Analysis
- user interaction
yes - max time kernel
31s - max time network
33s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
Setup for Outlook.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup for Outlook.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Setup for Outlook.exe
- Size 39.0MB
- Sample260804-c8fk3abg72
- SHA256 909efe01acf7a77071886f875fffc45ac970d7572a0f117c67f759e2c5ba8cd6
- MD5 24c83c93ffa7821e52b4cc380790a776
- SHA1 c55447523efa71fcbdc8717a526e9fc304a90cbe
- SHA512 95b90ab034c52b28ef9d63907fcb2737418b9da0f1994fca2917ff4fb393d89fda030492800635d5a6c6fa350d0ae30b0b0f70a8b3165535aefed14ebc953863
- SSDEEP 786432:bQF24UlakWss09pMXFqCs3YXjeA1qCQRIjG:bYDbkW4pMXns3YqbRIq
- TLSH T18897CF390E4A45B9A3BDBB571E37B64003E882F9B181BF78A94104C616E1FEE5CE5D43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: MSIEXEC.EXE - Loads dropped DLL 6 IoCs
pid Process 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup for Outlook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4468 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4468 MSIEXEC.EXE Token: SeSecurityPrivilege 4308 msiexec.exe Token: SeCreateTokenPrivilege 4468 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 4468 MSIEXEC.EXE Token: SeLockMemoryPrivilege 4468 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4468 MSIEXEC.EXE Token: SeMachineAccountPrivilege 4468 MSIEXEC.EXE Token: SeTcbPrivilege 4468 MSIEXEC.EXE Token: SeSecurityPrivilege 4468 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 4468 MSIEXEC.EXE Token: SeLoadDriverPrivilege 4468 MSIEXEC.EXE Token: SeSystemProfilePrivilege 4468 MSIEXEC.EXE Token: SeSystemtimePrivilege 4468 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 4468 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 4468 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 4468 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 4468 MSIEXEC.EXE Token: SeBackupPrivilege 4468 MSIEXEC.EXE Token: SeRestorePrivilege 4468 MSIEXEC.EXE Token: SeShutdownPrivilege 4468 MSIEXEC.EXE Token: SeDebugPrivilege 4468 MSIEXEC.EXE Token: SeAuditPrivilege 4468 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 4468 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 4468 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 4468 MSIEXEC.EXE Token: SeUndockPrivilege 4468 MSIEXEC.EXE Token: SeSyncAgentPrivilege 4468 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 4468 MSIEXEC.EXE Token: SeManageVolumePrivilege 4468 MSIEXEC.EXE Token: SeImpersonatePrivilege 4468 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 4468 MSIEXEC.EXE Token: SeCreateTokenPrivilege 4468 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 4468 MSIEXEC.EXE Token: SeLockMemoryPrivilege 4468 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4468 MSIEXEC.EXE Token: SeMachineAccountPrivilege 4468 MSIEXEC.EXE Token: SeTcbPrivilege 4468 MSIEXEC.EXE Token: SeSecurityPrivilege 4468 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 4468 MSIEXEC.EXE Token: SeLoadDriverPrivilege 4468 MSIEXEC.EXE Token: SeSystemProfilePrivilege 4468 MSIEXEC.EXE Token: SeSystemtimePrivilege 4468 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 4468 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 4468 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 4468 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 4468 MSIEXEC.EXE Token: SeBackupPrivilege 4468 MSIEXEC.EXE Token: SeRestorePrivilege 4468 MSIEXEC.EXE Token: SeShutdownPrivilege 4468 MSIEXEC.EXE Token: SeDebugPrivilege 4468 MSIEXEC.EXE Token: SeAuditPrivilege 4468 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 4468 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 4468 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 4468 MSIEXEC.EXE Token: SeUndockPrivilege 4468 MSIEXEC.EXE Token: SeSyncAgentPrivilege 4468 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 4468 MSIEXEC.EXE Token: SeManageVolumePrivilege 4468 MSIEXEC.EXE Token: SeImpersonatePrivilege 4468 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 4468 MSIEXEC.EXE Token: SeCreateTokenPrivilege 4468 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 4468 MSIEXEC.EXE Token: SeLockMemoryPrivilege 4468 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4468 MSIEXEC.EXE 4468 MSIEXEC.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3888 wrote to memory of 4468 3888 Setup for Outlook.exe 85 PID 4308 wrote to memory of 1872 4308 msiexec.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup for Outlook.exe"C:\Users\Admin\AppData\Local\Temp\Setup for Outlook.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\Mail Merge Toolkit.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4468
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 575FD1EE0A6A181AD97EE83BFE2A279A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1872
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI63C6.tmp
- Size 62KB
- SHA256 cd05434124848ef9e7a20863350445b60b09dc1c065d2b083aa5f9e4ee46df61
- MD5 3c2b341d4952169e5e5d55896804f802
- SHA1 5ababf93bc2c7f6e73e072f0c01894a82739d64e
- SHA512 31c7c98c73aa179c78dd9a86077b981ae77174b0f715355970ce18ffbe2c734a955b72bf2d603b3d6652f14d381047d08b68a247fbe1972e0eac236308a7f07e
- SSDEEP 768:Z0J8+QCTqaxxKkUmFVSarTJym3OZESrcvFKUPwPPOJh2Ip41bxf1mlbN5+:1CTqYttXDJT+lcrPwPs893fIbT+
- TLSH T1B253AF4569E140B3CB879A3151E5DF17BF3E6B921EE144839FF299960D273C0E33A20A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6BD5.tmp
- Size 778KB
- SHA256 d03a3d943fa24e54f473e9cf721ed2944d5627a150b7b745394b6d9b84b0c96d
- MD5 3275aa7a02d4ab48b31224a2996f5806
- SHA1 264beaee8e160c61a5e0fe69eebbd0b4bca9e452
- SHA512 d1bda3f03521aedbcb0f5277e5de413e10661ca95e027fd96298a8f07a51b93af72a9e85cae74fbd95eb991125f199c87d1a87e13ce38646254101c85eec19d2
- SSDEEP 12288:oRkxFDNAq643SbQC4kvUrnJZjwJQaS+IS0oa3Q20eI8wdVasIBfA2xCS:PxZ3wJooa3FvI8wdVasIhM
- TLSH T1C6059E01FB89C179CA4E1577507FA71E217AA6A65F308BC3B6846B6DDD302C1BD3E206
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6CFF.tmp
- Size 94KB
- SHA256 2118aed32903188abab59d4cd7846fef4723a520d485e71245bd1243681988ae
- MD5 24e9a52029733e90ea43ab278fac0db4
- SHA1 d74dfa01f1001529385f8bbb668f47d5bd2148c8
- SHA512 527d3982f59866eb9abdf16032127b4730d4e348e0e67b8d585ab2c2337cf847f8b6a1222ccaa98ae8a94bfcb17828158ed0ea40353e708d4af5901312dd949e
- SSDEEP 1536:eivk7DtT4NxMQxmWthib9C0X/niKJK+TcAyc/idw5eEPwPs89cfIbT7IQ:3cnsx1FTidK+TcAyc/i254bXB
- TLSH T195939E1175A482B3C289453095A5CF37EB7DBF920FF184C3D769EA891C617D0E33A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\0x0409.ini
- Size 5KB
- SHA256 57e020c41ad0566fb55415a40167a0c3da89584bc4e5f961d8e8c646f80c5590
- MD5 52d179ad79966752ec40a678fd8b0062
- SHA1 f12df9b03090286d1093b5421aea3acc358cc032
- SHA512 b5fb5002f1947a765a83c9a960c378b04adfe7acebbd8be79dca07c73d7ff96f5e988d8b6995c8ba6156a74ecdb0084e543090704080ea3095dbb80835cdf9c5
- SSDEEP 96:VXoB2Ahl8/T3INLfRtMx76U0KOFWgVQMG2Uub0QAg80SbtEBapIx0KsLK3E0cTBY:JIYT3wLfRA0v/tBAvCSEB90C
- TLSH T189C1754E4FA6837E2861031AB16F2650F326956D5363D167B1EF005C7383E1893BB6E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\1033.MST
- Size 32KB
- SHA256 2db94bfb262a2c7143a4cbca182153fce829432957cd1793831d70552eeae26d
- MD5 7453b1be12256c57df9bbb63b4e9060e
- SHA1 5167589e9544bfe97f66ca00a5deb1212b14dc54
- SHA512 b9e765b377ff59f9e5eb096dbef27ccd2d1c45b3e2978aa6c627bf8a99e6280997d6004d06328c1b6445f077a247d0e6b46e9520f8b65eb452300df848f2d560
- SSDEEP 96:avnCk7jkinnutjmGJB6u+qc2/FdOI6xrwult/c8fk4+LE/FpsWbqBYJuxrv87dC+:K7dxGJoB2/FYEWs4/FZoxT
- TLSH T19AE21B2A32145333C28801B15F5AC1DE733AEC65B9EBD223B491F35F13379762AA24D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\Mail Merge Toolkit.msi
- Size 38.6MB
- SHA256 25fe808754c6655a394bfdf8587ba5e5e7a87e88bc452aa637664db424dc9453
- MD5 48c14266a6e39df5daf15c0c417189c2
- SHA1 717aac44dca22789dc4494e6f957a7d29814f8d5
- SHA512 6b492d621c662d4c273895be1e8d92654f7374853b8dcd28584fd3ab4a0fda6093b2642300d985371f411e029451245187dd2b244431dccaa0345b06855828b9
- SSDEEP 786432:0U18ntnb1fuBfRLIPy+xaqYTK8AktPYXTH2sb1YVV:0u8ntnVuBfRsPy+xl7GPYXrrhYV
- TLSH T1ED97CF01F221C129F5AF14B6E9BE9E2D256C7E70034455D3A3C8BD6E1BB39D2393261B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\Setup.INI
- Size 1KB
- SHA256 1419c326401603872949b985e00821047ecb0c6eaed7e27fb15ce784f3e93894
- MD5 2465ea2391786fa25811d97279169bd1
- SHA1 90c4073015ec08ed576352a20d5092ed1ecf8a72
- SHA512 f2a179699a5e7585be6633ed7cbec0e8ffce9c00eb27b5bae47717ee7de7da6ba7789b7f800995426040448e50f690e1755e5515665858ec88909bc582e7eb65
- TLSH T1A0319B4135BB19EDA31B72B76EB2038339C522144D167219F3484AE4DFADA27533E2A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\_ISMSIDEL.INI
- Size 509B
- SHA256 060ae318cbb475ccd9772c6bca14869d1929e3ecb023e4b41c6f0876b7f1b68b
- MD5 d0136ba08173a4815620e42b1198373a
- SHA1 4243b03b6f56c6b7022a229a2df45c19e3232b9e
- SHA512 6e0c054d75b9928b18fd1aba3e6607cbc23907fe3e6a54cb43dd58977c216634e5af6883da0fe052ea3cc95779cf2f1af1c22f732eeefd53ccfe7aade0237f60
- TLSH T1FCF0E9306B4BDBCB40A4036E2FAEB20CD993ED0D6F4113A08D7195683553808EFD2355
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\_ISMSIDEL.INI
- Size 11B
- SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
- MD5 3fdd2635aa94921522af8186f3c3d736
- SHA1 0fe63553e9f993c0cb2cb36b8cdcfba4f4a2650d
- SHA512 ebdbeefbdc777937fce516a1cbd9af7c305fc242091d695ad919a27c98fac5b6b16b44130bdf97dbfd10561cce701180b1fbb303d848944c3b33b8a3c058653a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{CA0E8FF0-8B84-4E5A-878E-F7059DFFC9AF}\_ISMSIDEL.INI
- Size 297B
- SHA256 90c7de4c218a229dd035e1c7abfb1403c484c2bb6dc2c39253d6db164122c9d9
- MD5 630b4ad0adf8b886eb29f324e60c1f90
- SHA1 ed8569943ce2f0297de5392cae014f5e72a7df02
- SHA512 67ef3092d6434b37f39c4bef505d004144a7976207c727d7097f60c9152798823a5bddabcf6a16b3a070cb27e2fe08b2169c50fb4ec123dcc429c5041bc97e47
- TLSH T147E01274BB47DBCA80A4121E2FBE710CCA93EC086F4516954E7196183557448DFD3366
- MD5 SHA1 SHA512 TLSH