiexec.exe Token: SeCreateGlobalPrivilege 3124 msiexec.exe Token: SeCreateTokenPrivilege 3124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3124 msiexec.exe Token: SeLockMemoryPrivilege 3124 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3124 msiexec.exe 3124 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3124 msiexec.exe 2304 msiexec.exe 4716 MsiExec.exe 1816 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2304 wrote to memory of 4716 2304 msiexec.exe 90 PID 2304 wrote to memory of 2560 2304 msiexec.exe 96 PID 2304 wrote to memory of 1816 2304 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BBSAKv1.9.2_Installer.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3124
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 75B3FD28B02BB448405B201598E53479 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4716
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2560
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DF06C268B0AC5BB0937C7E08D2059C092⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59b5da.rbs
- Size 9KB
- SHA256 c14c20d325030c453311ad0681b055c79f7e252ee55a136830cb0ec525dcf8cc
- MD5 1837bc23eb3ad2efe3a9b62cd79727e2
- SHA1 a9bb283664077c9fb9035e6c37c26bbe8b4c0793
- SHA512 8012bb4c7e66026b498c131537b62ccab8b3f5a872702dd759e39059974d20db52f673f73bee5ba912f930495e853cc275ede45e17092203dfd99e1e61fdbb2c
- SSDEEP 192:j2KC0fOpnxiJnIdnxiJnpj0S2sFyoliLFd33kp6fhPNCx8ZXN:j2SfGuaup07sFhliLFd3rJPNCx8ZXN
- TLSH T13C125210B600C2E3E96A2B38E7134B5177B6D3C9C680771F1DCD84A90F42B9A6B5DAC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1B5E.tmp
- Size 221KB
- SHA256 ba56a2fa13e5dae48b6d74a8fa40f2f44473b386e71ba1e7ec2ded90ad56bb8b
- MD5 911aa8d08b7ccab654e897b0e4439354
- SHA1 4f4f16048deae47a2ff5b9849042f62ec51794bc
- SHA512 8aa11f26093e54a62c5390c64e218a8a57cd3374bbce8ecc243042dd8a2214ede1f3befa699837698c0bd42b9b4e011f95c62588b8bdd4da9aae12dabe4b46e4
- SSDEEP 3072:oCwtulBs61sjBGyhrhirKFalevt64totKL7BCSj086gbTv075x2K1kv398G8Haf1:3o9hEcaGt5PBCSnR/c/LSP9tRzSQ
- TLSH T122245B2136D0D131E5E321B846ACA6711ABEF5B15B70C5C7B38407EE9AB17D0AB3874B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59b5d9.msi
- Size 1.3MB
- SHA256 f7dfc6796763a5bece671610081314f533aae6d7ed944a38119feac25f5ab8ed
- MD5 75abe984688fef846ab7af0f36dd6e73
- SHA1 8d1b525728668555bf1494cd40c27dc8065f9af3
- SHA512 bb4ff812ebbe5f371aac2c049e8af3fa7da4f2f1d4ef854e49b85d6d82f5429ac59a338db75f8aa26d1ff7dd82496ca6b1ee06c6a2ab3e5a40b6d0b58f7eff13
- SSDEEP 24576:Wi2G1n9AGyaBlE+0UsvTSiJF261LuVqLyiiT6WCRjEVydeC6QlyilChllk:Wi2G19HBlEvpvTLJF269q6zk7C6nyCy
- TLSH T15B55E12037C6DB31C1C321B4926EA7204679AC203B65CD8372D43BDE6971BE1AF6579B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 d2df27a0edf4a3efaf73bf37b772cc2df05cb8a5e55bd942ff422acba4ee7820
- MD5 86a03e05a086fa13181ad7656c1cacaf
- SHA1 d3845ed1ef83c288854b9447ad344925c50e1a4b
- SHA512 7c3d596e926f0b64edf9615dd23fca20f0f22d258bf60ec6bdcd7bbad458fe3a2526cd18ef62418497ebc09299d65cd118610c2f8bfe710bd4de94fc415f3833
- SSDEEP 24576:bFo3DMPddoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:zH0
- TLSH T1E357B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{08bf0ada-c048-4a52-8ece-3dc6a990bbc1}_OnDiskSnapshotProp
- Size 6KB
- SHA256 81162041ba248eac1ec20e856b5a84751cae00b8322c98b5168f244fffaeb60d
- MD5 ccc4946ec96fa4c320052d9c1b4e8e61
- SHA1 247bfce86fdcdc78f4690d44ec8a0e38affe8f25
- SHA512 33eb3dc4ee03599a20e0a8b788d28a0a0d1e7d6d11ba8ae2d511ec085912e4443dfb8b3feb423960bbe7ffb2ee5241bb595f7ee181d86735213a9fd4f6ed91b8
- SSDEEP 96:Fu8W5mAlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:ALZl/b++uVmN
- TLSH T146D1890C5AF54711E2B3AB3229F14557A837B911EF33CB8E0198238E6671910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH