Overview

overview

6

Static

static

1

windowsdes...64.exe

windows10-2004-x64

6

windowsdes...64.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    25s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    windowsdesktop-runtime-10.0.10-win-x64.exe
  • Size 57.3MB
  • Sample260803-vb39zacd49
  • SHA256 e82fc901c8f52d716293b2bc0830ce0dd254a06268c457a19e8fc503560a84d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F13DE747-13EF-4EE2-A834-08D70BBF6D5D} {345454C6-77EC-47E8-8FEA-B609C9CA97A8}
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:2276
    • C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{A0C3F9A5-F3DA-4052-8475-E0C1541BC523} {BC1D66BF-0865-46EF-9CD1-40412D030B38} 4400
      2⤵
      • Adds Run key to start application
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:984
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 8B9CEF07BB407D492D0B97B6808A7178
      2⤵
      • Loads dropped DLL
      PID:3256
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 361751315597D7438590201B6ACAA46D
      2⤵
      • Loads dropped DLL
      PID:784
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 93FC4EE8408D543A01EECBD4676967BC
      2⤵
      • Loads dropped DLL
      PID:4840
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 7B3F973FC7D66AE2AA48F0D3457C64EA
      2⤵
      • Loads dropped DLL
      PID:4352
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 14CE5F3D401797A2DF5442CCBD7E7CBD
      2⤵
      • Loads dropped DLL
      PID:3216
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 64F816267970B3D92B55F961F1513584
      2⤵
        PID:1968
    • C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
        "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024.log"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\TEMP\{9340AC67-9E76-4371-8D02-83322314CF4E}\.ba\wixstdba.exe
          "C:\Windows\TEMP\{9340AC67-9E76-4371-8D02-83322314CF4E}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C6A1FD22-7DA2-4199-9C17-7362846455D6} {F062C9DA-A69D-4B04-87FB-E4BFAE2F01B9}
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:3836
        • C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
          "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{17B3B1B7-4C91-4439-8384-DFE63A08BD91} {A02E3B9C-8833-43D4-BAD4-508993F3D2E9} 4324
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5092

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57fb4b.rbs
          • Path C:\Config.Msi\e57fb4b.rbs
          • Size 11KB
          • SHA256 a1c938b4f7303b1c17dce0107142251411c9e91af0c231fcb8a77709e20b9514
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e57fb52.rbs
          • Path C:\Config.Msi\e57fb52.rbs
          • Size 9KB
          • SHA256 821254cda8a426f24ce2bf09a66e4074684ee5e7af6afb755805fb9cf06ee37e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e57fb57.rbs
          • Path C:\Config.Msi\e57fb57.rbs
          • Size 49KB
          • SHA256 b72f2b85d6da02f7aeab28cfb37d7061681c25d23756647b894bc0990a1bd081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e57fb5c.rbs
          • Path C:\Config.Msi\e57fb5c.rbs
          • Size 71KB
          • SHA256 b1e16e9c89f40af096a779ecb12d9f5e96bf5f87686e26c1fa24b674d95761b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ThirdPartyNotices.txt
          • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
          • Size 77KB
          • SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe
          • Path C:\Program Files\dotnet\dotnet.exe
          • Size 163KB
          • SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft Windows Desktop Runtime 10.0.10 (x64).swidtag
          • Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.10 (x64).swidtag
          • Size 490B
          • SHA256 ebb47332987c9d8f004eb95ece7ba1e1880a26d88b376f3133b64e9c0e491e0e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
          • Size 1KB
          • SHA256 7dfa95a7bed547c31fedeb2dc8a3312cc33575674483fe05e2dd7fededb6abe6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_000_DotNetHost.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_000_DotNetHost.log
          • Size 2KB
          • SHA256 94e10e311993f43a124829473338c52bf0c84e3e9e8b6a7fe271a276b3c3fc7c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_001_DotNetHostFxr.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_001_DotNetHostFxr.log
          • Size 2KB
          • SHA256 47aee843ec74a20f26dd20b9afb0448a0d76b5f78ae24b7cde9924eff60c77e2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_002_DotNetRuntime.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_002_DotNetRuntime.log
          • Size 2KB
          • SHA256 5894ac7404b7d47d6e5dac44d66331220ac7cdb2c6bcc72cd5beb2a363e2bd80
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_003_WindowsDesktopRuntime.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260803175024_003_WindowsDesktopRuntime.log
          • Size 2KB
          • SHA256 861b2f5dabdf0a5cbb910b495214b9d9b82c7762240f300e287229ecddebdeb8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DotNetHost
          • Path C:\Users\Admin\AppData\Local\Temp\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\DotNetHost
          • Size 1012KB
          • SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DotNetHostFxr
          • Path C:\Users\Admin\AppData\Local\Temp\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\DotNetHostFxr
          • Size 1.1MB
          • SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DotNetRuntime
          • Path C:\Users\Admin\AppData\Local\Temp\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\DotNetRuntime
          • Size 28.2MB
          • SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsDesktopRuntime
          • Path C:\Users\Admin\AppData\Local\Temp\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\WindowsDesktopRuntime
          • Size 28.8MB
          • SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI24D.tmp
          • Path C:\Windows\Installer\MSI24D.tmp
          • Size 392KB
          • SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\BootstrapperApplicationData.xml
          • Size 9KB
          • SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DotNetLogo_256x.png
          • Path C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\DotNetLogo_256x.png
          • Size 2KB
          • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dotnet.ico
          • Path C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\dotnet.ico
          • Size 44KB
          • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\thm.wxl
          • Size 7KB
          • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\TEMP\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\thm.xml
          • Size 11KB
          • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.exe
          • Path C:\Windows\Temp\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.ba\wixstdba.exe
          • Size 431KB
          • SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windowsdesktop-runtime-10.0.10-win-x64.exe
          • Path C:\Windows\Temp\{364ED2F4-B646-42AA-BBAF-2501A256C6EC}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
          • Size 967KB
          • SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download