Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
Setup for Outlook.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup for Outlook.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Setup for Outlook.exe
- Size 39.0MB
- Sample260804-c8fk3abg72
- SHA256 909efe01acf7a77071886f875fffc45ac970d7572a0f117c67f759e2c5ba8cd6
- MD5 24c83c93ffa7821e52b4cc380790a776
- SHA1 c55447523efa71fcbdc8717a526e9fc304a90cbe
- SHA512 95b90ab034c52b28ef9d63907fcb2737418b9da0f1994fca2917ff4fb393d89fda030492800635d5a6c6fa350d0ae30b0b0f70a8b3165535aefed14ebc953863
- SSDEEP 786432:bQF24UlakWss09pMXFqCs3YXjeA1qCQRIjG:bYDbkW4pMXns3YqbRIq
- TLSH T18897CF390E4A45B9A3BDBB571E37B64003E882F9B181BF78A94104C616E1FEE5CE5D43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\D: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\V: msiexec.exe - Loads dropped DLL 6 IoCs
pid Process 3692 MsiExec.exe 3692 MsiExec.exe 3692 MsiExec.exe 3692 MsiExec.exe 3692 MsiExec.exe 3692 MsiExec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup for Outlook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2496 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2496 MSIEXEC.EXE Token: SeSecurityPrivilege 5072 msiexec.exe Token: SeCreateTokenPrivilege 2496 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2496 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2496 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2496 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2496 MSIEXEC.EXE Token: SeTcbPrivilege 2496 MSIEXEC.EXE Token: SeSecurityPrivilege 2496 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2496 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2496 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2496 MSIEXEC.EXE Token: SeSystemtimePrivilege 2496 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2496 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2496 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2496 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2496 MSIEXEC.EXE Token: SeBackupPrivilege 2496 MSIEXEC.EXE Token: SeRestorePrivilege 2496 MSIEXEC.EXE Token: SeShutdownPrivilege 2496 MSIEXEC.EXE Token: SeDebugPrivilege 2496 MSIEXEC.EXE Token: SeAuditPrivilege 2496 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2496 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2496 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2496 MSIEXEC.EXE Token: SeUndockPrivilege 2496 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2496 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2496 MSIEXEC.EXE Token: SeManageVolumePrivilege 2496 MSIEXEC.EXE Token: SeImpersonatePrivilege 2496 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2496 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2496 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2496 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2496 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2496 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2496 MSIEXEC.EXE Token: SeTcbPrivilege 2496 MSIEXEC.EXE Token: SeSecurityPrivilege 2496 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2496 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2496 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2496 MSIEXEC.EXE Token: SeSystemtimePrivilege 2496 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2496 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2496 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2496 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2496 MSIEXEC.EXE Token: SeBackupPrivilege 2496 MSIEXEC.EXE Token: SeRestorePrivilege 2496 MSIEXEC.EXE Token: SeShutdownPrivilege 2496 MSIEXEC.EXE Token: SeDebugPrivilege 2496 MSIEXEC.EXE Token: SeAuditPrivilege 2496 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2496 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2496 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2496 MSIEXEC.EXE Token: SeUndockPrivilege 2496 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2496 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2496 MSIEXEC.EXE Token: SeManageVolumePrivilege 2496 MSIEXEC.EXE Token: SeImpersonatePrivilege 2496 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2496 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2496 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2496 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2496 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2496 MSIEXEC.EXE 2496 MSIEXEC.EXE - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2496 MSIEXEC.EXE 5072 msiexec.exe 3692 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4716 wrote to memory of 2496 4716 Setup for Outlook.exe 89 PID 5072 wrote to memory of 3692 5072 msiexec.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup for Outlook.exe"C:\Users\Admin\AppData\Local\Temp\Setup for Outlook.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\Mail Merge Toolkit.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F01F4FBC2C4B59CAFB5B449AF7EC248 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3692
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI578C.tmp
- Size 62KB
- SHA256 cd05434124848ef9e7a20863350445b60b09dc1c065d2b083aa5f9e4ee46df61
- MD5 3c2b341d4952169e5e5d55896804f802
- SHA1 5ababf93bc2c7f6e73e072f0c01894a82739d64e
- SHA512 31c7c98c73aa179c78dd9a86077b981ae77174b0f715355970ce18ffbe2c734a955b72bf2d603b3d6652f14d381047d08b68a247fbe1972e0eac236308a7f07e
- SSDEEP 768:Z0J8+QCTqaxxKkUmFVSarTJym3OZESrcvFKUPwPPOJh2Ip41bxf1mlbN5+:1CTqYttXDJT+lcrPwPs893fIbT+
- TLSH T1B253AF4569E140B3CB879A3151E5DF17BF3E6B921EE144839FF299960D273C0E33A20A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6FD8.tmp
- Size 778KB
- SHA256 d03a3d943fa24e54f473e9cf721ed2944d5627a150b7b745394b6d9b84b0c96d
- MD5 3275aa7a02d4ab48b31224a2996f5806
- SHA1 264beaee8e160c61a5e0fe69eebbd0b4bca9e452
- SHA512 d1bda3f03521aedbcb0f5277e5de413e10661ca95e027fd96298a8f07a51b93af72a9e85cae74fbd95eb991125f199c87d1a87e13ce38646254101c85eec19d2
- SSDEEP 12288:oRkxFDNAq643SbQC4kvUrnJZjwJQaS+IS0oa3Q20eI8wdVasIBfA2xCS:PxZ3wJooa3FvI8wdVasIhM
- TLSH T1C6059E01FB89C179CA4E1577507FA71E217AA6A65F308BC3B6846B6DDD302C1BD3E206
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI716F.tmp
- Size 94KB
- SHA256 2118aed32903188abab59d4cd7846fef4723a520d485e71245bd1243681988ae
- MD5 24e9a52029733e90ea43ab278fac0db4
- SHA1 d74dfa01f1001529385f8bbb668f47d5bd2148c8
- SHA512 527d3982f59866eb9abdf16032127b4730d4e348e0e67b8d585ab2c2337cf847f8b6a1222ccaa98ae8a94bfcb17828158ed0ea40353e708d4af5901312dd949e
- SSDEEP 1536:eivk7DtT4NxMQxmWthib9C0X/niKJK+TcAyc/idw5eEPwPs89cfIbT7IQ:3cnsx1FTidK+TcAyc/i254bXB
- TLSH T195939E1175A482B3C289453095A5CF37EB7DBF920FF184C3D769EA891C617D0E33A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\0x0409.ini
- Size 5KB
- SHA256 57e020c41ad0566fb55415a40167a0c3da89584bc4e5f961d8e8c646f80c5590
- MD5 52d179ad79966752ec40a678fd8b0062
- SHA1 f12df9b03090286d1093b5421aea3acc358cc032
- SHA512 b5fb5002f1947a765a83c9a960c378b04adfe7acebbd8be79dca07c73d7ff96f5e988d8b6995c8ba6156a74ecdb0084e543090704080ea3095dbb80835cdf9c5
- SSDEEP 96:VXoB2Ahl8/T3INLfRtMx76U0KOFWgVQMG2Uub0QAg80SbtEBapIx0KsLK3E0cTBY:JIYT3wLfRA0v/tBAvCSEB90C
- TLSH T189C1754E4FA6837E2861031AB16F2650F326956D5363D167B1EF005C7383E1893BB6E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\1033.MST
- Size 32KB
- SHA256 2db94bfb262a2c7143a4cbca182153fce829432957cd1793831d70552eeae26d
- MD5 7453b1be12256c57df9bbb63b4e9060e
- SHA1 5167589e9544bfe97f66ca00a5deb1212b14dc54
- SHA512 b9e765b377ff59f9e5eb096dbef27ccd2d1c45b3e2978aa6c627bf8a99e6280997d6004d06328c1b6445f077a247d0e6b46e9520f8b65eb452300df848f2d560
- SSDEEP 96:avnCk7jkinnutjmGJB6u+qc2/FdOI6xrwult/c8fk4+LE/FpsWbqBYJuxrv87dC+:K7dxGJoB2/FYEWs4/FZoxT
- TLSH T19AE21B2A32145333C28801B15F5AC1DE733AEC65B9EBD223B491F35F13379762AA24D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\Mail Merge Toolkit.msi
- Size 38.6MB
- SHA256 25fe808754c6655a394bfdf8587ba5e5e7a87e88bc452aa637664db424dc9453
- MD5 48c14266a6e39df5daf15c0c417189c2
- SHA1 717aac44dca22789dc4494e6f957a7d29814f8d5
- SHA512 6b492d621c662d4c273895be1e8d92654f7374853b8dcd28584fd3ab4a0fda6093b2642300d985371f411e029451245187dd2b244431dccaa0345b06855828b9
- SSDEEP 786432:0U18ntnb1fuBfRLIPy+xaqYTK8AktPYXTH2sb1YVV:0u8ntnVuBfRsPy+xl7GPYXrrhYV
- TLSH T1ED97CF01F221C129F5AF14B6E9BE9E2D256C7E70034455D3A3C8BD6E1BB39D2393261B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\Setup.INI
- Size 1KB
- SHA256 1419c326401603872949b985e00821047ecb0c6eaed7e27fb15ce784f3e93894
- MD5 2465ea2391786fa25811d97279169bd1
- SHA1 90c4073015ec08ed576352a20d5092ed1ecf8a72
- SHA512 f2a179699a5e7585be6633ed7cbec0e8ffce9c00eb27b5bae47717ee7de7da6ba7789b7f800995426040448e50f690e1755e5515665858ec88909bc582e7eb65
- TLSH T1A0319B4135BB19EDA31B72B76EB2038339C522144D167219F3484AE4DFADA27533E2A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{46DB6107-BF99-4129-8F66-7F9C923DF054}\_ISMSIDEL.INI
- Size 11B
- SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
- MD5 3fdd2635aa94921522af8186f3c3d736
- SHA1 0fe63553e9f993c0cb2cb36b8cdcfba4f4a2650d
- SHA512 ebdbeefbdc777937fce516a1cbd9af7c305fc242091d695ad919a27c98fac5b6b16b44130bdf97dbfd10561cce701180b1fbb303d848944c3b33b8a3c058653a
- MD5 SHA1 SHA512