Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
RaiDrive.Mount_2026.6.25_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
RaiDrive.Mount_2026.6.25_x64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target RaiDrive.Mount_2026.6.25_x64.msi
- Size 32.6MB
- Sample260818-nyfc4aam41
- SHA256 b8be8ad1d265fe1a3ed22345c0ce240cbddc6fb140c70c9140284d4bb943d6f3
- MD5 892fdae4b09c58c9f3db0389089481b2
- SHA1 2bbe71e68605affc6937069575beff2be79f9921
- SHA512 0a29e15e3813266d85804c8b6cacdc311a11385fb44c5d667f4e827c24082686a4fb2a0ceb7409ca40b34d1e5141d41974a4654241e282f9c910711ccd768c09
- SSDEEP 786432:NClYoOEIHrfdtBsBS1Aa+Y9FG3gGQ2iNAVUvMZZ9GWCjNGNYHzJe:wlYoOEIHrfdt31Aa+YewGyNtuZYWCjN4
- TLSH T1A5771221719AC037D15E02725928DB6BA1BD6EB94B7140D773EC7E2E2BB50C14332EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 13 IoCs
pid Process 3164 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe 2488 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4256 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4256 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4256 msiexec.exe Token: SeIncreaseQuotaPrivilege 4256 msiexec.exe Token: SeSecurityPrivilege 2404 msiexec.exe Token: SeCreateTokenPrivilege 4256 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4256 msiexec.exe Token: SeLockMemoryPrivilege 4256 msiexec.exe Token: SeIncreaseQuotaPrivilege 4256 msiexec.exe Token: SeMachineAccountPrivilege 4256 msiexec.exe Token: SeTcbPrivilege 4256 msiexec.exe Token: SeSecurityPrivilege 4256 msiexec.exe Token: SeTakeOwnershipPrivilege 4256 msiexec.exe Token: SeLoadDriverPrivilege 4256 msiexec.exe Token: SeSystemProfilePrivilege 4256 msiexec.exe Token: SeSystemtimePrivilege 4256 msiexec.exe Token: SeProfSingleProcessPrivilege 4256 msiexec.exe Token: SeIncBasePriorityPrivilege 4256 msiexec.exe Token: SeCreatePagefilePrivilege 4256 msiexec.exe Token: SeCreatePermanentPrivilege 4256 msiexec.exe Token: SeBackupPrivilege 4256 msiexec.exe Token: SeRestorePrivilege 4256 msiexec.exe Token: SeShutdownPrivilege 4256 msiexec.exe Token: SeDebugPrivilege 4256 msiexec.exe Token: SeAuditPrivilege 4256 msiexec.exe Token: SeSystemEnvironmentPrivilege 4256 msiexec.exe Token: SeChangeNotifyPrivilege 4256 msiexec.exe Token: SeRemoteShutdownPrivilege 4256 msiexec.exe Token: SeUndockPrivilege 4256 msiexec.exe Token: SeSyncAgentPrivilege 4256 msiexec.exe Token: SeEnableDelegationPrivilege 4256 msiexec.exe Token: SeManageVolumePrivilege 4256 msiexec.exe Token: SeImpersonatePrivilege 4256 msiexec.exe Token: SeCreateGlobalPrivilege 4256 msiexec.exe Token: SeCreateTokenPrivilege 4256 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4256 msiexec.exe Token: SeLockMemoryPrivilege 4256 msiexec.exe Token: SeIncreaseQuotaPrivilege 4256 msiexec.exe Token: SeMachineAccountPrivilege 4256 msiexec.exe Token: SeTcbPrivilege 4256 msiexec.exe Token: SeSecurityPrivilege 4256 msiexec.exe Token: SeTakeOwnershipPrivilege 4256 msiexec.exe Token: SeLoadDriverPrivilege 4256 msiexec.exe Token: SeSystemProfilePrivilege 4256 msiexec.exe Token: SeSystemtimePrivilege 4256 msiexec.exe Token: SeProfSingleProcessPrivilege 4256 msiexec.exe Token: SeIncBasePriorityPrivilege 4256 msiexec.exe Token: SeCreatePagefilePrivilege 4256 msiexec.exe Token: SeCreatePermanentPrivilege 4256 msiexec.exe Token: SeBackupPrivilege 4256 msiexec.exe Token: SeRestorePrivilege 4256 msiexec.exe Token: SeShutdownPrivilege 4256 msiexec.exe Token: SeDebugPrivilege 4256 msiexec.exe Token: SeAuditPrivilege 4256 msiexec.exe Token: SeSystemEnvironmentPrivilege 4256 msiexec.exe Token: SeChangeNotifyPrivilege 4256 msiexec.exe Token: SeRemoteShutdownPrivilege 4256 msiexec.exe Token: SeUndockPrivilege 4256 msiexec.exe Token: SeSyncAgentPrivilege 4256 msiexec.exe Token: SeEnableDelegationPrivilege 4256 msiexec.exe Token: SeManageVolumePrivilege 4256 msiexec.exe Token: SeImpersonatePrivilege 4256 msiexec.exe Token: SeCreateGlobalPrivilege 4256 msiexec.exe Token: SeCreateTokenPrivilege 4256 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4256 msiexec.exe Token: SeLockMemoryPrivilege 4256 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4256 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4256 msiexec.exe 2404 msiexec.exe 3164 MsiExec.exe 2488 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2404 wrote to memory of 3164 2404 msiexec.exe 90 PID 2404 wrote to memory of 2488 2404 msiexec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RaiDrive.Mount_2026.6.25_x64.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4256
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E18949AFDD1BD2074149D0F60F2B1250 U2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3164
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 98E8ABF484AF17372A11E1D62A4E1B64 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI25039\EmbeddedUI.dll
- Size 3.3MB
- SHA256 bf79389a07bd67f1d80d3ae0ed6a540df1f638a598fc6c6af42e0e7689f13060
- MD5 f70e0b9f5f1425d9e386c48bb69119b5
- SHA1 dfe6f01f1280978cfb08efa8db1eb2f36fb50269
- SHA512 f3b5381e05a839a3a7619571a21a08aa8c80aa614f279fea2a76b1663051c556d7758e50566c9adc6a6480b72acd5da01f86ab8c9ffb10c369f91d70b9513d5c
- SSDEEP 98304:fM7OEIHrfd0FsgaybBLew2O7lCNoWahCtGip:fM7OEIHrfdtylLesHhSGO
- TLSH T148F56D32615AC126D16E11B1152CDAAFA12D5FAE4BB004D7B3EC6E6E67384C35333E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2E0B.tmp
- Size 738KB
- SHA256 118a551eef23bf842ed470316aa1a50bf17b6d656652879802d4acc0184608ca
- MD5 ee45c6dffaf86ed2a76d8f969c390c08
- SHA1 ff5b2942ffa7d28ed3f72208e8e76391b2991b5a
- SHA512 a92bc7aff5da3dc33263ea3d43cf617d47a2a6c589118f7ee3c5f293d63171778a7a37815ec23cb426558546cf0a1e694c67c7cbc36cca92677de566d1d71664
- SSDEEP 12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
- TLSH T117F46C2139C9C02AD56D01B12AFCDA6B912EBD7A4B7144CBA3D8AD7B19F14C29335F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI395D.tmp
- Size 875KB
- SHA256 f754814bda0f682382da00f49f21eb66f47c02504e4fb9322bc8068f0f168b41
- MD5 0100adb48a98b69b29b817fc65547aa8
- SHA1 958c3a436211758373087efa732fa5e9fb16f5b3
- SHA512 00203279917359ba4838f7232d9cd8db479cf61506aa4dbbb08e6e53b0cfdc5c489928e97cd936df2b7d46d71073d78294085e3ad3e6974c07d242d8c0f9a6b0
- SSDEEP 24576:iHURIFar5sNBN/Th0lhSMXl3M50fZA8rZY0:iDBVis50fZA8rZY0
- TLSH T176155AB1259EC036F16D02B1363D8EBBA52D6E770FB160DB63D0693A69348D21631E1F
- MD5 SHA1 SHA512 SSDEEP TLSH