Analysis
- max time kernel
180s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Eraser 6.2.0.2993.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
Eraser 6.2.0.2993.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Eraser 6.2.0.2993.exe
- Size 8.4MB
- Sample260809-pfqa1sxdrb
- SHA256 062ccb4e9e6f90d3e5b0df23a4c85c65690a1b527a70015c914e17468fc74bbc
- MD5 ccc33a97215d0f681f0a93e9c2cbea21
- SHA1 4264b1e46b1f4d0e98659c8167994197a87f6a11
- SHA512 767e162aa88da7f05f6a304152c1baba928418eb59f7a657bdb0959a96f01a6aa280565231ac6d0ae1d85c3b78595d8e21011e11d0ec8566a958904556309d54
- SSDEEP 196608:4LP77AnQvG91X+fOqHi2z6/o7W7D8Jsj/7dPV7MgsKXLB6:4L/UH2fnz6Q7W7oO//AgsKXLw
- TLSH T11096332433D6D0F4D1E1153584A867B85E3EDE129F51CAFF6BD92F2A1A601C12A30FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eraser 6.2.0.2993.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 3384 msiexec.exe Token: SeIncreaseQuotaPrivilege 3384 msiexec.exe Token: SeSecurityPrivilege 5376 msiexec.exe Token: SeCreateTokenPrivilege 3384 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3384 msiexec.exe Token: SeLockMemoryPrivilege 3384 msiexec.exe Token: SeIncreaseQuotaPrivilege 3384 msiexec.exe Token: SeMachineAccountPrivilege 3384 msiexec.exe Token: SeTcbPrivilege 3384 msiexec.exe Token: SeSecurityPrivilege 3384 msiexec.exe Token: SeTakeOwnershipPrivilege 3384 msiexec.exe Token: SeLoadDriverPrivilege 3384 msiexec.exe Token: SeSystemProfilePrivilege 3384 msiexec.exe Token: SeSystemtimePrivilege 3384 msiexec.exe Token: SeProfSingleProcessPrivilege 3384 msiexec.exe Token: SeIncBasePriorityPrivilege 3384 msiexec.exe Token: SeCreatePagefilePrivilege 3384 msiexec.exe Token: SeCreatePermanentPrivilege 3384 msiexec.exe Token: SeBackupPrivilege 3384 msiexec.exe Token: SeRestorePrivilege 3384 msiexec.exe Token: SeShutdownPrivilege 3384 msiexec.exe Token: SeDebugPrivilege 3384 msiexec.exe Token: SeAuditPrivilege 3384 msiexec.exe Token: SeSystemEnvironmentPrivilege 3384 msiexec.exe Token: SeChangeNotifyPrivilege 3384 msiexec.exe Token: SeRemoteShutdownPrivilege 3384 msiexec.exe Token: SeUndockPrivilege 3384 msiexec.exe Token: SeSyncAgentPrivilege 3384 msiexec.exe Token: SeEnableDelegationPrivilege 3384 msiexec.exe Token: SeManageVolumePrivilege 3384 msiexec.exe Token: SeImpersonatePrivilege 3384 msiexec.exe Token: SeCreateGlobalPrivilege 3384 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3384 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3384 msiexec.exe 5376 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5216 wrote to memory of 3384 5216 Eraser 6.2.0.2993.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eraser 6.2.0.2993.exe"C:\Users\Admin\AppData\Local\Temp\Eraser 6.2.0.2993.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\eraserInstallBootstrapper\Eraser (x64).msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3384
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\eraserInstallBootstrapper\Eraser (x64).msi
- Size 25.5MB
- SHA256 496c01d7daa83d21050b4e1e0ad5c2564c0f5c363c5dd2ab93bb375158bb46f5
- MD5 bfd205e32d852dfbb69ee4d99dc1aec4
- SHA1 2d2ace7a6bc02b6375c607952a41c0f3df84ba20
- SHA512 80b087e8a5e30ee95537080172ef845108d3daeee36ad9eae086f61aa95624506ee814814d2bff3eb46dc373a4363d71c77ce3e1a4734fbcc428a667d19b98ec
- SSDEEP 196608:cZQdd33340TV6HHP2R/lBoIaQeHjrlxMsHMTa4AKDk75lLt/ed3y6N1THZwGgFL8:wQ9TmMqMeKilAwGgFvhw
- TLSH T15F477C4AABAC8552E5BA9634896B4A07D773BC016B72D3CF1025729E2F337D14E35323
- MD5 SHA1 SHA512 SSDEEP TLSH