b93fdcd1136faa9a8cb73a329b2f1f5f430a150ddcec35de916e3a1539f09351

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Size 1.7MB
Sample260809-wvsg9atbnb
SHA256 b93fdcd1136faa9a8cb73a329b2f1f5f430a150ddcec35de916e3a1539f09351
MD5 61a5fb191ae2ae876db31dcce75e4183
SHA1 751669c38b666c7435b2a65a5c6fe40435d59aaa
SHA512 76ed473ff370255e7b09a931c10e1aea7d9d84b4655d85e9ad28faa5f143bb9063c363829a28614fb89cd00c4755e825268123e5f6f4849a0db9328297811ffc
SSDEEP 49152:OFxErb1F2gqQF6d8RrycC51DtuoIwgpXIfWzbnoP2qDAV:2Gb1FLqQF6dWry//DthQiooP2qDAV
TLSH
T121853342A7DE453BD0BA1BB0B5F91A637BBA38D0ADB6F76C3302494408316D14D7936B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
236	msiinst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	instmsiw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	instmsiw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiinst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 236	4844	instmsiw.exe	89

C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\instmsiw.exe
"C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\instmsiw.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe /i instmsi.msi MSIEXECREG=1 /m /qb+!
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msiinst.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
Size 51KB
SHA256 f714271380241db1825d0762e4895d8640205e55e50bafc7b141def5bc1afd6b
MD5 a6312824f6abf5dd300b2f321d251f5a
SHA1 d33f361232373c0092721bff9093f5cde6eebfc2
SHA512 78ad9fbfb0b6d5ecd4b2c56e54b7c46fd80bab685a28a4c2aff11f21417d379728ea3b3be97222c44e09037e19be50110bba1dd7b350659fd22f0913cbc56af1
SSDEEP 1536:LWfrvcA7Hvf62GQiWLNFEi2tKZmcgIHq+:qfD7attazeKgcgIHz
TLSH
T12633D400B3F8823AF1F36FB12A7887124B7ABC505E74D74E0704994E6A31A99DE75723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads