267304efcc831e35927c1f25d610d36fb64121d108a6f4ff0168c53df01e2b16

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server/W2K3_W2K8/DrvInst/instmsia.exe
Size 1.6MB
Sample260809-wvsg9atbnb
SHA256 267304efcc831e35927c1f25d610d36fb64121d108a6f4ff0168c53df01e2b16
MD5 43f7305c2e5dd4a8f3c5abeb2ffe4833
SHA1 03bda624ab7f0d7cb9ada41a960c35c0152f98fd
SHA512 e24072f1b5b102fbd52126396854463ff07d8d0efce1d922ed99acd0369cff163e415abc1faeaf559ef7898e5f82945db544a0f425db0db42696282d0acd7c7c
SSDEEP 49152:Ru0LSVHASxN9aD7sOP93ZPaZRNsa95ZN5T:o0mVgSxa872av9
TLSH
T16D852382DBE94632F0351B7558F6232B3B347DA95D36EB2EAE43008518735C4A5B4B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1252	msiinst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	instmsia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	instmsia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiinst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1252	4608	instmsia.exe	89

C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\instmsia.exe
"C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\instmsia.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe /i instmsi.msi MSIEXECREG=1 /m /qb+!
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msiinst.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
Size 36KB
SHA256 a68d8931dc6ddf89cd36374f1fa5a01aaca3fb4694610cd9ef1ff62d53332515
MD5 5e9189e28544286137eb313100835892
SHA1 a8ae60ab85015e70a2cdf171919b3296b5b831d1
SHA512 11eb6914b78738517b483ad21bc0282c78580b5bf7f9c9abc6570fedb5d82775cda2cb629c7c37e636937637103cb19d282b6e3175bfc1edf6e0484f1810b52c
SSDEEP 768:BqKf/OF1uPhuk587EMp6aJYCDOlGCfuXnFm2cE9JU:EKnOF1yhukQEMp6p4OlGCfun42c6JU
TLSH
T177F27D01B3A4C47BC0D1457127A84B2A5BBB9C240BB4178E5B845A4EAB663E5FF393C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads