Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BullitExcelAddin64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
BullitExcelAddin64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target BullitExcelAddin64.msi
- Size 6.4MB
- Sample260727-ppaxpascjd
- SHA256 924137d4a27c0cdd65d689d76f83550061a7d1fadd0cb034014c2e1c1e095bb9
- MD5 475f0a135c4959b293e9e33c3786bb97
- SHA1 9fd14378f2b222c998f0c13e454c0cb988038b4a
- SHA512 a2552f3bdf7d53d2f3bded0c7438bd55a6dbecd3fe21fb7b3594f99eca2e2b0777b14b21bf08491446bfeec08d3e608c927d23da002c7737ea160748ca90e486
- SSDEEP 98304:GxMKINemrgobgeqMe6koIYU3IJSBkRYSqLx1YDiqBUUW1k8QXp2ZEP:GmKuemuPALM3IIBqYSqLx1YD9BPEQXq
- TLSH T1E866BF21B94DC136D66E06B09D3EDB9BA53C6DB20BB048DBA3D4B88A59304C39335F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 12 IoCs
pid Process 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2924 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 3452 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe Token: SeLockMemoryPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeMachineAccountPrivilege 2924 msiexec.exe Token: SeTcbPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 2924 msiexec.exe Token: SeTakeOwnershipPrivilege 2924 msiexec.exe Token: SeLoadDriverPrivilege 2924 msiexec.exe Token: SeSystemProfilePrivilege 2924 msiexec.exe Token: SeSystemtimePrivilege 2924 msiexec.exe Token: SeProfSingleProcessPrivilege 2924 msiexec.exe Token: SeIncBasePriorityPrivilege 2924 msiexec.exe Token: SeCreatePagefilePrivilege 2924 msiexec.exe Token: SeCreatePermanentPrivilege 2924 msiexec.exe Token: SeBackupPrivilege 2924 msiexec.exe Token: SeRestorePrivilege 2924 msiexec.exe Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeDebugPrivilege 2924 msiexec.exe Token: SeAuditPrivilege 2924 msiexec.exe Token: SeSystemEnvironmentPrivilege 2924 msiexec.exe Token: SeChangeNotifyPrivilege 2924 msiexec.exe Token: SeRemoteShutdownPrivilege 2924 msiexec.exe Token: SeUndockPrivilege 2924 msiexec.exe Token: SeSyncAgentPrivilege 2924 msiexec.exe Token: SeEnableDelegationPrivilege 2924 msiexec.exe Token: SeManageVolumePrivilege 2924 msiexec.exe Token: SeImpersonatePrivilege 2924 msiexec.exe Token: SeCreateGlobalPrivilege 2924 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe Token: SeLockMemoryPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeMachineAccountPrivilege 2924 msiexec.exe Token: SeTcbPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 2924 msiexec.exe Token: SeTakeOwnershipPrivilege 2924 msiexec.exe Token: SeLoadDriverPrivilege 2924 msiexec.exe Token: SeSystemProfilePrivilege 2924 msiexec.exe Token: SeSystemtimePrivilege 2924 msiexec.exe Token: SeProfSingleProcessPrivilege 2924 msiexec.exe Token: SeIncBasePriorityPrivilege 2924 msiexec.exe Token: SeCreatePagefilePrivilege 2924 msiexec.exe Token: SeCreatePermanentPrivilege 2924 msiexec.exe Token: SeBackupPrivilege 2924 msiexec.exe Token: SeRestorePrivilege 2924 msiexec.exe Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeDebugPrivilege 2924 msiexec.exe Token: SeAuditPrivilege 2924 msiexec.exe Token: SeSystemEnvironmentPrivilege 2924 msiexec.exe Token: SeChangeNotifyPrivilege 2924 msiexec.exe Token: SeRemoteShutdownPrivilege 2924 msiexec.exe Token: SeUndockPrivilege 2924 msiexec.exe Token: SeSyncAgentPrivilege 2924 msiexec.exe Token: SeEnableDelegationPrivilege 2924 msiexec.exe Token: SeManageVolumePrivilege 2924 msiexec.exe Token: SeImpersonatePrivilege 2924 msiexec.exe Token: SeCreateGlobalPrivilege 2924 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe Token: SeLockMemoryPrivilege 2924 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2924 msiexec.exe 2924 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2924 msiexec.exe 3452 msiexec.exe 2484 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3452 wrote to memory of 2484 3452 msiexec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BullitExcelAddin64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9D47DBF3FCAFB27D8C14248E1F59F0E1 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSID6CE.tmp
- Size 1.1MB
- SHA256 021242629aeef982a9c33846cdaf5cce15f3e4eda1c12fe2360797837089c29a
- MD5 0c48d9c98d163cd4e852b8ae0c2307e2
- SHA1 e6f0ff0cac178eb20138dc3f6ff0dd18faa7960e
- SHA512 45632223ef5dc76bf68d69137b89c34b9740ac7189cb00289d94828087a098f999a38e5eb9e91e55627dfe16f09e7f71124f2d1cf4169caeed2618e6b6defa89
- SSDEEP 24576:Xa/JMKINr6mHLb9K70xMYpPtOby4eMh0lhSMXl25etobSst+qXkh:XaxMKINemrgobVOby4exoeESst+qXkh
- TLSH T1D1456C713A8EC037D75E1BB06A3DCA9E912D7DB90B7188C7A7D86D9A54704C21732E23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIDDE8.tmp
- Size 999KB
- SHA256 113cf8da1136187e3aa2ac96cc29c21ebb92a29dcf9e4eeaa36524c00dee8e76
- MD5 5a175789c1c387fc5e2e88a379e54f72
- SHA1 78a986824a9253fe7e0d60aa205d34e491b1a2d3
- SHA512 de00e08fb415715ab89f3fe81be680645efec34b2a2c50f38ed0577688d0e0220ff4fb4f11d7ea2e2fb3d526258151a977c1d3adc5ca3a2e171bc8f5479e7cc4
- SSDEEP 24576:na0GSBOWbGXd/kDyIsmUi4pHOiY8nYn7VIsh0lhSMXlfoyS2uT+UGXaY:naJSB2RkLiVnYnSRJSXT+UGXaY
- TLSH T1B6257B21754AC43AF56D06F26A3CDBAB923CAD790FB114C773D4AD6A2C704C26239E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIDF02.tmp
- Size 1.3MB
- SHA256 10041098189567c4dd8e03892f04f83b3f4171cea5745b24effd0f4578a8b533
- MD5 118eccbb25cdd10e8fbf43f39993a360
- SHA1 b648d387e4114bd6a594dd475264aa8d0bf4612d
- SHA512 d6b70af955b5a177e5217208555be617c66957c24274b1ca9f82cff5935e9e873a6228625b91a2152ee236a98f9fa51763b42c3c34d91c72c19bbccaab31c29e
- SSDEEP 24576:bsqbJNf3q890cHMMuzFG8ckKe6kV6fPIO9Fh0lhSMXlgSN8xLYmuu+XE3vPPEk4D:1sMwG8ckKe6kUfPIYcQSNsLYmuu+XE3e
- TLSH T119551A21BC4C46B5E76F89309E17A696ED6C25D21BA48CFF51E0D48696312C3C331FBA
- MD5 SHA1 SHA512 SSDEEP TLSH